Business Continuity Management
Definition
Business Continuity Management
Business continuity management is the standing management system that keeps an organisation’s critical activities running through disruption. The system produces the plan, not the other way round — a plan with no management system behind it expires quietly on the shelf.
The system covers four recurring obligations: understanding what matters, deciding how it will keep running, writing that down, and testing whether the written version actually works.
Only the third of those produces a document. The other three are activities with owners and dates — which is why continuity is a management discipline rather than a publishing exercise.
Scope is wider than most organisations assume. Premises, people, suppliers and data each need a recovery position, and the one most often missing is the availability of specific named individuals.
Business impact analysis is where it starts. Every activity is assessed for how quickly its loss becomes intolerable, and that single judgement drives every recovery investment that follows.
Regulation has raised the floor in some sectors. Financial services in particular now face explicit testing and reporting duties rather than a general expectation of prudence.
Key takeaways
- The management system is the discipline; the continuity plan is one of its outputs.
- Business impact analysis sets recovery priorities before any solution is chosen.
- Untested plans fail on the day, because dependencies change faster than documents.
- Supplier continuity has to be verified contractually, not assumed from a policy statement.
How it works
The cycle runs in a fixed order: analyse impact, set recovery objectives, design the arrangements, document them, train people, then exercise and review. Skipping straight to documentation is the common shortcut and the common failure.
Recovery objectives are the quantified output. Recovery time says how quickly an activity must resume — and recovery point says how much recent data the organisation can afford to lose.
Exercising is where most programmes are found out. A walkthrough tests whether people know the plan, while a live scenario tests whether the plan survives contact with a dependency nobody documented.
Concentration risk deserves its own examination. Several suppliers naming the same underlying platform means one failure reaches all of them, and individual assessments will never reveal that.
| Stage | Output | Frequency |
|---|---|---|
| Business impact analysis | Prioritised activity list | Annual |
| Recovery objectives | Time and data-loss targets | Annual |
| Arrangement design | Chosen recovery options | On change |
| Documentation | The continuity plan | On change |
| Exercise and review | Test findings and fixes | At least annually |
Public guidance breaks the work into ordered steps. The United States business continuity planning material published through Ready.gov sets out a six-step process, beginning with preparing and then defining the plan’s objectives.
Technical continuity has its own standard. NIST Special Publication 800-34 Revision 1 covers contingency planning for information systems and its relationship to “organizational resiliency, and the system development life cycle”.
Examples
Continuity programmes differ mainly in what they are protecting against and how far the obligation extends into the supply chain. The three below cover site loss, supplier failure and regulated resilience.
A manufacturer identifies two processes that cannot stop for more than four hours. Its disaster recovery clause with the hosting provider is rewritten to match that objective rather than a standard one.
A retailer exercises a full site-loss scenario annually. Findings feed the business continuity plan (BCP) rather than a report, and the dependency list is corrected every year.
A financial firm extends continuity into its supply base. Each critical provider’s arrangements are examined through vendor risk assessment and tested, not accepted on a policy statement.
Related terms
Continuity work is described by several terms that cover the document, the contract term and the regulation. The entries below fix what each one actually is.
- Business continuity clause: the contract term obliging a supplier to maintain arrangements.
- Digital Operational Resilience Act (DORA): the regulation making parts of this mandatory for European financial entities.
- Standard operating procedure (SOP): the documented routine that continuity arrangements fall back to.
- Right to audit clause: the mechanism for verifying a supplier’s claims rather than trusting them.
FAQ
How does this differ from a business continuity plan?
The plan is a document listing arrangements. The management system is the standing cycle of analysis, testing and review that keeps that document accurate.
Is disaster recovery the same thing?
No. Disaster recovery restores technology. Continuity management covers the whole activity, including people, premises, suppliers and manual workarounds.
How often should plans be exercised?
At least annually for critical activities, with a desktop walkthrough more frequently. Exercises that never fail are usually too easy to be informative.
What does business impact analysis produce?
A ranked list of activities with the maximum tolerable period of disruption for each. Everything downstream is sized from that ranking.
How are suppliers covered?
Through contractual obligations, evidence of their own arrangements, and joint testing for the critical ones. A policy statement alone is not evidence.
Who should own the system?
A named executive, with operational ownership in risk or operations. Ownership inside IT alone limits the scope to technology recovery.
Find continuity and resilience delivery partners through the Outsource Accelerator hubs.
Independent
