On 22 July 2009, the U.S. National Fire Protection Association (NFPA) and Disaster Recovery Institute (DRI) International announced two new certifications for the audit of disaster, emergency management and business continuity management (BCM) programs:

• Certified Business Continuity Auditor
• Certified Business Continuity Lead Auditor

DRI and the Business Continuity Institute (BCI) offer professional certifications only (credentials bestowed upon individuals). Certification of organizations is available only through the British Standards Institute's British Standard (BS) 25999 standard, although the new U.S. Voluntary Private Sector Preparedness Program (PS-Prep) mandates the U.S. Department of Homeland Security to offer organizational certification. Neither professional nor organizational certification guarantees that you will recover from a disaster. You can succeed without them.

The new DRI certifications demonstrate personal knowledge in the auditing of BCM programs and cover BCM standards such as NFPA 1600 and BS 25999, as well as industry regulations and DRI's professional practices. They do not yet qualify a recipient to conduct organizational certification audits for PS-Prep or BS 25999. At this time, PS-Prep does not provide for individual certification, although it will establish auditor competency and qualification requirements. The International Registrar of Certified Auditors (IRCA) has worked with the BCI to develop the Business Continuity Management Systems Auditor Certification Programme for BS 25999. This certification serves as one qualification of a recipient to conduct BS 25999 certification audits and, like the DRI certifications, is voluntary but not required.

This announcement positions the DRI certifications to be used as a BCM auditor qualification through IRCA, Information Systems Audit and Control Association, or other certifying body. Under PS Prep and BS-25999, auditors need to work under an accredited certifying body to conduct organizational certification audits. Certified bodies and the process they use to qualify BCM auditors are accredited by ANSI-ASQ National Accreditation Board for PS-Prep, the United Kingdom Accreditation Service for BS 25999, and other accreditation bodies by country. PS-Prep has no certified bodies as the requirements have not yet been established. Many certified bodies around the world are authorized to conduct BS 25999 certification audits.

• Those seeking professional BCM program auditor certification: Use these new certifications to enhance your knowledge of BCM, but know that they have not yet been accepted by an official certifying body.
• Those seeking organizational BCM program auditor certification: The new certifications don't apply. Look to BS 25999 or wait for PS-Prep to announce its standards.

"Hype Cycle for Business Continuity Management, 2009” — For business and technology executives, the increasing costs and risks of business disruptions continue to drive the operations importance of business continuity management. By John Morency and others

"Business Continuity Management Defined, 2008” — Providing for continuity of operations following a disaster is a top-level concern for enterprises and is vital to maintaining financial confidence and the reputation of the organization. By Roberta Witty

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)