What (Almost) Everyone Gets Wrong About the Business Continuity Lifecycle

Business continuity and crisis planning is not a one-and-done event.

Still, I see a lot of businesses make this pivotal mistake.

They put in a lot of work conducting their initial business impact analysis (BIA), identifying the resilience gaps, creating plans, policies, lists, and procedures, and distributing these throughout the organization.

Then they quit.

In the meantime, data becomes stale. Technology evolves. Vendors and other third-party relationships come and go.  Business objectives change.

As a result, your business continuity plans become outdated and leave you ill-prepared to handle the evolving threats that will inevitably occur and disrupt your business.

The anecdote to this problem is the business continuity life cycle.

Here, we discuss what a business continuity lifecycle is, why you need one, and some highly practical steps on how to implement one in your business.

What is a business continuity lifecycle and why do you need one?

Most businesses make the mistake of thinking that business continuity planning is a linear process, rather than a circular one.

They assess the most likely threats to their critical functions, develop plans to mitigate the impacts of those threats, conduct a few trainings and exercises, and consider the business continuity planning box to be “checked” for good. The result is a flat and lifeless program that quickly stales.

But your business and the threats that face it change and evolve over time. And when your plans for responding to those threats don’t, the resulting miscalibration all but guarantees that your company will become less resilient over time.

As any fitness buff will tell you (although I’m definitely not one of them), you have to continually use and exercise your hard-earned muscles if you want to maintain them. And because your body and environment change over time, you will probably have to adjust your routine to keep the same fitness results.

This example perfectly illustrates the need for a business continuity lifecycle—a cyclical process for assessing likely threats and their potential impacts on your business, developing plans to address those threats, and then exercising, reviewing, and improving those plans over time.

Once you’ve built your organization’s resilience muscles—with a comprehensive business impact analysis and thorough business continuity plans—you have to exercise and adjust those plans to ensure that your resilience muscles are always ready to do the job.

The business continuity lifecycle is how we do this.

4 steps of the business continuity lifecycle

The business continuity lifecycle consists of 4 key steps:

• Assessing potential threats and their impacts on your business
• Developing plans to address and mitigate those impacts
• Validating and exercising your plans
• Maturing your plans by regularly incorporating the feedback gleaned from experience

We’ve illustrated each part of the business continuity lifecycle in more detail below.

Let’s take a look at each step of the process in more detail.

1.   Assess

The first component of the business continuity lifecycle is to understand your ecosystem of likely threats and how those potential threats might impact your business. This is primarily done by conducting a Business Impact Analysis, or BIA.

The BIA aids you in identifying your most critical business processes and how disruption might impact those processes. It should anticipate potential impacts on your revenue, expenses, operations, and the reputation of your company. It is also important that your BIA captures the data that your IT team needs to design an effective IT disaster recovery plan.  This includes details about your business process recovery time objectives (RTOs) and your dependencies (technologies, vendors/third parties, facilities, other business processes), and your recovery time needs for each of those.

2.   Plan

After identifying your most critical business processes with your BIA, you need to identify and catalog your available response and recovery options for each process.  Then, you can create procedural tasks and guidelines that instruct your teams on how to recover critical business processes in order of importance. This is the roadmap that your business will use to initially assess a disruption, activate the appropriate response strategy, and carry out that strategy to completion.

Changes to operations, resources, and turnover can impact the relevance of your business continuity plans. It’s important to revisit them on a regular basis (ideally annually) to determine what has changed and whether your tasks and guidance are still the right ones or need to be adjusted.

3.   Exercise

Much like driving the route home from work becomes second nature over time, exercising your business continuity plans helps your organization build the confidence and muscle memory it needs to respond effectively during a crisis or disaster situation. Exercising your business continuity plans also helps to validate your tasks and operations and ensure that they are appropriately designed to help your organization respond effectively to a disruption.

Business continuity plan exercises can range from a tabletop environment where you walk through a scenario, talk through the plan, and explain how the plan works, to an actual crisis simulation.

We recommend that every organization conduct exercises with all departments and employees at least annually.

