Business Continuity: A Practical Plan for Disruption

Welcome. In this lesson, we will explore continuity as a business responsibility.

Explain why continuity involves more than recovering IT.

Consider people, premises, suppliers and systems together. Focus on the activities that deliver essential products or services. Assign business ownership for continuity decisions.

Begin with the service the customer needs, then identify the activities that keep it running. Work backwards to people, information, facilities, suppliers and systems. A backup server cannot replace an absent authorised approver or a blocked access road. Decide which business owner can prioritise limited resources during a disruption.

Consider this example. A company restores its server but still cannot dispatch orders because its only courier is unavailable. Continuity planning must include that dependency.

Pause here and try this activity. List a disruption that could stop your business even if every computer still works.

Here is one possible response. Dispatch relies on pickers, stock information, packing space and a carrier. If the carrier is unavailable, restoring the server does not restore delivery. The operations manager evaluates an alternate carrier and tells customer service what can realistically be delivered.

Before moving on, think about this question. Which statement best describes business continuity? The best answer is: Maintaining or recovering critical business activities. Business continuity considers all the resources needed to deliver critical activities.

Welcome. In this lesson, we will explore business impact and priorities.

Identify how the impact of a disruption grows over time.

Assess operational, financial and customer consequences. Identify critical periods such as payroll or delivery cut-offs. Use the findings to prioritise activities and resources.

A business impact analysis asks how consequences change as interruption continues. Do not rank activities only by department size or seniority. Consider deadlines, customer commitments, cash flow, safety and dependencies. Describe the minimum level of service needed, then agree priorities with the accountable business owners. Numbers in an exercise are assumptions to validate, not universal recovery targets.

Consider this example. A four-hour outage has different consequences for a payroll run on pay day and for a routine internal report. Business impact helps distinguish their priorities.

Pause here and try this activity. Choose two activities. Describe the effect of a two-hour, one-day and three-day interruption.

Here is one possible response. Payroll on pay day: two hours reduces the checking window; one day may miss the pay run; three days prolongs employee impact. A routine monthly dashboard may tolerate longer interruption. Confirm payment cut-offs and dependencies before approving their relative recovery priorities.

Before moving on, think about this question. What is the main purpose of a business impact analysis? The best answer is: Understand disruption impacts and recovery priorities. A BIA examines consequences over time so the organisation can choose recovery priorities.

Welcome. In this lesson, we will explore recovery objectives.

Distinguish how soon an activity must resume from acceptable data loss.

A recovery time objective is a target time for recovery. A recovery point objective describes acceptable data loss measured in time. Validate that proposed recovery arrangements can meet the agreed targets.

Keep downtime and data loss separate. RTO is the recovery-time target; RPO is the acceptable age of recoverable data, expressed as time. A four-hour RTO does not mean four hours of data loss is acceptable. Recovery targets should fit within the business's tolerable disruption and be supported by tested arrangements, including reconciliation after service returns.

Consider this example. An order system has a four-hour recovery target and a one-hour data-loss tolerance. A daily backup alone may not meet the data recovery requirement.

Pause here and try this activity. For one critical system, discuss a recovery-time target and the maximum tolerable gap in transaction records.

Here is one possible response. Illustrative order system targets: restore minimum service within four hours, and recover data no more than one hour old. A nightly backup alone does not demonstrate the one-hour RPO. Test restoration, verify transactions and define how missing orders would be reconciled.

Before moving on, think about this question. A one-hour recovery point objective concerns what? The best answer is: Data loss measured in time. RPO concerns the point in time to which data should be recoverable.

Welcome. In this lesson, we will explore options and dependencies.

Choose workable alternatives for critical resource failures.

Map important dependencies and single points of failure. Assess alternative staff, sites, suppliers and work methods. Check that a workaround preserves necessary controls.

An alternative must be available when the original fails. Two suppliers may depend on the same warehouse or transport route. Test capacity, access, lead time and necessary approvals. Specify the maximum duration or volume a workaround can support. Manual work needs numbering, approval and later reconciliation so continuity does not create uncontrolled records.

Consider this example. A service team agrees an alternative contact number and manual request log for an outage. Staff know who can approve urgent work and how records will later be reconciled.

Pause here and try this activity. Select one dependency and define an alternative plus the limit of what it can support.

Here is one possible response. Alternative: accept up to twenty orders daily on controlled numbered forms while the system is unavailable. The supervisor approves each batch and safeguards the forms. Once restored, reconcile every form against the system before retiring the temporary log.

Before moving on, think about this question. A manual workaround should include which control? The best answer is: Clear approval and later reconciliation of records. Workarounds should maintain essential controls and support a reliable return to normal operations.

Welcome. In this lesson, we will explore a usable continuity plan.

Create concise instructions that remain accessible during disruption.

State who can activate the plan and how decisions are escalated. Maintain current contacts and alternative communication routes. Write the first actions and recovery steps in plain language.

Design the plan for a stressed colleague, not for a shelf. Put activation triggers, decision authority, alternate contacts and first actions near the front. Ensure authorised staff can access a copy when normal systems fail. Use verified contact details, identify who updates them, and separate staff safety actions from service recovery decisions.

Consider this example. A continuity plan names the decision-maker, an alternate and the first five actions. An accessible offline copy prevents the plan being trapped in an unavailable system.

Pause here and try this activity. Draft a one-page plan for one disruption, including activation, contacts and the first actions.

Here is one possible response. Trigger: dispatch cannot operate from the main site. Operations manager or deputy activates the plan. First: confirm staff safety, assess interruption, contact the response team, establish a reliable communication channel and decide the minimum service. Record decisions and the next update time.

Before moving on, think about this question. What makes a continuity plan usable during an outage? The best answer is: Accessible instructions with clear roles and contacts. Accessibility, clear ownership and practical instructions make the plan usable under pressure.

Welcome. In this lesson, we will explore exercises and improvement.

Use a scenario to test assumptions without disrupting live operations.

Run a discussion exercise with the people named in the plan. Record decisions, missing information and failed assumptions. Assign improvement actions and repeat exercises after significant changes.

A tabletop tests decisions and assumptions through discussion; it does not prove technical recovery. Introduce new information in stages and ask what the team would do, who decides and what evidence is missing. Close with actions, owners, deadlines and a retest. Keep the exercise separate from live systems unless a controlled test has been specifically approved.

Consider this example. In a tabletop exercise, the backup contact number is wrong. The team corrects it, assigns an owner and adds contact verification to the review schedule.

Pause here and try this activity. Run a 20-minute discussion: your main office is unavailable tomorrow. Record three decisions and one improvement.

Here is one possible response. Scenario: office inaccessible at 9 am; at 9:10 the alternate approver is unavailable; at 9:15 a key customer requests an update. Record the deputy decision route, minimum service and communication owner. Correct the stale contact list and verify it before the next exercise.

Before moving on, think about this question. What is the most useful output from a continuity exercise? The best answer is: An action list with owners and completion dates. Exercises create value when findings lead to specific improvements and follow-up.