Pillars of Risk Management Business Continuity
BUSINESS CONTINUITY: WHEN NORMAL STOPS, HOW DOES THE BUSINESS KEEP GOING?
BUSINESS CONTINUITY AS ONE OF THE PILLARS OF RISK MANAGEMENT
On the main Pillars of Risk Management page, I explained why my team and I kept Business Continuity alongside Technology Risk, Enterprise Risk Management, Cyber Risk, Operational Resilience, Governance & Compliance, Third-Party Risk, Risk Assessment and the Risk Register even as we added newer areas such as A.I. & Risk, Future of Work, Trust, The Future Human and Signals.
Business Continuity remains one of those established foundations because every business, no matter how small, eventually faces disruption. A key employee may suddenly become unavailable. The office may be inaccessible. A supplier may fail. A cloud platform may go down. A cyberattack may make systems unusable. An extreme weather event may interrupt transport or utilities. Or, as COVID-19 showed, a disruption can affect people, premises, customers, suppliers and working arrangements all at once.
COVID-19 made Business Continuity feel urgent in a way that many businesses had never experienced before. Some organisations had continuity plans but discovered that their assumptions did not match the reality they faced. Others had no meaningful plan at all because they had never expected a disruption of that scale. Many individuals and small businesses were forced to improvise almost overnight.
That experience should not be forgotten simply because the immediate crisis has passed. The next major disruption may not be a pandemic. It may be a cyberattack, technology failure, geopolitical event, severe weather event, supplier collapse, widespread power outage or something we have not yet anticipated. Business Continuity therefore remains an important Pillar because the central question survives every scenario:
If our normal way of working suddenly stops, how do we continue what matters most?
WHAT IS BUSINESS CONTINUITY?
Business Continuity is the ability to continue or restore important business activities when normal operations are disrupted. It involves understanding which activities are critical, what they depend upon, what the consequences of disruption would be and what alternative or recovery arrangements are needed.
For a small business, this does not have to mean a large manual sitting on a shelf. It might mean knowing who can cover an essential task, how customer information can still be accessed, how payments can still be collected, which suppliers can be replaced, how people can work from another location or what manual process can temporarily replace an unavailable system.
The idea is simple: do not wait until the disruption happens to work out what you will do.
That links directly back to another thought on the main Pillars page. Risk Management is a thought process that is better done upfront rather than in hindsight. Business Continuity is perhaps one of the clearest examples of that. Once the disruption has happened, options may be fewer, decisions more rushed and costs much higher.
HOW DID BUSINESS CONTINUITY COME ABOUT?
The basic idea behind Business Continuity has existed for as long as people have depended upon businesses, trades and services to continue operating.
A shopkeeper might keep spare stock. A family business might teach more than one person how to perform an essential task. A trader might use more than one supplier. Important documents might be kept somewhere separate from the main workplace. These were practical ways of avoiding total dependence on one person, place or resource.
As businesses became more dependent upon technology and formal processes, continuity planning became more structured. Organisations began asking which activities were most important, how long they could be interrupted, which resources were needed for recovery and what alternative arrangements could be prepared in advance.
Over time, this developed into tools such as Business Impact Analysis, Business Continuity Plans, recovery objectives, alternative-site arrangements, call trees, crisis communication procedures, disaster recovery and testing exercises.
The tools became more sophisticated, but the underlying question remained very ordinary: if something we depend upon disappears tomorrow, what do we do next?
WHAT BUSINESS CONTINUITY QUESTIONS DID INDIVIDUALS AND SMALL BUSINESSES USED TO ASK?
Individuals and small-business owners have always asked Business Continuity questions, even if they never used that term.
A small business owner might ask, “What happens if I cannot open the shop tomorrow?”
A family business might ask, “Who knows how to do this if I am not here?”
A consultant might ask, “What happens if my laptop breaks the night before an important deadline?”
A retailer might ask, “What happens if my usual supplier cannot deliver?”
A small clinic might ask, “What happens if the person who handles all the appointments is suddenly unavailable?”
