What a Business Continuity Maturity Assessment Should Tell You (and What an Audit Won’t)

Most business continuity assessments end with a list of findings. A good business continuity maturity assessment ends with a decision: what to fix first, what to stop doing, and what it will take to get there.

If you finish an assessment holding forty findings and no order to work them in, you bought an inventory, not an assessment.

A disclosure before we start: Bryghtpath sells assessments. We run the Resiliency Diagnosis®, and we built ResiliencyPulse, a self-service maturity platform. The standard below applies to any assessment you buy or run, including ours.

Audit, Gap Analysis, or Maturity Assessment: Know Which One You Are Buying

The three terms get used interchangeably. They answer different questions.

Type	The question it answers	What you get	Use it when
Audit	Do we comply with the standard?	Pass or fail, with nonconformities	A certification, regulator, or customer requires proof
Gap analysis	Where do we differ from the standard?	A list of gaps, usually in clause order	You are preparing for an audit
Maturity assessment	Where are we, where do we need to be, and how do we get there?	A scored baseline, a target, and a sequenced roadmap	You need to improve the program, fund it, or defend it

An audit tells you whether you passed. It does not tell you what to do Monday morning. Most programs need the maturity assessment first and the audit later.

Old View	New View
The assessment’s job is to find gaps	The assessment’s job is to decide which gaps matter
A higher score is always better	The right score depends on your risk, regulators, and size
The report is the deliverable	The roadmap and the executive briefing are the deliverables
Assess once, before the audit	Assess to set a baseline, then re-measure on a cycle

Seven Things a Business Continuity Maturity Assessment Should Tell You

1. A score you can defend

The score should be measured against named standards that apply to you: ISO 22301 for business continuity, ISO 22361 for crisis management, ISO 27031 or NIST SP 800-53 for IT disaster recovery, FFIEC for financial institutions. It should break down by domain (governance, Business Impact Analysis, plans, exercises, recovery) rather than giving one blended number.

A single overall score hides the problem. A program at 3 for planning and 1 for exercising does not have a “2” problem. It has an exercising problem.

2. A target, not just a score

A score without a target is trivia. The assessment should tell you where your program needs to be, given your regulators, your risk exposure, and your size.

Not every organization needs to reach 5. Most programs we assess start between 1.5 and 2.5 on a five-point scale, and a well-run program can reach 2.5 to 3.5 within two years. A target you can actually reach is worth more than one you can’t.

3. Which gaps actually matter

Clause-by-clause gap lists treat every gap as equal. They are not. A missing Business Impact Analysis (BIA) undermines every plan built on top of it. A formatting gap in a plan template does not.

Ask how the assessor ranks gaps. The answer should be business impact and dependency, not the order of the standard.

4. What your documents hide

Documents show what the program says. Interviews show what the program does. A good assessment talks to the people who would run the response and finds what the documents miss: two crisis plans with overlapping teams, severity levels nobody can explain, or a recovery order that exists only in one person’s head.

An assessment built only on document review grades the binder, not the program.

5. The order of work

The roadmap should be sequenced, with an owner and a time frame for each step. Short-term fixes that build credibility come first; structural changes that take a year come after. You should be able to read it and know what happens in the next 90 days.

6. What to stop doing

Good assessments subtract. Consolidate two crisis plans into one. Retire the plan nobody maintains. Collapse overlapping teams. The people who run these programs tell us the same thing: “one of the biggest challenges with crisis management is making it too complicated.”

If an assessment only adds work, it is not finished.

7. The case for funding

The assessment should produce an executive briefing your leadership will act on, framed the way they think: where the risk sits, what it costs to reduce it, and what the investment returns. Practitioners hear it constantly from their executives: “Great job reporting the risk. We need to do something about it.” The assessment is how you answer that.

Red Flags in an Assessment Proposal or Report

• A 200-page report. Length is not rigor. If your executives will not read it, it will not change anything.
• Findings with no priority. Forty observations in clause order means the prioritization work is still yours.
• No stakeholder interviews. A document-only review cannot see how the program actually works.
• Scored against a standard you do not answer to. A score against a framework your regulators ignore is hard to defend.
• No target state. A baseline without a destination cannot guide investment.
• The assessor’s fix is the assessor’s product. If every recommendation leads to the vendor’s software, read the report twice.

When to Assess

The best time is before you need the answer. The most common triggers we see:

• You are new to the role or inherited the program and need a credible read before your name is on it.
• A tabletop exercise exposed gaps and the team needs a plan, not another list of findings.
• An audit, board presentation, or compliance deadline is coming, such as HITRUST, FFIEC, or an ISO 22301 certification.
• You need to fund or relaunch a stalled program and need the case to move.
• It has been a year since the last baseline. Re-measuring is how you prove progress.

If you are running an assessment internally, our guide to business continuity assessment covers the key components and common challenges.

What a Business Continuity Maturity Assessment Costs

The options run from free to a facilitated engagement. Pick the one that matches the decision you need to make.

• Start with a quick read. The ResiliencyPulse self-check gives you a rough maturity picture in about four minutes, with ten questions. It is free.
• Score it yourself, properly. ResiliencyPulse scores your program against eight published standards, with peer benchmarking, starting at $749.99 a year for one person and $2,999 a year for a team of three.
• Bring in a facilitated assessment when the stakes justify it: a new or inherited program, a board or regulator audience, or a program that needs an outside view to move. A Resiliency Diagnosis® typically runs about 12 weeks and starts in the mid five figures.

Self-assessment is useful and cheap. It cannot interview your people, and it cannot carry outside credibility into a boardroom. That is what the facilitated version is for.

How the Resiliency Diagnosis® Answers These Seven Questions

Since we asked you to hold every assessment to this standard, here is how ours meets it.

• A defensible score: maturity scored by domain on a five-point scale against ISO 22301, ISO 22361, FFIEC, NIST SP 800-53, ISO 27031, and Bryghtpath benchmarks, with peer comparison.
• A target and a priority: we tell you where you need to be and which gaps matter first.
• What documents hide: stakeholder interviews are part of every engagement.
• The order of work: a prioritized roadmap with short-term fixes and long-term moves.
• What to stop doing: we tell you what to consolidate, what to cut, and what to build.
• The case for funding: an executive briefing deck built for your leadership team or board, and a plain-English evaluation instead of a 200-page report.

An assessment that only tells you where you stand is a mirror. The one worth paying for is a map.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
• Take the four-minute self-check. The ResiliencyPulse self-check gives you a quick maturity read before you decide what kind of assessment you need.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through what your program needs.