Business continuity that works when normal operations do not
When comparing business continuity consultants, decide first whether you need a business impact analysis, a usable BCP, a controlled scenario exercise or an ongoing BCMS. A narrow scope may be more proportionate than an open-ended transformation. Explore BIA work, compare business continuity with operational resilience or discuss a specific requirement.
A business continuity consultant helps an organisation decide which activities must continue during disruption, what resources enable them and how recovery procedures will be triggered and exercised. In financial services, that work must also connect to the firm’s regulatory context. An attractive template is insufficient if no service owner can explain what happens when a payment rail is unavailable at the busiest point of the day.
We scope continuity consulting around real workflows, not pages of boilerplate. The result should be a business impact analysis, usable team-specific procedures, an exercise schedule and an agreed maintenance owner. A client should know which assumptions are proven and which still depend on an untested provider promise.
What a continuity engagement can deliver
- Business impact analysis (BIA): identify activities, consequences of interruption, peak periods, dependencies and acceptable recovery objectives.
- Continuity strategies: decide on manual processing, alternate locations, staff cover, reciprocal arrangements and recovery sequence.
- Business continuity plans (BCPs): create role-specific activation, communications, workaround and restoration instructions.
- Exercises: test scenarios with named decision-makers, time-bound injects and documented exceptions.
- Maintenance: assign owners and triggers for updating plans after organisational, technology or supplier changes.
We distinguish a plan from a business continuity management system. A BCP describes actions during an incident. A BCMS governs how continuity requirements are identified, implemented, tested, reviewed and improved across an organisation. ISO 22301:2019 specifies BCMS requirements; certification is a separate independent process and should never be implied simply because documents have been drafted.
Business continuity versus operational resilience
Traditional continuity programmes often assess the recovery of functions or processes. FCA operational resilience for in-scope firms begins with important business services and the point at which disruption would create intolerable harm to clients or market integrity. A technology platform may recover to its internal RTO and still cause intolerable customer harm because manual reconciliation or supplier communications are too slow. Both approaches are useful, but they answer different questions.
An example: the unavailable customer-support platform
Imagine a payments firm loses its usual contact centre and CRM at the same time. A plan that says “work from home” may fail if staff authentication and case access use the same identity service. A meaningful exercise asks who can reach vulnerable customers, what alternative records can safely be used, how suspicious activity reports are escalated and whether communications remain lawful and accurate. Those are scenario prompts, not claims about a real client.
How to assess proposals from a BCP consultant
Ask how many workshops and exercises are included; whether they will involve the third-party owners; what level of plan detail is delivered; how recovery claims will be tested; and what happens after handover. If continuity must remain reliable throughout the year, consider a defined managed service rather than paying repeatedly to refresh outdated files.
Exactly what to request in a business continuity consultant’s proposal
Ask bidders for a deliverables register before commissioning a full BCMS. A useful proposal answers six questions: which departments and processes will be assessed; how BIA findings will determine recovery objectives; how many plans and workshops are included; which third parties will be questioned; what form the first exercise will take; and who will own updates after project closure. The number of consultants involved matters less than whether actual service owners will participate.
| Procurement question | Strong evidence to request | Warning sign |
|---|---|---|
| Will plans work without the main IT system? | Manual procedure with constraints and an exercised activation path | ‘IT will restore everything’ with no dependencies |
| Are recovery times credible? | BIA rationale, capacity assumptions and observed recovery data | Untested RTO copied from a contract |
| Can the team use the plan? | Named role responsibilities, accessible procedures and exercise records | Long policy with no operator actions |
| What happens after handover? | Change triggers, review owner and maintenance schedule | ‘Update annually’ with no ownership |
Illustrative distinction: A 4-hour database recovery target can be achieved technically while customer payment operations remain unavailable for longer because transaction reconciliation and fraud checks were not recovered. Continuity planning should identify both the IT milestone and the actual return of the business process. For an in-scope financial firm, the separate assessment against service-level impact tolerance is still necessary.
Practical template to use with your team
- Download the BCP working outline — adapt, verify and approve before operational use.
Frequently asked questions
What is the difference between a BCP and a BCMS?
A BCP describes response and recovery actions. A BCMS is the management system that owns, reviews, exercises and continually improves continuity arrangements.
Do we need ISO 22301 certification?
Not necessarily. Many organisations use the standard as a framework without seeking independent certification. Requirements depend on contractual, business and other obligations.
Does business continuity planning satisfy FCA SYSC 15A?
It contributes important evidence, but on its own it does not cover all obligations around important business services, impact tolerances, mapping, testing and governance.