What it means
Continuity planning starts with a business impact analysis, which lists what the organisation does and asks how long each activity could stop before the damage became severe. The answers rarely match intuition, and payroll or customer support often turn out to matter more urgently than the systems that attract the most attention.
Two targets come out of that analysis. The recovery time objective is how quickly a process must be back up, and the recovery point objective is how much data the business can afford to lose, measured as the age of the last usable backup.
The finance angle is straightforward: continuity spending behaves like insurance, so it is judged by comparing the cost of the arrangements against the expected cost of the disruption they prevent. That means somebody has to put a number on an hour of downtime, which is uncomfortable but unavoidable.
Plans that are never tested tend not to work. A live exercise, even a two hour walkthrough around a table, reliably finds the out of date contact list, the backup that has silently been failing and the single person who knows the password.
Continuity is broader than disaster recovery, which is the technology subset dealing with restoring systems and data. A complete plan also covers people, premises, suppliers, customer communication and who has authority to make decisions when the usual approvers cannot be reached.
In practice
Real-world examples.
Example
A payroll bureau discovers during a test that its backup site had no printer stationery for cheques and no route to its bank's payment system. The gap costs nothing to fix in an exercise and would have delayed payments for 40 client companies in a real incident.
Example
A food producer identifies that a single supplier provides 80% of one ingredient. It qualifies a second supplier at a slightly higher price, accepting roughly $60,000 a year of extra cost as the price of not losing a production line for months.
Example
A professional services firm loses office access for a fortnight after a burst water main. Because it had already moved to cloud systems and tested remote working, billable hours fell by less than 5% for the period.
Think of it
“Business continuity is keeping operations running during problems-your backup and recovery plans.
Formula
Calculation
Cost of downtime = (lost revenue per hour + additional cost per hour) x hours of outage
Expected annual loss = cost per incident x expected number of incidents a year
An online retailer takes $87,600,000 of revenue a year and trades around the clock, so revenue per hour is $87,600,000 / 8,760 hours = $10,000. A six hour outage of the ordering system therefore costs $10,000 x 6 = $60,000 of lost revenue.
Recovery work, overtime and customer credits add a further $25,000, giving a total of $60,000 + $25,000 = $85,000 for a single incident. Risk assessment and past experience suggest two such incidents a year, so the expected annual loss is 2 x $85,000 = $170,000.
A standby system that would cut each outage to thirty minutes costs $30,000 a year to run and maintain. Comparing $30,000 of annual spending against most of $170,000 of expected annual loss makes the case straightforward, and the remaining judgement is about how confident the business is in its two incidents a year estimate.Case study
Seen in the real world.
This is an illustrative and clearly fictional example. Larkspur Insurance Services, an invented broker handling around 30,000 policies, had a continuity plan that had been written four years earlier and filed without ever being tested. Its recovery time objective for the policy system was stated as four hours.
In the fictional exercise the finance director finally ran, the team discovered that restoring the policy database from backup took eleven hours, that two of the three named emergency contacts had left the company, and that nobody had the authority to approve emergency spending in the chief executive's absence. None of these problems would have been visible on paper.
Larkspur's illustrative fixes were unglamorous and cheap: a quarterly restore test, a delegated spending authority of $50,000 for a nominated deputy, and a contact list refreshed with every joiner and leaver. When a genuine ransomware incident hit the following year, the firm was serving customers again inside six hours instead of the several days its untested plan would have produced.
Watch out
Common mistakes.
- Writing a continuity plan and never testing it, which leaves the organisation confident about arrangements that quietly stopped working months ago.
- Treating continuity as an IT responsibility alone, when premises, people, suppliers and customer communication all fail in a real incident.
- Setting a recovery time objective by wishful thinking rather than by what the technology and staffing can actually deliver.
Questions
People also ask.
What is the difference between business continuity and disaster recovery?
Disaster recovery is the technology part, restoring systems and data, while business continuity is the wider plan for keeping the whole organisation functioning.
How often should a plan be tested?
At least annually for a full exercise, with lighter checks such as backup restores every quarter, and always after a significant change to systems or premises.
Does insurance remove the need for a continuity plan?
No, because insurance replaces money after the event while a continuity plan protects customers, staff and reputation during it, and insurers increasingly expect to see a tested plan.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%