In this bulletin, Charlie discusses business continuity in Saudi, where he has been conducting exercises and workshops.
This week, I have been in Riyadh delivering a series of workshops, exercises, and business continuity reviews. Therefore, I will be sharing some thoughts on what I have learned. I have been to the country many times before COVID however, this was my first time since the pandemic. This time, I went over to work for a different organisation, and I feel as though I have a better picture of general business continuity now after seeing more than one organisation. The bottom line is that Saudi is a hotbed of good business continuity practice. During my visit, I was really impressed with the level of business continuity and the skills shown in the kingdom.
I have only worked for two banks but both had ISO 22301. I am not sure how many banks in the UK have that particular standard. The business continuity management system in the bank I was working with, had been implemented by local Saudi business continuity professionals rather than consultants. A number of employees have ISO 22301 internal audit qualifications, so it seems that they have the skills to do their own internal audits. As a consultancy in the UK, in 15 years we have only supported eight organisations to ISO certification. There appears to be a pool of staff in Saudi who can do the implementation. The ISO process might suit the Saudi ways of working, and they are keen on the process, methodologies, getting everything signed off, and are so used to some of the quiet time, and labour-intensive processes ISO 22301 requires!
In the banking sector, the regulator SAMA is very strong and there is a high level of requirements on regulated organisations to have business continuity in place. One of the requirements is to practice data centre switch, from the primary to the secondary each year. This involves the full process of switching with all the risk it entails, running on the secondary for a week and then switching back. We all know that data centre tests are fraught with danger and alongside the possibility of the implementation of the switch going wrong, there is also the impact on customers, as banking systems may go down as the switch takes place. I am impressed by the commitment of the regulator to ensure that this takes place and is properly practised.
I have reviewed a number of plans here in Saudi, and I have been impressed with their quality. We at PlanB have a plan assessment tool and criteria for reviewing crisis and business continuity plans. When I did the assessment this morning the score was pretty good. When we reviewed it, after much discussion and argument, quite a few of the scores were improved. I can honestly say that the plans I viewed today were some of the best plans I had seen, and had one of the highest assessment scores.
Many of the business continuity professionals have been around for a long time, and I met with the former head of the business continuity department earlier this week, he had been a professional for 3 years. One of the incubators of business continuity talent is the Arab National Bank, and it seems that most of those in business continuity in Saudi have worked at the bank for some time. Their Chief Business Continuity Officer has more awards than me, and I see that he is down for another one at the CIR awards later this year.
There is an expanding push from the government in the kingdom for business continuity, and the requirement is moving from the financial sector to the government departments. There is also a huge programme of building new cities, with facilities for leisure, business and tourism and having a business continuity in place is part of their requirement. So the market here will expand.
In the UK we believe we are the vanguard of business continuity, but I think we need to be aware of the oasis of good practice in Saudi. I will leave you with a picture of Mohammed receiving a copy of my book, reading it will make the quality of business continuity in Saudi improve even further!!
