In this week’s bulletin, Charlie discusses the BCI’s CBCI Certification course and how it has changed from when it was first developed, and discusses his recent experience teaching a classroom CBCI course in Glasgow.
You aren’t meant to forget your first time, but I can’t remember the first time I taught the Business Continuity Institute’s (BCI) CBCI training course. Jim Burtles was one of Business Continuity Training’s first tutors, and he took me through the course before I taught it for the first time. I think my first course was in Glasgow in 2010, and I remember taking almost a week to learn the course and the Good Practice Guidelines (GPG) so that I could teach it. At the end of a week’s teaching, I took the exam on paper with the students on the Friday morning. I got a merit. I remember posting the students’ exam papers for marking and hoping that they didn’t get lost in the post! I was also employed by the BCI at the time to deliver their ‘live online’ course. I don’t remember the platform, but I taught students from all over the world. The course consisted of 4 weeks, teaching twice a week for two hours. Students could log on or listen in their own time. I do remember presenting once, from my bed, for two hours non-stop with nobody listening. As I was a consultant, when I was travelling on-site, I had to find somewhere to present. I did it from McDonald’s because they had Wi-Fi, but much to my students’ annoyance, they mostly heard the background music rather than my words of wisdom. I learned my lesson and didn’t do that again.
From these early beginnings to when I taught the course two weeks ago, much has changed, and I thought this week I would share some thoughts on the changes I have seen over the years.
The course format hasn’t greatly changed since the early beginnings of 2010. It is still slides and tutor-led. As in the early days, you as a tutor have to bring your own case studies, exercises, and experience to make the course interesting, ensure that students learn, and that those taking the exam pass it. So, in 14 years, there has been no major innovation in the teaching of the course.
When I first taught the course, the majority of students were on the course to learn business continuity as they had to go back and implement it for their organisation. On my course, everyone came from an organisation with a mature BCMS, and they were there as part of their role as a business continuity manager or a coordinator, and were there to understand the basics. Most students had between one and three years’ experience, so were relatively new to the profession. Some of my first courses had students who had been doing business continuity for several years but needed to or wanted to, learn how to do it ‘properly’, the BCI way, rather than being self-taught or learning from others in their organisation. The BCI/GPG way then, as it is now, is very much the acknowledged methodology for implementing business continuity.
On my course, we had two people who had cyber roles and were there to learn about business continuity. I am pretty sure that those on my past courses were all people with business continuity roles, and there were very few from allied professions.
My Glasgow course, for the first time, did a one day on-site at the Auchentoshan Distillery. This was the first time we went to a site so that we could use the processes as our case study. We conducted a tour to understand the process, and before the tour, the students spent all morning learning about BIAs and risk assessments so they could apply this knowledge to decide how they would conduct a BIA for the distillery. This worked, and we are thinking of using Auchentoshan and perhaps other organisations as the case study for the course, and conducting the training, or part of the training, on-site. It has taken me 14 years to come up with and implement this idea!
Over the years, the BCI has taken much more control over the course and those teaching it. As I hadn’t taught the course for a year, I had to recertify as a tutor. This involved me taking the exam, filling in a form, and supplying two referees who then had to provide a reference. I also had to sign a multi-page code of conduct, which gave me all the dos and don’ts of tutoring!
I think the course and the GPG have greatly improved over the years, and the 7.0 GPG version is the best yet. ‘Establishing a BCMS’, ‘Analysis’, ‘Enabling Solutions’, and ‘Validation’, represent business continuity as it is practised at the moment, which has not always been the case in GPGs. ‘Embracing Business Continuity’ has been largely rewritten, and I understand conceptually what it is trying to achieve, but I personally think it is too complicated and long-winded. I rather feel the same about ‘Solutions Design’. Both these sections are likely to be refined during the next iterations of the GPG and more aligned to what people actually do. On the whole, I feel that I can agree mostly with the present GPG and don’t have to say, as I had to do in the past, ‘this is what the GPG says, but in reality, it is done in a different way’.
My teaching of the course is very reflective of the business continuity profession at the moment. We have a lot more organisations with a mature BCMS, the qualification continues to be respected and desired, and other professions, such as cyber professionals, acknowledge that they need to understand business continuity. The content the course is based upon is greatly improved and much more realistic in terms of best practice. If you haven’t been on the course, it is well worth it, and we hope to see you on a future course.
Click here to see our upcoming live online CBCI course dates.
Click here to see our upcoming classroom CBCI course dates.
