Business Continuity Beyond the Plan

Most organisations have business continuity plans. Far fewer could confidently say those plans would work. Recovery targets are set without checking whether technology can meet them, contact lists go out of date and exercises are postponed.

Standards such as NCEMA 7000 in the UAE and ISO 22301 internationally set out what good looks like. These are the areas we see make the biggest difference.

Base Everything on a Real Business Impact Analysis

The business impact analysis identifies critical activities, how quickly they must be recovered and what they depend on. It should be completed with the people who run those activities, and challenged where recovery targets look unrealistic.

Close the Gap Between Business and IT

A business recovery target of four hours means little if the systems behind it take two days to restore. Disaster recovery capabilities should be designed and tested against the targets the business has set.

Plan for People and Suppliers, Not Just Systems

Disruptions often affect people, buildings and suppliers as much as technology. Plans should cover alternative sites, remote working, key person dependency and the failure of critical suppliers.

Exercise, and Learn

Exercises turn plans into capability. Start with tabletop discussions, then move to walkthroughs and simulations. Record what did not work and fix it. The aim is not to pass the exercise but to find the gaps.

Prepare Leaders for Crisis Management

In a serious disruption, leaders must make decisions quickly with incomplete information, and communicate with staff, customers, regulators and the media. Crisis management training and clear decision-making structures make that possible.