Business Continuity Management

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

From Analysis to Testing

Business Continuity Management (BCM) is not a one-time project but an ongoing process that makes organisations resilient to crises and disruptions. Central to this is the lifecycle approach, which divides BCM into clearly structured phases. This process-oriented approach reveals how a robust continuity management system systematically emerges from the identified processes.

Phase 1

Business Impact Analysis and Risk Assessment

The first phase of the Business Continuity Management (BCM) lifecycle forms the foundation for all subsequent activities. In this analysis phase, the business-critical processes, their time tolerances, as well as the dependent resources and risks are systematically identified and assessed. The aim is to develop a clear understanding of what is truly critical in the company and which factors could threaten the continuity of operations.

Business Impact Analysis (BIA)

The Business Impact Analysis is the core of the first phase. It is used to determine the impact of a process interruption on the company.

The central question is:

„How long can a process be down before the consequences become unacceptable for the company?“

For this purpose, metrics such as the Maximum Tolerable Period of Disruption (MTPD) and the Recovery Time Objective (RTO) are determined.

The BIA reveals which processes must be prioritised for recovery to avoid existential, legal, financial, or reputational damage. At the same time, it provides transparency about dependencies between processes and resources, forming the basis for subsequent recovery planning.

Risk Assessment (RIA)

Following the BIA is the Risk Assessment, which takes a closer look at the identified time-critical resources – such as personnel, buildings, IT systems, suppliers, or information.

The focus here shifts from process criticality to the vulnerability of resources.

Both internal risks (e.g., technical failures, staff shortages) and external risks (e.g., natural events, political instability, or supply chain disruptions) are assessed.

For further details on risk management and the necessary steps in the Risk Assessment, please refer to the NOVELEDGE Blog on Risk Management

The aim of the Risk Assessment is to identify the probable causes of potential operational disruptions and to define preventive and reactive protective measures. This lays the foundation for Phase 2 of the BCM lifecycle: the development of the Business Continuity Strategy.

Interaction and Significance

BIA and RIA are closely interlinked:

While the BIA determines what is critical and when a response is needed, the Risk Assessment shows why failures might occur and how they can be avoided or minimised.

Only the interaction of both analyses enables a comprehensive assessment of organisational resilience and provides the necessary decision-making basis for an effective BCM strategy.

Phase 2

Development of the Business Continuity Strategy

Based on the results of the BIA and Risk Assessment, a Business Continuity Strategy is developed. It defines which measures, capacities, and alternatives are necessary to maintain or quickly restore time-critical processes and resources in an emergency.

At its core, this means a Check & Secure:

• Check: Alignment between RTO, RTA, and MTPD to ensure that recovery times are realistic and achievable.
• Secure: Derivation of measures to secure resources and processes.

It is important to note that strategies must always be tailored to the organisation. A standard plan never fits all companies, but only an approach that considers the existing structures, capacities, and conditions.

The development of a Business Continuity Strategy forms the core of the second phase in the BCM lifecycle. It bridges the gap between the previously conducted analysis (e.g., Business Impact Analysis, Risk Analysis) and the subsequent operational implementation. While the analysis identifies critical processes, dependencies, and requirements, the strategy answers the question “How do we ensure maintenance or recovery?”

This phase is particularly characterised by the division into visible and non-visible elements:

Visible Area (above the waterline): This includes clearly formulated measures, plans, and courses of action. These are comprehensible to all involved, concretely measurable, and often documented (e.g., alternative locations, emergency workstations, backup IT systems, supplier strategies).

Non-visible Area (below the waterline): The majority of a BC strategy, however, lies hidden. This includes structural, supportive, and monitoring elements such as governance, responsibilities, internal control mechanisms, resource allocation, or integration into the risk management system. These factors are not immediately apparent but form the foundation for the visible measures to function at all.

The Iceberg Metaphor illustrates this tension: Only a small part of the BC strategy is immediately visible, the majority of the requirements lie below the surface and often go unnoticed – although they are crucial for effectiveness.

The „pink elephant“ in the room

Another challenge is the factors that, although known to all involved, are often not openly addressed. These can be unresolved goal conflicts, political interests, resource deficits, or organisational tensions. The „pink elephant“ symbolises these hindering factors that are conspicuously present in many organisations but are ignored.