These are Business Continuity questions because they all involve continuing important activities when the normal arrangement is interrupted.
The practical responses were often straightforward. Keep a spare device. Maintain another supplier. Cross-train another employee. Store important information somewhere else. Keep emergency contact details available. Have another way of taking payment. Know which activities can wait and which cannot.
The professional terminology may include contingency planning, recovery arrangements, redundancy, alternate processing and continuity procedures, but the core principle is easily understood: do not allow one disruption to stop everything.
WHAT BUSINESS CONTINUITY TOOLS CAN A SMALL BUSINESS USE?
A small business can begin Business Continuity planning without creating a complicated framework. The first step is to identify the few activities that genuinely matter to keeping the business functioning.
One simple tool is a Business Impact Analysis, often referred to as a BIA. In a large organisation, a BIA can become a detailed formal process. For a small company, the thinking can be much simpler: Which activities really matter? What happens if each one stops? How quickly does it become a serious problem? What people, technology, information, premises or suppliers do we need to restore it?
Suppose a small business relies on online bookings, customer information and electronic payments. If the booking platform fails for one hour, the effect may be manageable. If it fails for three days, the impact may be much more serious. The BIA helps the business distinguish between an inconvenience and a disruption that genuinely threatens operations.
Another useful tool is the Business Continuity Plan, or BCP. The plan sets out what to do when normal operations are disrupted. For a small business, this might include emergency contact details, alternative ways of working, backup systems, manual procedures, communication arrangements and who is responsible for making decisions.
The plan does not need to be long. A ten-page plan that people understand and can actually use may be far more valuable than a 100-page document nobody can find when something goes wrong.
WHAT IS A BUSINESS CONTINUITY PLAN?
A Business Continuity Plan is a documented set of arrangements that explains how a business will continue or recover important activities during a disruption.
A useful BCP usually answers practical questions. What happened? Who needs to know? Which activities take priority? Who is responsible for making decisions? What systems, information or suppliers are needed? What alternatives are available? How will customers and employees be informed? At what point should the business move from temporary workarounds into full recovery?
For a small business, a BCP may be very simple. If the premises cannot be used, perhaps staff can work remotely. If the booking system fails, appointments might be recorded manually. If one supplier is unavailable, another may be used. If the owner is unexpectedly absent, another person should know how to access critical information and make essential decisions.
The value of the plan is not that every possible disruption can be predicted in advance. Its value is that the business has already thought about what matters most and what alternatives are available.
That distinction became especially important during COVID-19.
WHY DID COVID-19 MAKE BUSINESS CONTINUITY SO IMPORTANT?
COVID-19 made Business Continuity unusually visible because many businesses suddenly discovered that assumptions they had relied upon for years could disappear almost overnight.
People could not necessarily travel to work. Premises might be closed. Employees became unavailable. Suppliers were disrupted. Customers changed how they bought goods and services. Face-to-face activities had to move online where possible. Technology that had previously been convenient became essential.
The disruption was also unusual because several problems developed at the same time. A continuity plan designed only around losing an office or one system could not necessarily address simultaneous workforce, supplier, technology and customer disruption.
Many businesses therefore had to improvise. Video meetings replaced physical meetings. Cloud collaboration became central to daily work. Employees worked from home. Businesses created new delivery channels and digital processes quickly because the normal way of operating had disappeared.
The important Business Continuity lesson from COVID-19 is not simply “have a pandemic plan.” That is too narrow.
The deeper lesson is:
Do not assume that tomorrow will allow you to operate in the same way you operate today.
The next disruption may be completely different, but the continuity discipline remains useful because it asks which activities must continue, what they depend upon and what alternatives exist if normal arrangements disappear.
Business Continuity should therefore remain near the top of the risk-management mind even after COVID-19. Being caught unprepared once should make us better prepared for the next disruption, not only the same disruption repeating itself.
HOW IS BUSINESS CONTINUITY DIFFERENT FROM OPERATIONAL RESILIENCE?
