Business continuity

Continuity arrangements you could actually run.

Work out what your organisation cannot afford to lose, write arrangements your own people could pick up and run, then put those arrangements in front of a real situation and find out. I take on the whole of that, whichever part of it you are missing, or run it for you month to month.

Front cover of the Ross Macdonald Consultancy business continuity exercise programme overview
01 / What I see

Organisations come unstuck in the same four places.

Four things I keep finding when I exercise and audit continuity arrangements. This is my own view from the work itself, not research, and it recurs often enough to design around.

01

The plan is opened for the first time during the incident

It was written by one or two people, approved, and filed. The people who would have to run it have often never read it. Where there is no plan at all, the same holds for whatever everyone assumes the arrangements to be, because those assumptions have never been compared out loud.

02

What you need sits inside the thing that failed

Contracted response times, site detail, supplier numbers and staff contacts live in the system that is unavailable, or in the building your people cannot get into. An exercise finds that in an afternoon. An incident finds it at four in the morning.

03

Authority is assumed rather than agreed

Plans say who leads. Fewer say who leads while that person is on a flight, and fewer still say what the deputy is allowed to spend without asking. Organisations discover in the room that a great deal rests on two or three individuals in ways that have never been written down.

04

Recovery is treated as the finish line

Systems come back and the plan stops. The reconciliation, the backlog and the account you owe other people all begin at that point, and they usually run longer than the disruption did.

02 / The work

Four stages, and you can start at any of them.

Some organisations need the whole sequence. Some already hold an analysis and need the plan written. Some hold a plan that has never been used. I take on whichever part is missing and say plainly where I think you should begin.

01

Business impact analysis

Interviews and workshops with the people who run the work. No questionnaire sent round by email. What comes out of it is written down and evidenced.

The activities that matter most, and who depends on them
What each one depends on, including the dependencies that were never recorded
How long each could stop before the consequences became unacceptable, and the recovery times you set against that
The minimum people, systems and premises a reduced operation would need
A priority order agreed with the people who will have to live with it
02

The continuity plan

Written from your analysis, in your language, short enough that your duty manager would open it at seven in the morning. Owned by your people rather than by me.

When the plan is invoked, by whom, and what happens in the first hour
Roles and the authority that goes with each one, including who deputises
Recovery strategies for the priorities the analysis identified
What is said to staff, customers, suppliers and anyone you are obliged to tell
Version control, an owner, a review date, and a walkthrough with your management team so they have used it once before they need it
03

Exercising

A plan is finished when your people have used it. A facilitated session puts your people into a situation and establishes what they would actually do, which is where the gaps show. The rest of this page covers how that runs.

Ten exercises to choose from, scoped to your organisation beforehand
A written report with observations, actions and owners
Changes fed back into the plan, so it actually gets updated
04

Review

Arrangements go out of date quietly. A plan written against last year's premises, systems and staff will be wrong in places you have not yet noticed, which is why the review needs to be arranged in advance.

An annual review of the analysis and the plan against what has changed
A review after anything significant: a move, an acquisition, a new system, a change of supplier
Actions from the last exercise closed out instead of rolling into next year
03 / Ways to work with me

Where you want to start.

Some organisations want a defined job with a finished deliverable at the end of it. Some want the exercise on its own. Some want continuity held alongside the rest of their risk, quality and compliance picture, month to month, run by a fractional director who already knows the organisation.

Consultancy

The analysis and the plan

Scoped at the outset and quoted as a package, so you know what you are getting and what it costs before anything starts. The work runs to that scope and finishes with documents your people own.

Interviews and workshops with your people
The impact analysis and the continuity plan, written and handed over
A walkthrough with your management team before I leave
Exercising

One session, or a programme

Booked on its own, whether or not I wrote the plan. Where arrangements already exist, this is the fastest way I know to find out how good they are.

Ten exercises, scoped to your organisation beforehand
Preparation, delivery, and a written report with actions and owners
Sessions across a year or two where you want a standing programme
Ongoing

Fractional director support

Continuity sits inside a wider risk, quality and compliance picture. For a few organisations I run that picture myself, a couple of days a month, sitting with the leadership team and doing the work between meetings.

The competence of a director, at a fraction of the cost
The exercise programme and the annual review simply happen
A limited number of these at any time, by design
04 / The session

The exercise itself, run properly.

A situation develops in stages. At each stage the group says what they would genuinely do, using the plans, systems and contacts they actually have. I hold the pace, press where it matters and record what happens.

Length
Ninety minutes to two hours
In the room
Four to ten people
Preparation asked of them
None on the day

What the exercise will do

Establish what your people would actually do, in their own words
Show whether the arrangements people think are in place actually are
Put the assumptions that were never written down in front of everyone at once
Leave you with a written record of all of it, with an action and an owner against each finding

What the exercise will not do

Change or test any live system
Contact your customers, suppliers or the emergency services
Assess or record the performance of any individual
Produce a judgement about your organisation that we have not discussed with you first

We are exercising the arrangements and the assumptions underneath them. Where we find a weakness, that is the exercise doing its job.

05 / The programme

Ten exercises, in a deliberate order.

The programme covers losing the premises, losing your own systems, a possible cyber compromise, dependency on a provider, competing demand you cannot meet, the outright failure of a supplier, decisions taken without the usual people, something that happened out of hours and went unnoticed, a disruption that has run for a week, and the weeks after restoration.

Each one is pitched at a level, from a short structured conversation through to an executive tabletop, and each assumes only what the sessions before it have established. Which one you start with comes out of the first conversation.

06 / Scoping

Built around your organisation.

Ahead of the session you answer a set of questions about your building, your working patterns, your obligations and the words your people actually use. The material for the day is written from those answers.

Some of what I ask about will be commercially sensitive or restricted. Where that applies, hold it back and we raise it verbally on the day, with only the people you have chosen to be there.

07 / What you receive
A written business impact analysis, showing what was assessed, by whom, and on what basis
A continuity plan your own people can pick up and run, under version control with a named owner
The exercise, delivered at your premises or remotely, with participant material issued beforehand
A written report of the exercise, with each observation classified and each action given an owner, and documentation that stands as evidence for an auditor, a client or a funder
08 / Why organisations do it

Because they want to know.

Most of the organisations I work with do this because they want an honest answer to a question that has been nagging at them, and because a leadership team that has worked through it once is quicker and steadier when something real happens. That is reason enough on its own.

Where a standard is in play, the record follows without extra work. The analysis, the plan and the exercises follow the principles of ISO 22301, the international standard for business continuity management, which asks for an exercise programme built on suitable scenarios, held at planned intervals, each followed by a formal report and corrective actions.

Following those principles is a different thing from implementing the whole management system and certifying against it. Most of the organisations I work with want the first. Where you genuinely need the second, I will say so, and that is a larger piece of work.

Organisations with no certified management system get the same value and none of the paperwork burden.

09 / Who it suits
Organisations whose arrangements have never been used in earnest
Organisations with nothing written down yet, who need the analysis and the plan built from scratch
Organisations working towards certification, or holding it and due to exercise
Organisations whose clients, insurers or funders have begun asking what would happen
Organisations that have had a near miss and want to know what it showed them

Tell me what worries you most.

All conversations are treated as strictly confidential. If you want to know what your organisation would actually do, that is a conversation worth having before anything happens.

Call 0333 335 6730 Email Ross
© 2026 Ross Macdonald Consultancy Ltd · Company No. SC848204
Home Strategic planning ISO management systems Safety and security Privacy notice