Most business continuity consulting projects end the same way: a Business Impact Analysis (BIA), a stack of plans, and a final invoice. A year later the plans are out of date, the BIA is an opinion, and nobody inside the company knows how to run the next cycle. The consultant didn’t fail at writing. The engagement failed at handover.
You can avoid that by choosing a business continuity consultant on the right questions. This guide covers when you need a consultant at all, what to decide before you call anyone, the eight questions to ask before you sign, what the work costs, and how we answer the same questions.
Business Continuity Consultant or Managed Service?
Start by being honest about what you are buying. Business continuity help comes in three forms:
- Project consulting. A firm builds something specific, such as a program design, a BIA, a set of plans, or an exercise, and hands it back to your team to run.
- Advisory retainer. A firm reviews your work and answers questions. Useful when you have the hands and need judgment.
- A managed service. A senior team runs the program for you, every day.
This post is about the first one. A business continuity consultant is the right buy when you have a defined problem and a team that will own the result. If your real problem is that nobody has the time to run the program after the project ends, a consultant will hand you a deliverable you can’t maintain. That is a managed service decision, and our guide to managed business continuity services covers it.
A consultant is worth the money when you have one of these:
- A program to build. No program, or one that grew by accident and needs a design.
- A program to fix. A BIA nobody trusts, plans nobody uses, or an exercise that went badly.
- A deadline. An audit, a certification, a regulator, or a customer asking for evidence.
- A need for an outside view. People tell an independent outsider things they won’t tell the internal team, and executives give an outside assessment weight they rarely give a new internal leader.
That last one is personal. Before founding Bryghtpath, I led global crisis management and business continuity at Target. When my boss told me to bring in a consultant, I resented it. The outside assessment and roadmap went to our executives and the board, and it got the program funded. I told the whole story on Managing Uncertainty, Episode 81.
| Old View | New View |
| The deliverable is the plan | The deliverable is a program your team can run |
| Start with templates | Start with a diagnosis |
| The consultant sets recovery times | Your executives validate recovery times; the consultant facilitates |
| Business continuity and IT disaster recovery are separate projects | Recovery objectives come from the BIA, and IT is in the room |
| Longer plans mean better plans | Plans people will actually use under pressure |
Before You Call Anyone: Five Things to Decide
You will get better proposals, and a better engagement, if you can answer these first.
- Why now? An audit finding, a board question, a new leader, a disruption that went badly. The trigger shapes the scope.
- What is in scope? Which business units, sites, and processes in year one. Start with the functions that drive revenue, serve customers, or carry regulatory exposure. You can expand later.
- Which standard do you answer to? ISO 22301, the FFIEC handbook, HITRUST, HIPAA, or a customer’s contract terms. A consultant should assess and build against the framework your auditors and regulators will use.
- Who is your executive sponsor, and who owns it internally? A program without a sponsor stalls. A program owned by the consultant fades when the contract ends.
- What does success look like? “Have a BC plan” is not success. “Every critical process has a validated recovery time, a plan its owner has exercised, and a recovery capability IT has tested” is.
If you can’t answer most of these, start there. A good business continuity consultant will help you work through them in the first conversation. A weak one will skip straight to a proposal.
8 Questions to Ask a Business Continuity Consultant Before You Sign
1. Who will actually do the work?
The senior practitioner in the pitch meeting is not always the person assigned to your engagement. Ask for the names of the people who will interview your leaders, run the BIA sessions, and write the plans, and what credentials they hold. In business continuity that usually means a CBCP or MBCP from DRI International or a membership grade from the Business Continuity Institute.
A good answer: named people, with the lead consultant doing the work you are paying for.
A red flag: “We’ll staff the team after the contract is signed.”
2. Have you run a program, or only written plans?
Writing a plan is one skill. Running a business continuity program through budget cycles, reorganizations, and real disruptions is another. Ask who on the team has owned a program inside a company, and what happened when it was tested by something real.
A good answer: specific disruptions, described without naming clients, including what didn’t work.
A red flag: frameworks and certifications, but no stories.
3. How do you start?
We often say that we will not work on the prescription unless we’ve done the diagnosis. A good consultant reviews your documents, interviews your people, and scores your program against a recognized standard before writing anything. Our post on what a business continuity maturity assessment should tell you explains what that first step should produce.
A good answer: an assessment that reports strengths as well as gaps, and a sequenced roadmap.
A red flag: a template plan with your logo on it in the first month.
