What it means
The starting point is a business impact analysis, which asks a simple question about every activity: if this stopped, how quickly would it hurt, and how much. That produces a shortlist of processes that genuinely cannot wait, which is usually much shorter than managers expect.
For each critical process the plan sets two targets. The recovery time objective is how long you can tolerate the process being down, and the recovery point objective is how much data or work you can afford to lose, which together drive what you spend on backup systems and standby arrangements.
Continuity planning is deliberately broader than disaster recovery. Disaster recovery is mostly about restoring technology, whereas continuity also covers people, premises, suppliers and communication, including who speaks to customers and what they are allowed to say.
The plan only has value if it is rehearsed. A tabletop exercise, where the team walks through a scenario such as a ransomware incident or the loss of a single key supplier, usually exposes more gaps in two hours than a year of document reviews.
The nuance that matters commercially is that continuity planning has become a sales requirement, not just a risk exercise. Large customers, insurers and public sector buyers increasingly ask for evidence of a tested plan before they sign, so the document earns money as well as protecting it.
In practice
Real-world examples
Example 1
A payroll bureau identifies that processing client payrolls is its only truly time-critical process. It agrees a four-hour recovery time objective for that system alone and accepts a two-day target for everything else, which cuts the cost of its standby arrangements substantially.
Example 2
A food producer discovers during a tabletop exercise that a single supplier provides all its packaging film. It qualifies a second supplier at slightly higher unit cost, and eleven months later that decision keeps three production lines running through a fire at the primary supplier.
Example 3
A professional services firm loses office access for a week after a burst water main. Because its continuity plan already listed home working equipment, call diversion and a client notification template, fee earners were productive again the following morning.
Think of it
Business continuity planning is like wearing a seatbelt in a car. You do not plan to crash, but if an accident happens, that simple preparation prevents a minor incident from becoming a total disaster.
Formula
Calculation
A useful figure is the cost of downtime: cost per hour = (revenue per operating hour x contribution margin) + idle labour cost per hour.
Take a manufacturer with annual revenue of $18,000,000 spread across 3,000 operating hours, giving $18,000,000 / 3,000 = $6,000 of revenue per operating hour. Its contribution margin is 40%, so the profit genuinely lost per idle hour is $6,000 x 0.40 = $2,400.
During an outage, 20 production staff are still paid at a fully loaded $45 an hour, which is 20 x $45 = $900 per hour. Total downtime cost is $2,400 + $900 = $3,300 per hour, so a single eight-hour outage costs 8 x $3,300 = $26,400.
If the continuity programme costs $40,000 a year and is expected to prevent two such outages, the avoided cost is 2 x $26,400 = $52,800. That is $52,800 - $40,000 = $12,800 better than doing nothing, before counting reputational damage or contractual penalties.Case study
Seen in the real world
This is an illustrative, fictional case. Kestrel Analytics is an invented data services company whose continuity plan existed as a 60-page document nobody had opened since it was written.
When a ransomware incident encrypted its main file server on a Tuesday morning, the team discovered the plan named two people who had left, listed a backup provider the company no longer used, and gave no instruction on who should contact clients. Recovery took four days instead of the eight hours the document claimed.
Afterwards, Kestrel rebuilt the plan as a two-page action card per scenario, appointed named deputies for every role, and ran a 90-minute exercise each quarter. The following year a hardware failure took the same server offline and the fictional firm was trading again within five hours, which is the difference a rehearsed plan makes.
Watch out
Common mistakes
- Writing a long plan that nobody rehearses, so the first real test is also the first time anyone reads it.
- Treating continuity as an IT project and ignoring people, premises, suppliers and customer communication.
- Setting recovery time objectives for every process instead of concentrating money on the handful that genuinely cannot wait.
Questions
People also ask
How often should a continuity plan be tested?
At least annually for a full exercise, with shorter scenario walkthroughs each quarter for the most critical processes.
Is business continuity planning only for large companies?
No, small businesses are often more exposed because they have fewer people and rarely have a second site or supplier.
What is the difference between continuity planning and insurance?
Insurance replaces money after the event, while continuity planning keeps you trading so there is less to claim for.