Business Continuity focuses on the plans, strategies and arrangements used to continue or recover business activities during disruption. Operational Resilience takes the broader view of whether important services can withstand, adapt to and recover from disruption across all of their dependencies.
The two are closely connected.
A BCP may explain what employees should do if a system becomes unavailable. Operational Resilience asks whether the important service can actually continue once all dependencies are considered.
For example, a business may have a backup system and a continuity plan. But if the only employee who knows how to activate that backup is unavailable, the service may still fail. Likewise, an alternative supplier may exist, but if that supplier depends upon the same underlying provider as the original supplier, the apparent contingency may not provide much resilience.
This is why the previous Operational Resilience page focused heavily on end-to-end dependencies. Business Continuity provides many of the practical tools used during disruption. Operational Resilience asks whether those tools are enough when the whole chain is tested.
The pages therefore fit together rather than duplicate one another.
HOW DOES BUSINESS CONTINUITY LINK TO TECHNOLOGY RISK?
Technology has become one of the most important Business Continuity dependencies for individuals and small companies.
A business may depend upon a booking system, payment platform, email, cloud storage, customer-management software or accounting application. Technology Risk asks whether those systems are reliable, appropriately managed and recoverable. Business Continuity asks what the business will do when one of those systems is unavailable anyway.
Suppose the booking system goes down. The Technology Risk response may involve system recovery, backups and work with the provider. The Business Continuity response asks whether appointments can be taken another way in the meantime.
This is why manual fallback arrangements, alternative platforms and accessible backup information can still matter even in highly digital businesses.
Technology Risk attempts to reduce the likelihood and impact of technology failure. Business Continuity assumes that failure can still occur and asks how the business continues despite it.
HOW DOES CYBER RISK LINK TO BUSINESS CONTINUITY?
Cyber incidents are now an important Business Continuity scenario because a successful attack can make technology and information unavailable for an uncertain period.
Ransomware is an obvious example. Cyber controls such as patching, multi-factor authentication, access management, endpoint protection and employee awareness try to prevent the attack from succeeding. If the attack succeeds anyway, the Business Continuity questions change immediately.
Can the business still operate? Are backups usable? Is there a manual workaround? How will customers be contacted? Which services should be restored first? What happens if email or customer records are unavailable?
The Cyber Risk page therefore focuses more deeply on preventing, detecting and responding to malicious digital activity. Business Continuity focuses on keeping important business activities going while the cyber problem is being contained and recovered.
This also demonstrates why no Pillar should be treated in isolation. The same incident may require Cyber Risk controls, Technology Risk recovery, Business Continuity arrangements and Operational Resilience thinking simultaneously.
HOW DOES BUSINESS CONTINUITY BECOME AN ENTERPRISE RISK ISSUE?
Business Continuity becomes part of Enterprise Risk when a disruption becomes significant enough to affect the broader objectives or survival of the business.
A small technology outage lasting twenty minutes may be inconvenient. The same outage lasting a week could threaten revenue, customer relationships and cash flow.
A key employee being absent for one day may be manageable. Losing the only person who understands a critical process for several months can become a strategic problem.
Enterprise Risk therefore asks what the disruption means for the business as a whole. Business Continuity focuses more specifically on what has to be restored or continued and how that will happen.
This connection also helps small-business owners see why continuity planning is not only about emergencies. It is closely connected to customer concentration, cash-flow resilience, succession, supplier dependency and strategic vulnerability.
HOW HAVE CHANGING WORK BEHAVIOURS AFFECTED BUSINESS CONTINUITY?
Remote work, hybrid work, digital collaboration, outsourcing and flexible employment have changed both the risks and the tools of Business Continuity.
A traditional continuity plan might have focused heavily on what happened if employees could not enter the office. For many businesses today, the office itself may no longer be the most critical dependency. Employees may be able to work from anywhere, but only if they can access cloud applications, identity systems, internet connectivity and digital information.
At the same time, a business may depend upon people who are not employees at all. Bookkeeping, technology support, marketing, design or other functions may be provided by freelancers or external service providers. Continuity planning therefore increasingly needs to consider where critical capability actually sits, not simply which employees are on the payroll.