4. How will you run the BIA, and who validates it?
The BIA decides everything after it: recovery priorities, strategies, plans, and what IT has to recover first. A consultant can facilitate it. Only your leaders can validate it. Ask how the consultant gets business owners to agree on criticality, and how executives sign off on recovery times. We wrote about why skipping BIA validation is a huge mistake.
A good answer: a validation step with your executives built into the schedule.
A red flag: recovery times the consultant sets on its own, or a BIA questionnaire so long nobody finishes it.
5. Will your plans be usable in a disruption?
After more than a decade of program evaluations, one finding keeps coming back. People tell us they didn’t use the plan in the disruption because it was too hard to use. As I said on Episode 289, “Then that’s not an effective business continuity program.” Ask to see a redacted sample plan.
A good answer: short plans with checklists, written for the person who has to act.
A red flag: a 60-page plan held up as proof of rigor.
6. How will you connect business continuity to IT disaster recovery?
The business expects four hours. IT can deliver four days. Nobody finds out until the outage. Ask how the consultant carries BIA requirements to your IT team and reports the gap between what the business needs and what IT can actually recover. More on that in Closing the Gap Between Business Continuity and IT Disaster Recovery.
7. How will you hand it over?
This is the question most buyers forget, and the one the old version of this post was right about: your organization has to take control of the program when the project ends. Ask how the consultant trains your plan owners, who runs the next BIA cycle, and what your team will be able to do alone at the end. Ask how and when the plans will meet their first exercise, and for a redacted sample After-Action Report (AAR).
A good answer: your people doing more of the work each phase, with training and an exercise built into the engagement.
A red flag: a finished binder and a “call us next year.”
8. When would you tell us you’re not the right fit?
An honest consultant knows who it serves best and says so. If you need a large team on site in a dozen countries, a small specialist firm is the wrong choice, and it should tell you. We have referred work to other firms because we weren’t the best fit.
A good answer: a clear description of the clients they serve best, and the ones they don’t.
A red flag: “We can do all of it.”
What Business Continuity Consulting Costs
Business continuity consulting is priced by scope: the number of business units, sites, and plans, the standards in play, and how much of the work your team will do. Most of our consulting engagements run from $50,000 to $500,000, and we price them as fixed fees tied to deliverables, so you know the cost before you start. Ask any firm whether it bills fixed fee or hourly, what is included, and how a change in scope is priced. The cheapest proposal often cuts the step that matters most, usually validation, training, or the exercise.
Compare the quote to the real alternative, too. Business Continuity Program Cost: In-House vs Outsourced walks through the math.
Not every organization needs a full engagement on day one:
- Start with a diagnosis. A Resiliency Diagnosis® typically runs about 12 weeks, starts in the mid five figures, and tells you where you stand and what to fix first.
- Start with templates. Our business continuity plan templates include a BIA tool and a plan template your team can build on.
- Start with an exercise. Exercise in a Day® builds a custom tabletop in one business day for $7,500.
How We Answer These Questions
Since we asked you to put every business continuity consultant through these eight questions, here are our answers.
- Who does the work: senior practitioners who have run business continuity programs inside large companies. Our team has spent two decades doing this work, and I have more than 30 years of it. I hold the MBCP, MBCI, and CISSP.
- How we start: with a Resiliency Diagnosis®, scored against ISO 22301 and the standards your regulators use. Then we follow our proven process: Diagnose. Design. Deliver. Evolve.
- The BIA: we facilitate it, and we review the results with your executives before anyone writes a plan.
- Handover: we build with your team, train your plan owners, and exercise the plans before we call the work done. When you want us to keep running the program, that is a separate decision, not a dependency we create.
- Fit: we will tell you plainly when we are not the right firm.
For one of the largest nonprofits in the United States, that meant a Resiliency Diagnosis® with more than 30 discovery interviews, then an emergency procedures guide for each office and for remote workers, a crisis management framework and plan, and a full business continuity program. We ran its first business continuity lifecycle (BIA, planning, training, and exercises), aligned business continuity and disaster recovery with its IT team, and briefed its CEO and C-suite. The getting help section of our Ultimate Guide to Business Continuity covers the other options, from doing it yourself to a managed program.
Choose the business continuity consultant who leaves your team able to run the program, not the one who leaves you a binder.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- See how we work. Our business continuity consulting services cover program design, BIA facilitation, plans, exercises, and IT disaster recovery alignment.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your business continuity program with us.
Marie Strawser joins Bryghtpath as Principal