Most business continuity programs that stall don’t have a planning problem. They have an ownership problem. Nobody is sure who sponsors the program, who decides the trade-offs, or who writes the plans, so the work drifts to whoever cares most, usually a two-person BC team trying to cover the whole enterprise. Clear business continuity team roles and responsibilities fix that.
When we start with a new client, one of the first things we assess is who holds each role today and whether everyone agrees on what the role means. The titles vary with your structure and culture. The roles don’t.
Business Continuity vs. Disaster Recovery: Two Teams, One Program
A business continuity plan keeps the business running through a disruption. An IT disaster recovery plan restores the technology applications and infrastructure after a major technology disruption. They are different plans with different owners, and they belong in one program.
Before founding Bryghtpath, I worked at Target, where business continuity reported to the general counsel and technology disaster recovery reported to the CIO. We called the arrangement “two teams, one dream”: one programmatic approach across two very different organizations, with the general counsel and the CIO as co-sponsors. Getting there took years. Your policy should require the two functions to work together, not just mention that they’re connected.
| Old View | New View |
| The BC team writes everyone’s plans | Business leaders own and write their plans; the BC team sets the standard and helps |
| The steering committee receives updates | The steering committee makes the trade-off decisions |
| Sponsorship sits wherever the program landed | The sponsor sits in top management |
| BC and IT DR are separate efforts | One program, with documented shared ownership |
| Plan ownership is a volunteer job | Plan ownership comes with the leadership role |
Business Continuity Team Roles and Responsibilities
ISO 22301, the international standard for business continuity management systems, defines the core roles. These are the ones we build into every program, with our refinements.
Board of directors
The board has fiduciary oversight of how the organization manages the risk of disruption. It sets the tone by expecting management to manage that risk well and asking to see the evidence. Most boards delegate the detailed oversight to the audit committee or risk committee, as written in the committee charter. With private equity ownership, the owners often play this role.
Executives
Each member of your executive team is accountable for continuity in their own area. That accountability is what makes plan ownership stick further down. Under ISO 22301, top management’s job is visible commitment, and in our maturity assessments we look for evidence of it: meeting minutes where an executive emphasized continuity, budget decisions, and follow-through on exercise findings.
Executive sponsor
One or two executives, often the general counsel, COO, CIO, CTO, or chief security officer, sponsor the program and usually chair the steering committee. They advocate for it, clear obstacles, and hold the program to its goals.
The sponsor must be a member of top management. As I said on Managing Uncertainty, Episode 91, “it needs to be sponsored from there because it’s that important. Otherwise, it gets lost in everything else.” Our post on how to champion your business continuity program as an executive sponsor covers the role in depth.
Steering committee
The steering committee, usually six to eight leaders from across the business, aligns the program to corporate strategy, sets annual goals, and holds the program accountable to them. It meets quarterly once the program is running, and more often while you’re building it.
Its most important job is to decide the trade-offs nobody else can. There isn’t money for every recovery strategy, and not every process gets a one-hour recovery time. The committee is the final arbiter. A committee that only listens to updates is pro forma. “It needs to be an actual governance body where there’s good give and take.”
Business continuity program manager
The program manager runs the program day to day: the lifecycle calendar, the standards and templates, reporting, and the expectations that guide business leaders and planners. They don’t write the plans.
When I ran the program at Target, I was blunt about it: “I didn’t write anybody’s plan.” The program manager sets the format, coaches, reviews, and escalates when a plan is late or weak. The business does the writing.
Business continuity team
The BC team supports the program manager with the hands-on work: running the business impact analysis (BIA), training planners, facilitating exercises, maintaining the BC software, and tracking after-action items.
IT disaster recovery owners
IT owns IT disaster recovery: the recovery plans for applications and infrastructure, and the capability to meet the recovery times the BIA sets. The DR lead should sit on or report to the steering committee so recovery gaps get decided, not buried. The roles section of our Ultimate Guide to IT Disaster Recovery covers the IT side.
Plan owners
Business unit leaders (payroll, HR, customer operations, physical security, information security, and so on) own their unit’s business continuity plan. They are responsible for it, they approve it, and they answer for it. Ownership comes with the job. It isn’t voluntary.
Planners and coordinators
Plan owners usually delegate the writing to someone on their team: a planner, plan designee, or BC coordinator. Planners use their knowledge of the function to write the plan in the program’s format, keep it current, and join exercises. In multi-site organizations, site coordinators play the same role for a location.
Roles at a Glance
| Role | Owns |
| Board (often the audit or risk committee) | Oversight of disruption risk; expects evidence the program works |
| Executives | Continuity in their own area; visible commitment |
| Executive sponsor | Advocacy, obstacles, and accountability; chairs the steering committee |
| Steering committee | Strategy alignment, annual goals, and trade-off decisions |
| Program manager | Day-to-day program, standards, reporting, and expectations |
| BC team | BIA, training, exercises, tools, and action tracking |
| IT disaster recovery owners | Technology recovery plans and capability to meet RTOs |
| Plan owners | Their unit’s plan: responsible for it and approve it |
| Planners and coordinators | Writing and maintaining the plan; joining exercises |
Three Keys to Making the Roles Work
1. Visible commitment from the top
Company-wide participation starts with the board and your executives. If they ask about the program, show up for the exercise, and act on the findings, the rest of the organization follows. If they don’t, no amount of program management will make up for it.
When the board of a major US-based home decor retailer challenged the company to improve its resiliency, we built the program on exactly this foundation: a policy, governance, a steering committee, and an executive sponsor, before the BIA and the plans.
2. Steering committee members who see the whole picture
Pick members who understand why continuity matters, have the critical-thinking skill to weigh trade-offs, and understand how the company’s processes and people depend on each other. They should represent their area and think across silos. A seat on the committee is also a strong development assignment for mid-level leaders with senior potential.
3. Business units own their plans
The most common mistake we see is a program manager or BC team writing the plans for every business unit. Those plans read well and fail in practice, because the people who will execute them didn’t build them and can’t speak for the process.
The business unit writes, edits, and maintains the plan. The program sets the format and helps them get there. Every new program hears the same question: who writes the plan? The plan owner does, in the program’s template. As I said on Episode 91, “I’m going to help you get there. You’re going to do it.”
For the governance that holds these roles together (policy, steering committee agenda, annual review), see why good business continuity governance is critical to resilience and the roles section of our Ultimate Guide to Business Continuity.
At some point the disruption will come. If every role is filled, understood, and practiced, you’ll know who does what before anyone has to ask.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Set up your governance. Our Business Continuity services include program and policy development, steering committee setup, and defining roles and responsibilities.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program’s roles with us.