This change also places greater importance on documentation and knowledge transfer. If only one person understands how an important digital process works, remote work does not remove the key-person dependency.
The continuity toolkit therefore increasingly includes cross-training, documented procedures, shared knowledge repositories, succession arrangements and manual fallback capability.
These issues connect naturally with Future of Work → Workforce Resilience, Future Skills and Ageing Workforce.
HOW DOES DEMOGRAPHIC CHANGE AFFECT BUSINESS CONTINUITY?
Demographic change can create continuity risks because businesses depend upon knowledge and capability as much as technology.
An ageing workforce can create succession challenges where experienced employees hold knowledge that has never been documented. When those people retire or leave, the organisation may discover that an important process cannot easily be transferred.
Small family businesses can face similar issues when the founder remains central to customer relationships, supplier arrangements, decision-making and operational knowledge.
At the same time, newer generations entering the workforce may work differently. They may expect digital tools, flexible working arrangements and rapid access to information. A business that depends heavily upon informal knowledge passed verbally from one person to another may struggle when work becomes more distributed.
Business Continuity therefore increasingly includes knowledge continuity, not merely physical and technological recovery.
A useful question for any small business is:
“If the person who knows how this works is suddenly unavailable, where does that knowledge go?”
If the answer is “nowhere”, that is a Business Continuity vulnerability.
HOW HAVE SUPPLY CHAINS AND THIRD PARTIES CHANGED BUSINESS CONTINUITY?
Small businesses increasingly rely upon third parties for technology, payments, logistics, accounting, cloud services, data processing and other important activities. This means that continuity now depends partly upon businesses outside the organisation's control.
A continuity plan therefore needs to consider what happens when an important provider fails.
The traditional response might have been maintaining an alternative supplier. That remains useful, but the toolkit is becoming more sophisticated because suppliers themselves can have hidden dependencies.
Two different software providers may use the same cloud provider. Two suppliers may depend upon the same manufacturer. Several A.I. applications may depend upon the same underlying foundation model.
The business can therefore believe it has alternatives while still being exposed to one common dependency.
This is where Business Continuity overlaps with Third-Party Risk and Operational Resilience. Third-Party Risk helps assess the external provider. Operational Resilience examines the wider dependency chain. Business Continuity asks what the business will actually do if the provider becomes unavailable.
HOW IS THE BUSINESS CONTINUITY TOOLKIT CHANGING?
The Business Continuity toolkit is evolving from relatively static plans focused on physical disruption towards more flexible arrangements covering digital dependency, remote work, cyber incidents, external providers, knowledge continuity and rapidly changing scenarios.
Established tools remain important. These include Business Impact Analysis, Business Continuity Plans, Recovery Time Objectives, Recovery Point Objectives, alternative-site arrangements, backups, disaster recovery, call trees, crisis communication and continuity exercises.
But some of those tools now look different in practice.
A traditional alternate workplace may be replaced or supplemented by remote-working capability. Call trees can be supported by digital emergency-notification systems. Business Impact Analysis increasingly needs to include cloud and external service dependencies. Recovery planning needs to consider cyber incidents where systems cannot simply be switched back on. Continuity plans may need manual fallback procedures where important automated or A.I.-supported processes become unavailable.
The toolkit is changing because the operating environment is more digital, distributed, outsourced, interconnected and dependent upon people and technology working together.
WHAT ARE RISK PRACTITIONERS BEGINNING TO USE OR ADAPT NOW?
Risk practitioners are increasingly adapting Business Continuity towards more scenario-based, dependency-driven and frequently tested approaches.
One important development is greater use of severe-but-plausible scenarios. Instead of attempting to predict the exact next crisis, practitioners ask whether the business could continue through a sufficiently serious but credible disruption.
Scenario testing is also becoming more interconnected. Rather than testing only one event, such as loss of premises, businesses can consider combinations of disruption. What happens if the technology platform fails while several key employees are unavailable? What if a supplier disruption occurs during a cyber incident? What if remote working is available but the cloud collaboration system is unavailable?
