The business continuity plan (BCP), in Italian piano di continuità operativa (PCO), is the set of documented procedures that guide an organisation in responding to a disruption, recovering and restoring activities to a predefined level. It typically covers the resources, services and activities needed to ensure critical functions, and it is one of the main outputs of business continuity management, which we discussed in a dedicated article.
A plan is judged by how well it is used in an emergency, with little time and heavy pressure. Before writing, however, groundwork is needed: that of risk management, which identifies the threats, and of impact analysis, which establishes which activities cannot stop.
In this article, we look at what a BCP is, how it is structured and how to start writing one for your organisation straight away.
The business continuity plan in three key points
States who decides and who acts
The business continuity plan establishes who decides, who acts and in what order operations resume.
There is no single structure
The recurring elements are purpose, roles, activation criteria, priorities, communication and deactivation.
It only has value if it is used
It must be quick to read, up to date and tested.
Business continuity plan: what it contains
Although common formulations may exist, there is no standardised BCP structure that applies to everyone. It is more useful to think in terms of the recurring elements: those needed to answer the questions an emergency raises, namely ‘what has happened?’, ‘how serious is it?’, ‘who decides?’, ‘what is restored first?’, ‘who needs to be informed?’.
The table below sets them out in order.
| Section | What it says | Question it answers |
|---|---|---|
| Document information | Version, owner, date of last test | Is this the plan currently in force? |
| Objectives and scope | Which activities and incidents it covers, and up to what severity | Does it apply to this situation? |
| Limitations | The conditions under which the plan does not apply | When is a different plan needed? |
| Roles and responsibilities | Who manages the incident and who mobilises the response teams | Who is in command and who carries out? |
| Criteria and activation | How severity is assessed, when the plan is activated, how matters are escalated | When is the plan triggered? |
| Restoration priority | Restart order based on criticality, RTO and RPO | What restarts first? |
| Communication and contacts | Internal and external messages, list of contacts | Who must be informed, and by whom? |
| Deactivation | How to return to normal procedures | When is the emergency over? |
Once these questions have been answered, the plan can then refer to specific plans, for example the crisis plan, the pandemic plan or the crisis communication plan.
How to write a business continuity plan
The plan rests on three decisions taken before any writing begins. A text that ignores them is merely decorative.
- Which activities are critical. These are derived from the business impact analysis (BIA), which estimates how the effects of an interruption grow over time (BCI). A plan that covers everything prioritises nothing.
- How much downtime is tolerable. The maximum period of disruption determines the recovery time (RTO) and the amount of data the organisation accepts it may lose (RPO), which set the priorities (Wikipedia). These are decisions for senior leadership, not technical values to be left to IT.
- Who has the authority to activate the plan. If nobody can declare it in force, the first few hours are spent improvising.
The text must be written to be used under stress, so it is essential that it be direct, adaptable, concise and relevant (Wikipedia).
No complex sentences: short sentences, numbered actions, and names and contact details instead of generic roles work better.
Business continuity plan example
Take a hypothetical case, invented for illustrative purposes: a logistics company with eighty people, a cloud-based ERP system and a warehouse. The impact analysis identifies two critical activities: dispatching orders and communicating with customers. Senior management sets a maximum downtime of half a day for dispatch.
Scenario covered
The ERP system has been unreachable for more than two hours.
Who activates
The operations director, or their deputy, named individually.
Getting started
Staff switch to manual procedures on paper forms, and customers with same-day shipments are notified.
Priority
First, deliveries already assigned; then the day’s orders; then the backlog.
Communications
One manager writes to customers using pre-approved text; another updates staff.
Recovery
Manual data is re-entered and checked for consistency with the ERP system.
Deactivation
The operations director declares the emergency over and initiates the review.
The value of the example lies in the method: every row answers a question and has a name next to it. That way, it can be used with complete confidence.
Activating and deactivating the business continuity plan
Activation rests on decision criteria that assess the severity of the incident and the levels to involve, on invocation procedures and on escalation procedures, which establish how the problem is brought to senior management (Wikipedia). The practical rule is that the criteria must be measurable: not ‘a serious failure’, but ‘the service has been down for more than two hours’.