4.   Mature

The “mature” phase is perhaps the most important part of the business continuity lifecycle. This is where you take stock of the lessons learned in exercising your plans—both in practice and in real life—and take definitive actions to improve on those plans.

Once you’ve developed your initial BIA’s and business continuity plans, you should ideally work through all parts of the business continuity lifecycle to update your inputs and plans at least annually. However, you may need to revisit your plans mid-year if there are material changes to your business (like a global pandemic) or a significant disruption that requires immediate adjustments.

3 practical ways to start a business continuity lifecycle

1.   Do it regularly

When I explain the requirements of the business continuity lifecycle to consulting clients, I frequently get asked: “Do we REALLY have to do this every year!?”

But operations change.

Technology evolves.

Incidents happen, providing you valuable feedback on your business continuity plans and whether or not they’re working.

That’s why you need a regular schedule for revisiting your BIA’s and business continuity plans to ensure that they are current and responsive to your resilience needs.

We recommend the following cadence for your business continuity lifecycle activities:

• Business Impact Analysis: These should be updated annually. If you have a lot, you can also break them up into two lists, reviewing each one every other year.
• Business Continuity Plans: Procedures and contact lists quickly stale and should be reviewed and updated annually.
• Significant Changes or Developments: If there are material changes to your business in the middle of the year, or a disruption response uncovers the need for immediate adjustments to your business continuity plans, you should update your plans more frequently as appropriate.
• Special Regulatory Requirements: For regulatory or compliance frameworks like HITRUST, SOX, and others, you may have additional controls that require more frequent reviews.

While reviewing ALL of your BIA’s and business continuity plans EVERY year can seem like a daunting task—especially for companies with a wide breadth of operations and as a result, dozens if not hundreds of plans—there are many ways to design your business continuity lifecycle in a way that doesn’t overwhelm. The most important thing is that your lifecycle activities occur on a regular and ongoing basis.

2.   Get it on the calendar

My personal rule is that if it’s not on the calendar it doesn’t get done. This also holds true in carrying out each aspect of the business continuity lifecycle.  Shortly before the start of your upcoming fiscal year, you should identify the key lifecycle activities that need to occur over the year and schedule those activities with your stakeholders, including any meetings that may be necessary.

This helps your stakeholders anticipate what’s coming and understand how their piece fits into the overall objectives of your program. It also provides a way for you to measure and demonstrate your program’s progress throughout the year.  If you fall behind on calendared activities, you can accelerate or adjust your efforts as necessary to stay on track.

3.   Have an escalation plan

If and when you aren’t staying on track with your lifecycle program activities, what will you do about it?

How and to whom will you escalate the situation when you’re not getting the participation you need?

Forcing compliance rarely works well.  And you want your stakeholders to demonstrate a true commitment to your program, including your business continuity lifecycle activities. As a result, you need to thoughtfully anticipate the non-performance of your various stakeholders and have a plan for urging them into action.

An education campaign or facilitating a Q&A with different departments might be all it takes. In other instances, you might need to muster the help of your executive sponsor to work their C-Suite connections to garner program compliance. Your business continuity governance process may also assist with gaining commitment from business teams.

Much like your business continuity plans set out a roadmap for disaster-induced detours, you should develop your own internal roadmap for addressing the unexpected glitches that could derail your business continuity lifecycle.

Want to work with us or learn more about Business Continuity?

• Our proprietary Resiliency Diagnosis process is the perfect way to advance your business continuity & crisis management program. Our thorough standards-based review culminates in a full report, maturity model scoring, and a clear set of recommendations for improvement.
• Our Business Continuity (including effective Business Continuity Lifecycles) & Crisis Management services help you rapidly grow and mature your program to ensure your organization is prepared for the storms that lie ahead.
• Our Ultimate Guide to Business Continuity contains everything you need to know about Business Continuity
• Our free Business Continuity 101 Introductory Course may help you with an introduction to the world of business continuity – and help prepare your organization for your next disruption. Our paid 5-Day Business Continuity Accelerator might just be the thing you need to jumpstart your business continuity program.
• Learn about our Free Resources, including articles, a resource library, white papers, reports, free introductory courses, webinars, and more.
• Set up an initial call with us to chat further about how we might be able to work together.