Another development is greater attention to substitutability. It is not enough to write “use alternative supplier” in a plan. Can the alternative supplier actually deliver what is needed, in the required quantity and within the required time?
Practitioners are also increasingly connecting Business Continuity with end-to-end dependency mapping, so that recovery strategies reflect what business activities really rely upon rather than what people assume they rely upon.
Testing is becoming more important too. A plan that has never been exercised contains assumptions. Tabletop exercises, simulations and recovery tests allow those assumptions to be challenged before a real disruption does it for us.
HOW IS A.I. CHANGING BUSINESS CONTINUITY?
A.I. becomes a Business Continuity issue when a business becomes sufficiently dependent upon it that important work cannot easily continue without it.
At first, a small business may use A.I. only for optional tasks such as drafting marketing content. If the service becomes unavailable, the effect is minor.
Over time, however, A.I. may become embedded in customer service, document preparation, analysis, scheduling, operational workflows and decision support. At that point, losing access to the A.I. service can become a continuity problem.
Traditional continuity tools can be adapted to this new dependency. A Business Impact Analysis can identify which activities depend upon A.I. A continuity plan can specify whether a manual process or alternative provider is available. Scenario testing can examine what happens if the A.I. provider becomes unavailable or materially changes its service.
The business may also need to consider whether people still know how to perform the underlying activity.
This creates an important connection with A.I. & Risk, Technology Risk, Future of Work and The Future Human. A.I. Risk examines the technology and governance questions. Business Continuity asks something narrower but very practical: what happens to the business if the A.I. we have come to rely upon is suddenly not there?
CAN A.I. ALSO HELP WITH BUSINESS CONTINUITY?
A.I. can potentially assist Business Continuity by helping to analyse dependencies, summarise procedures, generate scenarios for testing, search continuity documentation and organise information during planning or response.
A small business could, for example, use A.I. to help brainstorm realistic disruption scenarios or identify questions it may have overlooked in a continuity plan. Risk practitioners may use it to compare information across Business Impact Analyses or generate different scenario variations for exercises.
But A.I. should not become the sole repository of the continuity knowledge itself. If the business needs the A.I. service in order to retrieve or understand its Business Continuity Plan, the continuity tool may itself have become another dependency.
The same principle applies here as elsewhere on this website: A.I. can assist Risk Management, but it does not remove the need for verification, judgement and accessible fallback arrangements.
HOW DO CLIMATE AND GEOPOLITICAL RISKS AFFECT BUSINESS CONTINUITY?
Climate events and geopolitical developments become Business Continuity issues when they disrupt the resources required to operate.
An extreme weather event may affect premises, transport, utilities, employees or suppliers. A geopolitical event may affect imports, travel, energy, payments, regulation or the availability of important products.
A small business does not need to predict the geopolitical future or become a climate scientist. It needs to understand whether important activities depend upon something that could be affected and what alternatives might exist.
This is where Business Continuity connects with Signals → Climate Risk and Geopolitical Risk. Signals helps identify developments that may deserve attention. Business Continuity asks what the business would actually do if those developments turned into disruption.
The newer risk therefore does not replace the established continuity discipline. It gives the continuity plan a new scenario to consider.
HOW CAN SIGNALS HELP BUSINESS CONTINUITY BEFORE THE DISRUPTION HAPPENS?
Business Continuity is often associated with what happens after disruption begins, but Signals and horizon scanning can help move some of that thinking earlier.
A business might notice increasing delivery delays from a supplier, recurring outages at a cloud provider, regulatory developments that could restrict an important activity, unusual weather patterns or geopolitical tension affecting a supplier region.
These are not necessarily reasons to activate the Business Continuity Plan. They may simply justify closer monitoring or an early review of alternative arrangements.
This creates a useful connection between Signals and Business Continuity. Signals asks what we should be paying attention to before the risk becomes obvious. Business Continuity asks whether we have somewhere to go if the disruption actually occurs.