A sustainable Business Continuity strategy therefore requires not only consideration of the visible and invisible structural elements but also the courageous handling of these disruptive factors. Only when they are addressed and integrated into the strategic development process can the BC strategy reach its full potential.

Phase 3

Implementation in Business Continuity Plans

The developed strategy is now translated into concrete Business Continuity Plans (BC Plans). These include:

Again, the plans must fit the organisation. What makes sense in a large industrial company may be too complex for a medium-sized business. The key is tailored fit – only then are BC plans effective in an emergency.

Phase 4

Testing and Exercising

A Business Continuity Plan (BCP) remains theoretical until it has been tested. Therefore, testing and exercising form the final phase of the BCM lifecycle and simultaneously mark the transition into the continuous improvement process (PDCA). The aim is to validate the practical feasibility of strategies, plans, and roles, and to measure whether the actual recovery time (RTA) meets the target time (RTO) from the BIA. ISO 22301^[1] establishes a programmatic exercise and review regime with clear requirements for objectives, scenarios, execution, reports, and improvements.

What is tested?

• Plans & Procedures (8.4): Activation criteria, roles, communication, recovery, and return to normal operations – including evidence that high-priority activities can be continued/recovered within specified timeframes.
• Time Objectives (8.2 BIA): RTO as a target and RTA as a measurement result; MTPD, dependencies, resources.
• Strategies/Solutions (8.3): Suitability and resource backing (personnel, ICT, locations, supply chain) including cost-benefit analysis.

When is it tested?

• Regularly & on occasion: Exercises/reviews „at planned intervals“ and upon significant changes (organisation, context) as well as after incidents/activations. Results lead to improvements (8.5, 8.6, 10).
• Performance Evaluation & Management Review: Define metrics, evaluate results (9.1), conduct internal audits (9.2), and decide in the Management Review (9.3): Update BIA, risk assessment, strategies, and plans.

How is it tested?

Forms, Effort & Benefit (evidence-based)

ISO 22301 requires an exercise and review programme with suitable, clear scenarios, defined objectives, and formalised reports (8.5 a–g). Based on this, the following staged model can be used; increasing degree of realism = more evidence for effectiveness/RTA:

Documentation Requirement: Each exercise generates reports with results, recommendations, and actions; the organisation responds to this (implement improvements) – core requirements from 8.5 e–g and 10.1/10.2.

Why is it tested?

Demonstrating Effectiveness & PDCA

• Validation instead of Assumptions: Only exercises prove that strategies, plans, and resources are effective and time objectives remain achievable (8.5, 8.6).
• Continuous Improvement: Results feed into corrective actions (10.1) and ongoing improvement (10.2); metrics/measurements guide further development (9.1, 9.3).

Scenario Derivation (risk & BIA-based)

In practice, you derive scenarios from time-critical activities/resources (BIA, 8.2.2 f–h) and the effective risks on them (8.2.3 a–c). This results in exercises that directly impact critical value creation and dependencies (e.g., ICT, supply chain, locations) – precisely in line with the standard logic BIA → Strategy (8.3) → Plans (8.4) → Exercise (8.5).

Good Practices for Phase 4 (with ISO Reference)

• Establish Stage Logic (Maturity-based): Tabletop → Simulation → Technical Test → Full Exercise (8.5 b/d).
• Make it Measurable: Define KPIs/Time-Stamps in advance (RTA recording), set criteria for goal achievement (9.1).
• Test Communication: Warning/communication procedures are part of the exercise program (8.4.3 2, last paragraph).
• Include Partners/Suppliers: Assess capabilities (8.6 c) – especially in outsourcing/supply chain.

BCM as a Continuous Process

Especially in today’s times full of uncertainties and unpredictable developments, it becomes clear why BCM must not be limited to individual scenarios or specific risks. This is where the metaphor of the black swan comes into play: It refers to events that were previously considered almost impossible or unthinkable – and then suddenly occur with massive impacts. Such black swans show that organisations must not focus solely on known dangers. Instead, a scenario-independent, cross-disciplinary all-hazards approach is needed, which does not ask whether a process will be disrupted, but when and for how long.

BCM fundamentally differs from a classic risk management approach: It does not primarily focus on the probability of certain risks, but on the fact that critical processes can fail at any time, whether due to external influences, internal disruptions, or indeed the „black swan“. This is precisely where the particular strength of BCM lies – it ensures that organisations remain robust and resilient, even when the unthinkable occurs.

