Many organisations have a business continuity plan.
Far fewer know whether it will actually work.
That might sound like an uncomfortable statement, but it becomes apparent whenever organisations experience an unexpected disruption. Whether it’s a cyber incident, a prolonged technology outage, severe weather, the loss of a critical supplier, or an unexpected workforce issue, organisations often discover that the greatest challenge isn’t the disruption itself. It’s that their business continuity arrangements don’t reflect how the organisation actually operates.
One thing I’ve noticed over the years is that organisations often have warning signs of these issues before a disruptive event occurs. Whether they appear during planning workshops, desktop exercises, or conversations about who is responsible for what, these signs can indicate issues in their approach that need to be addressed before a disruption occurs.
Here are five common warning signs that your business continuity plan may not perform as expected when you need it most.
-
Your organisation has changed, but your plan hasn’t
No organisation stands still, yet business continuity plans often remain exactly as they were when they were first developed.
One of the most common issues I see isn’t poorly written plans. It’s well-developed plans that haven’t kept pace with how the organisation has evolved. New systems have been introduced, reporting lines have changed, suppliers have been replaced, and key people have moved on. None of those changes happen overnight, but over time they can significantly reduce the usefulness of a business continuity plan if it isn’t reviewed regularly.
It’s easy to assume a review every couple of years is enough, but business continuity should evolve whenever the organisation changes. Otherwise, the plan gradually becomes a snapshot of a business that no longer exists.
-
Recovery priorities are based on assumptions
When organisations begin discussing business continuity, almost every department believes its activities should be restored first.
The reality is rarely that simple.
Determining what is genuinely critical requires organisations to understand dependencies between activities, acceptable periods of disruption, and the consequences of losing particular products, services, or processes.
A Business Impact Analysis (BIA) should challenge people’s assumptions. It’s not unusual for departments to discover that another function has dependencies affecting the entire organisation. Those conversations are often some of the most valuable parts of the planning process because they create a shared understanding of what is genuinely critical. Engagement with executive teams and alignment with the organisation’s strategic priorities is key.
Without that understanding, organisations risk prioritising the recovery of resources that may be important but not essential to return to business as usual.
-
Business continuity is treated as someone else’s responsibility
Business continuity is still commonly viewed as an IT responsibility.
Technology recovery is certainly important, but restoring systems is only one part of maintaining operations.
One of my favourite moments during Business Continuity training workshops is when the penny drops that this isn’t just an IT issue. By the end of the session, the conversation has usually shifted considerably. People begin to recognise that technology is only one part of keeping an organisation operating. Decisions about people, suppliers, facilities, communications, customer obligations, and leadership are just as important during a disruption.
Business continuity works best when it becomes an organisational capability rather than the responsibility of a single department.
-
The plan has never been properly exercised
A business continuity plan should never be tested for the first time during a real disruption.
Exercises allow organisations to validate assumptions, identify gaps, clarify responsibilities, and improve decision-making before the pressure of an actual incident.
I’ve facilitated exercises where organisations discovered within the first couple of minutes that key contact details were out of date, decision-making responsibilities weren’t clearly understood, or people weren’t sure where the latest version of the plan was stored. None of those issues were difficult to fix, but without exercising the plan, they may not have been identified until a real disruption occurred.
That’s the value of exercising a plan. The objective isn’t to prove everything works perfectly. It’s to uncover weaknesses while there is still time to address them.
-
The plan exists to satisfy compliance
Perhaps the biggest warning sign is when business continuity planning becomes a documentation exercise.
Many organisations develop a plan because a customer expects it, a contract requires it, or it supports certification against ISO 22301. While those are all valid reasons to establish business continuity arrangements, they shouldn’t be the reason the plan exists.
The organisations that gain the greatest value from business continuity planning rarely see it as a compliance requirement. Instead, they treat it as an opportunity to better understand how their organisation operates, where their vulnerabilities lie, and how they would make decisions during a disruption. The resulting documentation is certainly important, but the conversations that happen while developing it are often just as valuable.
A well-written plan is important. A well-prepared organisation is even more important.
Business continuity is about preparedness, not prediction
No organisation can predict every disruption it may face.
The objective of business continuity is not to anticipate every possible event. It is to ensure the organisation can continue to deliver its most critical activities when unexpected events occur.
ISO 22301 provides a structured framework for achieving this by helping organisations understand their critical activities, assess the impacts of disruption, establish practical recovery arrangements, test those arrangements, and continually improve over time.
More importantly, it encourages organisations to move beyond documentation and focus on developing practical resilience that reflects the way they actually operate.
One of the reasons I enjoy delivering Business Continuity training is that it changes the way people think about resilience. Many arrive expecting to learn about a management system standard. They leave with a much broader appreciation of how people, processes, technology, suppliers, leadership, and decision-making all contribute to an organisation’s ability to continue operating when disruption occurs.
If you’re responsible for risk, governance, quality, compliance, or operational resilience, understanding the principles of business continuity can help your organisation prepare with greater confidence.
Our two-day Business Continuity training course provides a practical introduction to ISO 22301 and the key elements of a Business Continuity Management System, helping you develop knowledge and practical skills that can be applied within your own organisation.
Enrol in our 2-day Business Continuity course
Further reading
Read our original article on why Business Continuity is important
Find out more about ISO 22301 Business Continuity Management Systems
Learn about lessons from the CrowdStrike outage
