Business continuity and crisis planning is not a one-and-done event.
Still, I see a lot of businesses make this pivotal mistake.
They put in a lot of work conducting their initial business impact analysis (BIA), identifying the resilience gaps, creating plans, policies, lists, and procedures, and distributing these throughout the organization.
Then they quit.
In the meantime, data becomes stale. Technology evolves. Vendors and other third parties come and go. Business objectives change.
As a result, your business continuity plans become outdated and leave you ill-prepared for the disruptions that will inevitably come.
The antidote to this problem is the business continuity lifecycle.
Here’s what a business continuity lifecycle is, why you need one, and some practical steps to put one in place.
What Is a Business Continuity Lifecycle and Why Do You Need One?
Most businesses make the mistake of treating business continuity planning as a linear process rather than a circular one.
They assess the most likely threats to their critical functions, develop plans to mitigate the impacts of those threats, conduct a few trainings and exercises, and consider the business continuity box “checked” for good. The result is a flat, lifeless program that quickly goes stale.
But your business and the threats it faces change over time. When your plans for responding to those threats don’t, the mismatch all but guarantees that your company becomes less resilient every year.
As any fitness buff will tell you (and I’m definitely not one of them), you have to keep using your hard-earned muscles if you want to keep them. And because your body and environment change, you’ll probably have to adjust your routine to get the same results.
That is the business continuity lifecycle: a cyclical process for assessing likely threats and their impact on your business, developing plans to address them, and then exercising, reviewing, and improving those plans over time.
Once you’ve built your organization’s resilience muscles with a thorough business impact analysis and business continuity plans, you have to exercise and adjust those plans so the muscles are ready when you need them.
The business continuity lifecycle is how we do this. The lifecycle section of our Ultimate Guide to Business Continuity puts it in the context of a full program.
The 4 Steps of the Business Continuity Lifecycle
The business continuity lifecycle has four steps:
- Assess potential threats and their impact on your business
- Plan to address and mitigate those impacts
- Exercise to validate your plans
- Mature your plans by regularly incorporating what you learn
Let’s look at each step in more detail.
1. Assess
The first step is to understand your ecosystem of likely threats and how they might affect your business. You do this mainly through a business impact analysis.
The BIA identifies your most critical business processes and how a disruption would affect them. It should anticipate the impact on your revenue, expenses, operations, and reputation. It also needs to capture the data your IT team requires to design an effective IT disaster recovery plan: each process’s recovery time objective (RTO), its dependencies (technologies, vendors and third parties, facilities, other business processes), and the recovery time needed for each of those.
2. Plan
Once your BIA has identified your most critical processes, identify and catalog the response and recovery options for each one. Then write the procedures and guidelines that tell your teams how to recover those processes in order of importance. This is the roadmap your business will use to assess a disruption, activate the right response strategy, and carry it through to completion.
Changes in operations, resources, and staff can make your business continuity plans irrelevant. Revisit them regularly (ideally annually) to see what has changed and whether your tasks and guidance still fit.
3. Exercise
Much like the drive home from work becomes second nature, exercising your business continuity plans builds the confidence and muscle memory your organization needs to respond during a crisis or disaster. Exercises also validate your tasks and procedures and show whether they’re designed to help your organization respond to a real disruption.
Exercises range from a tabletop exercise, where you walk through a scenario, talk through the plan, and explain how it works, to a full simulation.
We recommend that every organization exercise with every department at least annually.
4. Mature
The “mature” phase may be the most important part of the business continuity lifecycle. This is where you take stock of the lessons learned from exercising your plans, in practice and in real life, and take definite action to improve them.
Once you’ve developed your initial BIAs and business continuity plans, work through every part of the lifecycle to update your inputs and plans at least annually. You may need to revisit your plans mid-year if your business changes materially (a global pandemic, for example) or a significant disruption requires immediate adjustments.
Where the Lifecycle Fits in a Business Continuity Program
The lifecycle is the annual rhythm of a running program. Building or rebuilding that program is a different job, and we use the same four steps for it every time: Diagnose. Design. Deliver. Evolve.
Diagnose where your program stands today. Design a program that fits your strategy, risk appetite, and culture. Deliver the plans, training, and exercises that build real capability. Then Evolve, which is where the lifecycle takes over: every year, assess, plan, exercise, and mature again.
If you’re starting from scratch, Starting a Business Continuity Program covers the first year. Some organizations don’t have the staff to run the lifecycle themselves. For a leading Midwest health insurer with no dedicated continuity or crisis staff, we ran the full business continuity lifecycle as a managed service: BIAs, plans, and exercises.
3 Practical Ways to Start a Business Continuity Lifecycle
1. Do it regularly
When I explain the business continuity lifecycle to clients, I frequently get asked: “Do we really have to do this every year?”
Yes.
Operations change.
Technology evolves.
Incidents happen, and they give you valuable feedback on whether your business continuity plans are working.
That’s why you need a regular schedule for revisiting your BIAs and business continuity plans, so they stay current and responsive to your resilience needs.
We recommend this cadence for your business continuity lifecycle activities:
- Business impact analysis: Update annually. If you have a lot of them, split them into two groups and review each one every other year.
- Business continuity plans: Procedures and contact lists go stale quickly. Review and update them annually.
- Significant changes: If your business changes materially mid-year, or a disruption shows that your plans need immediate adjustments, update them sooner.
- Regulatory requirements: Frameworks like HITRUST and SOX may carry controls that require more frequent reviews.
Reviewing every BIA and business continuity plan every year can seem daunting, especially for companies with wide-ranging operations and dozens, if not hundreds, of plans. There are many ways to design your lifecycle so it doesn’t overwhelm people. The most important thing is that the activities happen on a regular, ongoing basis.
2. Get it on the calendar
My personal rule is that if it’s not on the calendar, it doesn’t get done. The same holds for every part of the business continuity lifecycle. Shortly before your fiscal year starts, identify the lifecycle activities that need to happen over the year and schedule them with your stakeholders, including any meetings.
This helps your stakeholders see what’s coming and understand how their piece fits the program’s objectives. It also gives you a way to measure and show your program’s progress through the year. If you fall behind, you can speed up or adjust to stay on track. I talked through building that annual calendar on Managing Uncertainty, Episode 229.
3. Have an escalation plan
When you aren’t staying on track with your lifecycle activities, what will you do about it?
How, and to whom, will you escalate when you’re not getting the participation you need?
Forcing compliance rarely works well. You want your stakeholders to show a real commitment to your program, including the lifecycle activities. So anticipate that some stakeholders won’t perform, and have a plan for moving them to action.
An education campaign or a Q&A session with different departments might be all it takes. Other times, you might need your executive sponsor to work their connections with your executives to get participation. Your business continuity governance process can also help secure commitment from business teams.
Your business continuity plans lay out a roadmap for the detours a disaster forces on you. Build your own internal roadmap for the glitches that could derail your business continuity lifecycle.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Keep the lifecycle running. Our Business Continuity services run BIAs, plans, and exercises with your team, or for it.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your business continuity lifecycle with us.