Deactivation is often forgotten: it ensures an orderly return to normal procedures, so that emergency procedures, which cost more and generate errors, are not left running. Closure is followed by a review of what worked and what did not.
Testing and updating the business continuity plan
A plan that has never been tested remains a hypothesis. A maintenance programme keeps it up to date through tests and exercises; in the BCI cycle, the validation phase uses tests, exercises, performance assessments and audits to verify that the programme and the plan are adequate (Wikipedia).
The plan must be revisited whenever something relevant to it changes: a system, a site, a supplier, a person in a named role. The last case is the classic key person risk: if the named individual leaves the company, the plan has a gap that only the list of roles makes visible.
Continuity plan and disaster recovery
The business continuity plan concerns the entire organisation: people, sites, suppliers and communication, as well as systems. Disaster recovery concerns the restoration of IT systems and is, as a rule, a specific plan referenced by the business continuity plan. One does not replace the other: a company can recover its data within a few hours and still not know where its people can work in the meantime.
When the disruption becomes a matter that affects reputation, the plan links to the crisis management plan, which covers decisions and communication at leadership level.
Specific scenarios are the subject of contingency planning, which we will soon explore separately.
The Bliss corner: the plan nobody opens
The most common flaw is creating a plan that nobody opens. It is written for an audit, filed away, and at the first real outage people do what they know how to do, not what is written. The remedy is a plan of a few pages, with people’s names, tested often enough to be familiar.
A simple test
Choose someone who did not write the plan and ask them, at any hour, what they would do if the main system went down.
If the answer matches the plan, the plan is alive.
If not, the gap between the two answers is the work to be done, and it is worth more than another revision of the text.
The Bliss Agency perspective
Domande frequenti
What is a business continuity plan?
The business continuity plan is a set of documented procedures that guide an organisation in responding to a disruption, recovering and restoring activities to a predefined level. It typically covers the resources, services and activities needed to ensure critical functions. It is one of the main outputs of the business continuity management cycle (Wikipedia).
What should a business continuity plan contain?
There is no single structure, but the recurring elements are document information, objectives, scope and limits, roles and responsibilities, activation criteria, escalation procedures, recovery priorities, communication and contacts, and deactivation. It may also refer to other plans, for example crisis or communication plans (Wikipedia).
Who writes the business continuity plan?
It is written by those who know the critical activities, usually the business continuity manager together with process owners and IT, while decisions on downtime and priorities rest with senior management. A plan written only by a consultant or only by IT risks not reflecting the organisation’s real choices.
How do you write a business continuity plan?
You start with the critical activities, which emerge from the impact analysis, set the tolerable recovery times and decide who can activate the plan. Then you write directly and concisely, with numbered actions and names in place of generic roles. Finally, you test it, because a plan that has never been tested remains a hypothesis.
What is the difference between a business continuity plan and disaster recovery?
The continuity plan concerns the organisation as a whole: people, sites, suppliers, communication and systems. Disaster recovery concerns the restoration of IT systems and is usually a specific plan referenced by the former. The two are complementary, and IT recovery times must be consistent with those required by critical activities.
What is the difference between BCM and BCP?
Business continuity management is the process and management system that identifies threats, assesses impacts, builds the capability to continue and maintains it over time. The business continuity plan is one of its outputs: the operational document that states what to do when an interruption occurs. The former decides and updates; the latter guides action.
How often should the plan be updated and tested?
The plan must be kept up to date through a maintenance programme that includes tests and exercises, and revisited whenever systems, sites, suppliers or people in named roles change. A fixed frequency depends on the organisation and the sector: what matters is that the programme exists, is scheduled and produces documented corrections after each test.
When is the business continuity plan activated?
It is activated when an event exceeds a threshold set by the decision criteria, which assess the severity of the incident and the levels to be involved. Invocation procedures state who declares the plan in force; escalation procedures state how management is informed. Measurable criteria, such as a length of downtime, reduce doubt at the critical moment.
Does a small business need a continuity plan too?
Yes, in proportionate form. A small business has fewer critical activities and fewer systems, so the plan can fit into a few pages: main scenarios, who decides, alternative procedures and contacts. The risk for a small organisation is dependence on a few people or a single supplier, which a simple plan helps to make visible.