How often should you review your business continuity plan?

In my experience this is about concept of resilience by design, consider the impact of change on the overall resilience of your organisation as you make the change. Trigger events occur continually and organisations need to be able to adapt as needed, resilience (business continuity) should be part of this discussion.

Triggers can be tricky, as they are generally planned or unplanned. Triggers represent two codependent things that relate to organizational resilience: decision points for action, and learning opportunities. In order for them to be of value to the organization, there should be a list that defines those triggers, such that something that "closely resembles" a trigger can also be scrutinized to see if action is necessary. The trigger list focuses the organization to reduce response lag, while shaping and contributing to organizational learning which is incorporated into the BCP. Far too often, organizations fail to learn from disruptions. Treating trigger points as learning points truly brings life to the BCP.

A corporate-wide mindset on the criticality of business continuity is needed. It should be ingrained as part of corporate culture and way of thinking. Business continuity should be embedded at all levels of business. Implications to trigger events should enable deliberate thinking towards its impact on BCP. Reminders within various templates and procedures like Incident Reports, New product and service proposals, Risk assessment templates, Test reports etc would help to increase that visibility. Ownership remains at the business to ensure this. Other events like near misses or incidents sometimes fly under the radar but may be telling signs to underlying issues or shortcomings.

In the dynamic landscape of business, regularly reviewing your Business Continuity Plan (BCP) is crucial. Key trigger events necessitating a review include significant changes in your operational environment, such as new technological implementations, updates in legal or regulatory requirements, and shifts in market dynamics. Additionally, any alterations in your business structure, like mergers, acquisitions, or expansions, should prompt a BCP review. Natural disasters or emergencies that test your plan's effectiveness also provide critical insights for refinement. Staying proactive by aligning your BCP with these changes ensures resilience and adaptability, safeguarding your operations against unforeseen challenges.

A business continuity plan should typically be reviewed at least annually. However, several additional factors may prompt more frequent reviews to ensure the plan remains effective, relevant, and aligned with evolving risks. Any significant change, such as organizational restructuring, new technology, changes in leadership, changes in critical suppliers, should trigger a review. After any incident that required activating the BCP, to include lessons learnt. Also, when there are changes in Regulations or Compliance Requirements. Any cybersecurity threats, geopolitical tensions, or supply chain vulnerabilities, should also prompt a BCP review. Sometimes, post test analysis triggers BCP review based on the feedback from team members.

Risk assessments require the ability to be attuned to changes in external and internal environments in relation to the business' operations. Making the linkage is key and then making the relevant action plans to address the implications. Examples are the developments in AI, increased cyber incidents, wars, climate related risks.

Factors prompting a review of the risk assessment include technological advancements, shifts in market dynamics, regulatory changes, and lessons learned from recent disruptions. Additionally, internal changes to operations, such as new services, locations, or processes, also necessitate a fresh look at potential risks. Staying proactive and adapting your plans ensures your organization will be prepared unexpected events.

An effective BIA should not only produce a dependency map within your business but also identify those "unplanned events" that might occur in your supply chain that might result in a significant impact or loss within your business. For instance a ransomware attack on a Managed Service provider might have immeasurable and significant consequences and one ship blown off course in the Suez canal!

One of the key input to your BIA is the risk assessment process earlier. Having establish the various high impact risk events and the decision to mitigate them(other than insurance or risk acceptance), the next steps are to establish the impact from financial, reputational, regulatory, systemic, legal and other angles. These are then scaled across time for your RTOs. RPOs would be a factor of the RTOs, timeliness of data and also the ease of data reconstruction versus costs.

In my experience, annual exercises achieve very little. There’s a lot of activity and enthusiasm for a while but that fades after a few weeks. A much better cadence for training is quarterly training and mini-exercises with an annual ‘capstone’ exercise. This keep everyone more current plus new arrivals or promoted staff don’t have to wait too long before they’re brought onboard. (There’s a better explanation here - it’s for crisis training but the same ideas apply https://andrewsheves.com/2023/03/16/how-often-should-your-crisis-management-team-train/) Two other off-cycle occasions are 1) if an incident has occurred to update everyone after the lessons learned is complete and 2) when the operational situation has changed or BCP is updated.

BCP testing is very much about ensuring all those assumptions being made by your executives can be shown to be practically put into place. For instance many organisations assumed that all their staff could work from home! Another assumption is that critical elements like Diesel generators would start and they they had sufficient fuel to run for "x" days! Testing all those other assumptions is essential. If everything works smoothly in the testing then you are not doing it correctly. Think about involving a third party consultant into your next BCP test with the brief to introduce some stress testing (best not done by existing staff!)

Testing and exercising a business continuity plan is crucial for ensuring its effectiveness in real crisis scenarios. It's not just about having a plan on paper; it's about ensuring everyone knows their role and can act swiftly and confidently when disruptions occur. Regular drills and tests help identify gaps and areas for improvement, making the plan a living document that evolves with the business. This proactive approach minimizes downtime and financial loss, safeguarding the organization's reputation and stakeholder trust. In essence, testing is the backbone of a robust continuity strategy, preparing teams to face unforeseen challenges with resilience.

I disagree with the basic premise that the BCP exists separately from the stakeholders. A plan is owned by the actual business unit, the BCP function owns the overall program. As stated previously, the BIA is one key driver in plan update cadence. Depending on the size and complexity of the organization, it makes sense at a program level to define review cadence at at least an annual level.

If you're asking your customers how often you should update your BCP, you're doing it wrong. Big Red Flag. Same with your investors: "You mean you don't know how often to do this? And we're giving you money?"

In my experience, stakeholders usually don't have an opinion on plan reviews (in fact they often prefer 'less is better'). That said, a Plan Owner is someone who has a vested interest in the plan and should be asked about their comfort level with the plan. If they are not comfortable (for whatever reason, training, testing, documentation, strategies, etc.) that is feedback to follow up with!

In any business continuity plan, obtaining stakeholder feedback is not just a step; it's a cornerstone. Stakeholders often spotlight potential oversights and offer unique perspectives that can significantly fortify a plan's resilience. Their input ensures the plan aligns with both internal expectations and external requirements, making it more robust against disruptions. This approach not only enhances plan effectiveness but also fosters a culture of collaboration and trust.

My Top Tips: Once a year review and update is good. Over and above that 'whenever required'. This whenever required is when some significant changes have happened to or for your business. As a good practice I will recommend inviting suggestions from all employees for improvement in BCMS and when good meaningful suggestions have been received - you can review and update your BCP out of turn also.

Consider rethinking the entire value proposition of BCP! Historically , BCP was born, shaped and popularized pre-internet, pre-cloud, pre-digital, pre-X-as-Code, pre-COVID, pre-ChatGPT . As a result to this long list of “pre”s, it has a certain reputation of being for old-er, large-er, more-analog organizations. What I am currently exploring-and-refining-by-practice (and formulating) is looking at how BCP can be (and is) a “value” creator and enabler? Moving it from being a Risk-only focused to being a prerequisite for scaling and growing that must be “designed” for and built iteratively & progressively. This is a key to rethinking “scale & growth” from a “later” thing we do/worry about …to… designing for scale from the get go.

I think review of BCP should be once in a year or whenever there is any event of invoking BCP then lesson learned must be incorporated.