In many industries, legislation plays a key role in defining how companies treat financial data or consumer data. In this area, the survey participants indicated that:
• Twenty percent continue to rely on internal audits to manage regulatory compliance.
• Approximately 80 percent indicated their business units were aware of legal and industry issues.
• Thirty five percent said they were fully compliant with industry regulations and have the full support of executive management.
The study found that many companies have not developed enterprise-wide business continuity programs, or they do not have the appropriate infrastructure in place to verify that one is properly maintained. This was noted by more than two-thirds of business continuity professionals surveyed, and is surprising in light of the September 11, 2001 terrorist attacks, numerous high profile computer viruses, and many natural disasters, such as the recent hurricanes in the Southeast, that have occurred in the U.S. during this period.
Many companies say that have placed a renewed focus on contingency planning, yet there are still several factors impacting the apparent lack of initiative in this area, including:
• Most organizations lack a senior level business continuity management champion that can influence both the company's culture and financial resources.
• Business units are reluctant to spend the time and money to implement "optional" programs.
• Creating an enterprise-wide BCM program can seem overwhelming to many organizations that are already resource-constrained.
• Corporate executives may operate under the belief that "it will never happen to our organization."
Approximately 200 management representatives from a wide range of industries, such as media/entertainment, financial/banking, transportation and government, responded to the survey. Respondents include corporate/general managers, risk management, internal audit or information security.