This makes it clear: BCM is not a static construct, but a continuous, cyclical process that must be regularly reviewed, adjusted, and practiced. Only in this way can an organisation keep pace with constant changes and be prepared for the unforeseen – including the next black swan.

Organisational Ambidexterity as a Challenge for Effective Business Continuity Management

Companies today face an environment characterized by uncertainty, dynamism, and complexity. Technological upheavals, geopolitical tensions, climate crises, or changing consumer behavior pose the question to organizations: How can they reliably secure their core business while remaining innovative to stay competitive in the future?

The answer lies in the concept of organizational ambidexterity.

What does organizational ambidexterity mean?

The term describes an organization’s ability to simultaneously meet two seemingly contradictory demands:

• Exploitation: optimizing and efficiently utilizing existing processes, products, and structures. It represents stability, reliability, and securing the core business.
• Exploration: tapping into new markets, technologies, business models, and capabilities. It stands for innovation, adaptation, and forward-looking development.

Organizational ambidexterity is thus not an „either-or“ but a „both-and“. It requires companies to be simultaneously stable and dynamic – a tension that is particularly crucial for the introduction and implementation of Business Continuity Management (BCM).

The connection to Business Continuity Management

BCM aims to maintain critical business processes even under adverse circumstances. Traditionally, it is associated with safeguarding, stability, and risk minimization, thus aligning with the area of exploitation. However, in today’s world, stability alone is no longer sufficient. BCM must also enable companies to manage change and innovation without compromising resilience.

This is where the interface with organizational ambidexterity becomes apparent:

• BCM and Exploitation: BCM ensures that processes, systems, and structures remain efficiently secured and resilient.
• BCM and Exploration: BCM creates the organizational robustness that allows for experimentation, market testing, and implementing innovations – all while being aware that uncertainty and „black swans“ can occur at any time.

Thus, BCM is not only a „shield“ but also an enabler: It supports the balance between stability and change.

Practical challenges

Implementing organizational ambidexterity in the context of BCM presents several challenges:

• Resource conflicts: While exploitation demands clear structures, exploration requires freedom and investment. BCM must coordinate both sides.
• Cultural differences: Security and compliance on one side, innovation and experimentation on the other – both must be embedded in a corporate culture.
• Speed of adaptation: Markets, technologies, and crisis scenarios develop faster than traditional BCM processes can often respond. BCM must therefore be conceived more agilely.

Organizational ambidexterity highlights the dual role of modern companies: They must reliably secure their core business while having the courage to venture into new areas. For effective Business Continuity Management, this means not only creating structures for stability but also conditions for innovation and adaptation.

BCM thus becomes a strategic tool that enables companies to balance exploitation and exploration – laying the foundation for sustainable resilience in uncertain times.

Differentiation between Business Impact Analysis, Risk Assessment and Information Classification

Effective Business Continuity Management (BCM) requires a clear distinction between Business Impact Analysis (BIA), Risk Assessment (RIA), and Information Classification. Although all three processes are interconnected, they pursue different objectives and perspectives.

The Business Impact Analysis (BIA) aims to identify the criticality of business processes. It answers the question of which processes are essential for maintaining business operations and within what timeframes a disruption is tolerable. Parameters such as MTPD (Maximum Tolerable Period of Disruption) and RTO (Recovery Time Objective) are defined.

The Risk Assessment (RIA) follows this and focuses on the time-critical resources required for the previously identified processes. It evaluates the relevant risks – such as technical failures, staff shortages, or external threats – and lays the foundation for measures to secure these resources.

The Business Impact Analysis views the organisation from a purely business perspective.

It deliberately starts where a disruption has already occurred – regardless of why it happened.

The focus includes the following questions:

• Which processes are time-critical?
• How long can these processes be disrupted at most?
• What dependencies exist between processes, resources, and organisational units?
• What impact would a disruption have on the entire organisation or individual areas?

The Business Impact Analysis thus answers the question:

“What happens to the business if a damaging event occurs?”

It provides transparency about criticalities, time dependencies, and affected resources – without making a statement about how likely such an event is.

The Risk Assessment takes a different approach.

It is cause- and scenario-based and deals with the question of which events can occur and why.