The objective is not to predict every crisis. It is to avoid discovering too late that something we were watching had become something we could no longer operate without.
WHAT BUSINESS CONTINUITY QUESTIONS ARE PEOPLE ASKING NOW?
People rarely begin by asking “How do I build a Business Continuity Management framework?” They ask questions created by their actual circumstances.
A solopreneur may ask, “What happens to my business if I am suddenly unable to work?” That is a Business Continuity question involving key-person dependency and succession.
A small-business owner may ask, “What happens if my entire booking and payment system goes down?” That connects Business Continuity with Technology Risk, Third-Party Risk and Operational Resilience.
Someone may ask, “How do I prepare my business for another event like COVID?” The answer is not merely to write another pandemic plan. It is to identify critical activities, dependencies, alternatives and recovery priorities that can help the business respond to a range of disruptions.
A business increasingly using A.I. may ask, “Can my staff still work if the A.I. service becomes unavailable?” That is a modern Business Continuity question involving technology dependency, human capability and Future of Work.
Someone relying on overseas suppliers may ask, “What should I do if geopolitical tensions interrupt my supply chain?” That takes the reader from Signals → Geopolitical Risk into Third-Party Risk and Business Continuity.
Another may ask, “How do I know what part of my business needs to recover first?” That brings us back to one of the oldest Business Continuity tools, the Business Impact Analysis.
The events have changed. The questions remain recognisable.
WHICH NEWER RISKS MAKE THE EVOLUTION OF BUSINESS CONTINUITY USEFUL?
Business Continuity is increasingly relevant to A.I. & Risk, Future of Work, The Future Human and Signals, while continuing to connect strongly with the established Pillars of Technology Risk, Cyber Risk, Enterprise Risk, Operational Resilience and Third-Party Risk.
A.I. creates a new dependency where important work may rely upon an external intelligent system. Future of Work creates continuity questions around distributed work, key skills, changing employment structures and workforce availability. The Future Human becomes relevant where people begin to lose the capability to perform important work without technological assistance.
Signals brings a forward-looking dimension. Climate developments, geopolitical risk, technology trends, regulatory change and emerging risks can all become future Business Continuity scenarios.
The established toolkit therefore remains useful but has to evolve. Business Impact Analysis, Business Continuity Plans, recovery objectives, alternate arrangements and exercises can now be supplemented by cloud and SaaS continuity planning, cyber-recovery playbooks, knowledge-continuity planning, third-party concentration analysis, A.I. fallback arrangements and more complex scenario testing.
These are not entirely new objectives. They are new applications of an old and very practical question:
What will we do if normal stops?
COVID-19 TAUGHT US NOT TO PUT BUSINESS CONTINUITY BACK ON THE SHELF
COVID-19 caught much of the world unprepared for the scale, duration and combination of disruption that followed. For many businesses, Business Continuity suddenly stopped being an exercise performed once a year and became part of everyday survival.
That experience should matter.
The lesson should not be that every business now needs an enormous pandemic plan waiting for the next pandemic. The lesson is that the disruption we prepare for and the disruption we eventually experience may not be the same thing.
What we can prepare is our understanding of what really matters, what those activities depend upon, what alternatives exist, who needs to know what to do and how quickly the business needs to recover.
The next major disruption may be caused by A.I. dependency, a cyberattack, cloud failure, extreme weather, geopolitical instability, supply-chain interruption, workforce shortages or something we have not yet named.
Business Continuity remains useful because it does not require us to predict the exact event.
It asks us to prepare for the consequences of losing something important.
That is why Business Continuity should remain close to the top of the mind even when there is no crisis in front of us. It is much easier to identify an alternative supplier before the supplier fails, document critical knowledge before the key person leaves, test a backup before the system crashes and decide who makes decisions before everybody is trying to make them at once.
COVID-19 reminded us what hindsight feels like.
Business Continuity is one of the ways Risk Management tries to do some of that thinking before hindsight arrives.
That is why Business Continuity remains one of the Pillars of Risk Management.