Typical questions include:

• What threats and dangers exist?
• How likely is the occurrence of certain events?
• What weaknesses and vulnerabilities are present?
• What risks arise from this for the organisation?

The Risk Assessment thus answers the question:

“Why could a damaging event occur – and how realistic is it?”

Both perspectives meet at the common core of the occurrence of a damaging event.

This is precisely where Business Impact Analysis and Risk Assessment interlock:

• The Risk Assessment explains why an event can occur.
• The Business Impact Analysis describes what this event means for the business.

Only this combination allows for a complete evaluation.

Neither the Business Impact Analysis nor the Risk Assessment is sufficient on its own.

• Without Business Impact Analysis, the Risk Assessment lacks the context of business significance.
• Without Risk Assessment, the Business Impact Analysis lacks the connection to realistic threat scenarios.

Only through the interplay of both analyses is the foundation created for:

• a risk-informed business continuity strategy,
• proportionate safeguarding of resources,
• and an economically sensible prioritisation of measures.

The visualisation makes this connection visible:

two different perspectives that together form the analytical basis of Business Continuity Management.

Business Impact Analysis and Risk Analysis are therefore not alternatives, but complementary tools. Together, they form the foundation for robust decisions, targeted continuity strategies, and a resilient organisation.

Information classification, on the other hand, considers the information objects within the resources. Here, the CIA classification is at the forefront – that is, the assessment of Confidentiality, Integrity, and Availability. This analysis determines how worthy of protection the respective information is and what protective measures should follow.

Only through the combination of these three perspectives – process criticality (BIA), resource risks (RIA), and information protection (CIA) – is a holistic understanding of organisational resilience achieved.

At this point, the interfaces to other management systems already become apparent, such as information security (ISMS according to ISO/IEC 27001^[2]), risk management (ISO 31000^[3]), or compliance and quality management.

Therefore, the BIA should not be conducted in isolation from other management areas. Instead, it is important to utilise existing structures, analyses, and data sets to create synergies and avoid duplication of work.

This way, BCM becomes an integrated part of the overall corporate management – and not an isolated parallel process.

For a deeper insight into the dependencies of different management systems, feel free to check out our NOVELEDGE blog on resilience as a complete system

Roles, Responsibilities and Structured Collaboration in Business Continuity Management

Business Continuity Management (BCM) is much more than creating plans or documents. It is a continuous management process aimed at keeping organisations operational during disruptions, crises, or failures.

For BCM to function effectively, one thing is essential: clear roles, defined responsibilities, and structured collaboration.

This article highlights why BCM only works as a collective task and which roles play a central role in it.

BCM as a Collective Management Task

BCM cannot be carried by a single function or person.

It thrives on the integration of different perspectives: strategic, operational, technical, and organisational.

Only when responsibilities are clearly distributed can:

• critical processes identified,
• dependencies understood,
• risks realistically assessed
• and appropriate continuity strategies developed.

BCM is therefore not an isolated project, but an integrated management system that must be continuously maintained, reviewed, and developed further.

Key Roles in Business Continuity Management

Why clear responsibilities are crucial

In practice, BCM rarely fails due to a lack of concepts, but often due to unclear responsibilities.

A clear distribution of roles ensures that:

• decisions are made transparently,
• measures remain proportionate,
• resources are used purposefully,
• and BCM is sustainable.

Tools like a RACI Matrix help to transparently display responsibilities and avoid dual roles or gaps.

BCM only works when structured

Business Continuity Management is not an end in itself.

It only unfolds its benefits when:

• roles are clearly defined,
• responsibilities are embraced,
• and collaboration is structured.

BCM is therefore less a matter of documents –

but a matter of organisation, governance, and lived responsibility.

Especially in complex organisations, this structured division is the key to effectively implementing and maintaining the BCM lifecycle over the long term.

The strategic and operational aspects of Business Continuity Management

Why effective BCM only works when strategy and operational implementation are considered together.

Business Continuity Management (BCM) is often reduced in practice to emergency plans, exercises, or technical recovery measures. However, this perspective is too narrow. BCM is not merely an operational tool, but a holistic management approach that encompasses both strategic and operational aspects.

Only the interaction of both levels enables organisations to maintain their performance even in crisis and disruption situations, meet regulatory requirements, and build long-term trust with customers, partners, and other stakeholders.

Business Continuity Management (BCM) is often reduced in practice to emergency plans, exercises, or technical recovery measures. However, this perspective is too narrow. BCM is not merely an operational tool but a holistic management approach that encompasses both strategic and operational aspects.

Only the interaction of both levels enables organisations to maintain their performance even in crisis and disruption situations, meet regulatory requirements, and build long-term trust with customers, partners, and other stakeholders.

Business Continuity Management as a Strategic Task

At the strategic level, BCM is part of the overarching organisational and corporate strategy. It does not answer the question of how an organisation reacts in the event of a disruption, but why certain capabilities need to be protected and secured.

Strategic BCM creates the framework within which operational measures can be sensibly prioritised and implemented.

Typical strategic aspects of BCM include:

• Reputation and TrustEnsuring performance even in crises strengthens the trust of customers, business partners, and the public.
• Market Value and CompetitivenessCompanies with robust continuity structures are considered reliable and resilient market participants.
• Stability and Business ContinuityStrategic BCM contributes to the long-term security of the organisation and reduces existential risks.
• Compliance and GovernanceFulfilment of regulatory requirements (e.g. ISO 22301, ISO/IEC 27001, KRITIS, NIS2^{[1] [2] [4] [5]}) as well as clear responsibilities at the management level.

Strategic BCM is a leadership task. It requires decisions on:

• Protection priorities,
• acceptable downtimes,
• investments in resilience,
• as well as the organisational anchoring of BCM.

Operational Business Continuity Management

Operational BCM translates the strategic framework into concrete, actionable measures. It ensures that organisations remain capable of acting in the event of an incident and that defined goals are actually achieved.

Operational BCM particularly includes:

• Business Impact Analysis: Identification of critical processes, dependencies, and maximum tolerable downtimes.
• BCM and Emergency Plans: Concrete instructions for disruption and crisis situations.
• Processes and Roles: Clear responsibilities, escalation paths, and communication structures.
• Tests and Exercises: Verification of the effectiveness of plans and training of involved personnel.
• Capability to Act in the Event of an Incident: Ability to make structured decisions and implement measures under time pressure.

Interaction of Strategic and Operational BCM

Strategic and operational BCM are not separate disciplines but two perspectives on the same goal: ensuring organisational resilience.

• The strategy defines what should be protected and why.
• The operational level ensures how these goals are achieved.

Insights from operational BCM (e.g., from exercises or real events) are fed back into strategic development. BCM is thus a continuous management process and not a one-time project.

Effective Business Continuity Management only arises when strategic objectives and operational implementation are consistently linked. Organisations that view BCM solely as an operational obligation miss significant potential in terms of stability, compliance, and trust.

BCM only fully unfolds its impact when it is understood as a strategic management tool and implemented professionally at the operational level.

If you need support in implementing or further developing your BCM lifecycle, you can rely on the expertise of our network. Together, we develop tailored solutions – from analysis to exercise – ensuring your organisation is optimally prepared.

With our approach “BIA as a Service”, external experts from the network can conduct the Business Impact Analysis for you and prepare the results in a structured manner. These directly feed into your Business Continuity Strategy, enabling you to achieve high-quality and practical results with minimal internal effort.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are summarised.

1. DIN EN ISO 22301:2020-06 – Sicherheit und Resilienz – Business Continuity Management System – Anforderungen (ISO 22301:2019). Deutsche Fassung EN ISO 22301:2019. Herausgeber: DIN Deutsches Institut für Normung e. V., Berlin. Kostenpflichtig über den Normenhandel. ↑
2. ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection – Information security management systems – Requirements. Herausgeber: International Organization for Standardization und International Electrotechnical Commission, Genf. Kostenpflichtig über den Normenhandel. ↑
3. ISO 31000:2018 – Risk management – Guidelines. Herausgeber: International Organization for Standardization, Genf. Kostenpflichtig über den Normenhandel. ↑
4. Dachgesetz zur Stärkung der physischen Resilienz kritischer Anlagen (KRITISDachG). Freely available at gesetze-im-internet.de. ↑
5. Richtlinie (EU) 2022/2555 zur Gewährleistung eines hohen gemeinsamen Cybersicherheitsniveaus in der Union (NIS-2-Richtlinie). Freely available at EUR-Lex. ↑