ABC CP cheat sheet

Business continuity management (BCM) is a holistic management process that identifies potential threats and their impacts and builds organizational resilience to protect stakeholders, reputation, brand, and value-creating activities.

The BCM lifecycle is iterative: analysis (business impact analysis, risk assessment), solution design, implementation, testing/exercising, and embedding into culture; each stage feeds back into the next.

Business impact analysis (BIA) identifies time-critical activities and quantifies impact over time; it produces recovery time objective (RTO), recovery point objective (RPO), and minimum business continuity objective (MBCO).

RTO is the target time to restore an activity; RPO is the acceptable data loss measured in time before the disruption; maximum tolerable period of disruption (MTPD) is the point beyond which impacts become unacceptable - RTO must be shorter than MTPD.

Risk assessment under BCM evaluates likelihood and impact of disruptive events against prioritized activities; outputs feed solution selection rather than replacing the BIA.

Continuity strategies include resource redundancy, alternate sites (hot, warm, cold), manual workarounds, outsourcing, and relocation; selection balances cost against the required RTO and MTPD.

Exercise types escalate in rigor: plan review/walkthrough, tabletop, simulation, and full failover/live exercise; each should have defined objectives, scenarios, and post-exercise corrective actions.

BCM standards and good practice require documented policy, defined roles (e.g., continuity coordinator, crisis management team), and management review, with performance measured through audits, exercises, and metrics.

Embedding requires training, awareness, communication, and integration with related disciplines such as risk management, emergency response, IT disaster recovery, and supply chain management.

Certification bodies typically require a combination of verified work experience in BCM-related roles, completion of approved training, and passing a qualifying examination.

Experience is usually validated through employer attestation or supervisor references that specify role, duration, and continuity-related responsibilities rather than general job titles.

Continuing professional development (CPD) obligations maintain certification; a common model is a fixed number of CPD hours per year with a portion tied to BCM-specific content.

The certifying body's code of ethics governs professional conduct: integrity, competence, confidentiality, objectivity, and avoidance of conflicts of interest.

Documentation of experience should map activities to the BCM lifecycle (BIA, strategy, plan development, exercising, program governance) to demonstrate breadth.

Relevant experience often includes roles such as business continuity manager, resilience analyst, risk manager, emergency planner, or disaster recovery coordinator.

Recertification typically requires evidence of ongoing practice plus CPD; lapsed CPD or practice can result in suspension or required remediation.

Applicants must be able to demonstrate accountability for continuity outcomes, not merely participation, when describing professional experience.

Recovery sequence prioritization follows the BIA: activities with the shortest MTPD and highest impact are recovered first, and dependencies (internal and external) are mapped before strategy selection.

A continuity plan contains purpose and scope, activation criteria and authority, roles and contact lists, procedures for prioritized activities, resource requirements, and interfaces with external parties.

Activation criteria should be objective, pre-agreed thresholds (e.g., site unavailable beyond X hours, key supplier failure) rather than subjective judgment at the time of crisis.

Crisis management and business continuity differ: crisis management addresses strategic, reputational, and stakeholder communication, while business continuity restores operational activities.

Single points of failure are identified through dependency mapping across people, premises, technology, suppliers, and information; each should have a mitigation or accepted risk decision.

Exercise findings must be tracked to closure through a corrective action plan with owners and due dates; untested plans are treated as unproven.

Metrics for BCM program maturity include plan coverage of critical activities, exercise frequency and results, time to recover in tests versus RTO, and closure rate of corrective actions.

Supply chain continuity requires assessing critical suppliers' own continuity capabilities and contractual continuity requirements, not just internal readiness.

Ethical practice requires disclosing conflicts of interest, protecting confidential organizational data during BIA and exercises, and reporting findings accurately even when unfavorable.

Professional competence means practicing only within one's expertise and escalating to specialists (e.g., IT DR, legal, HR) where the continuity scope exceeds personal knowledge.

Experience claims should be specific and verifiable: state the activity performed, the scale of the program, the duration, and the outcome or deliverable produced.

Common disqualifiers in experience review include misrepresentation of roles, insufficient duration, purely theoretical training without applied practice, and lack of supervisory verification.

CPD logs should record activity title, provider, date, hours, and relevance to BCM; audits may require supporting evidence such as certificates or attendance records.

Maintaining certification includes adhering to the body's complaints and disciplinary process; substantiated breaches can lead to sanctions up to revocation.

Mentoring and knowledge transfer are recognized professional contributions and may count toward CPD or leadership evidence depending on the certifying body's rules.

Applicants should align their experience narrative with the certification's defined competency framework so reviewers can map evidence to required competencies.

Program governance assigns clear accountability: a sponsor with authority, a continuity coordinator managing the program, and business owners accountable for their activity plans.

Awareness and training differ: awareness builds general understanding across staff, while training develops specific skills for plan holders, responders, and the crisis team.

Plan maintenance triggers include organizational change, new systems or suppliers, exercise findings, audit recommendations, and significant incidents; plans should be reviewed at defined intervals.

Maturity models (e.g., staged from ad hoc to optimized) help benchmark program capability and prioritize improvement investments.

Audit and assurance provide independent verification that the BCM program meets policy, standards, and regulatory obligations; findings feed management review.

Communication plans must cover internal escalation, employee notification, customer and regulator communication, and media handling, with pre-approved templates and spokespeople.

Lessons learned processes convert incident and exercise experience into program improvements, closing the loop between response and planning.

Certification eligibility commonly requires a minimum number of years of BCM-related experience, sometimes with a portion at a management or program-ownership level.

Training requirements are typically satisfied by completing an approved course from a recognized provider, evidenced by a certificate of completion.

The qualifying examination tests both knowledge domains and applied judgment; passing is usually a scaled score against a set cut score rather than a fixed percentage.

Experience verification may include random audit; false or inflated claims can result in denial, suspension, or permanent ineligibility.

Renewal cycles are commonly multi-year, requiring accumulated CPD hours, a renewal fee, and attestation of continued practice and ethical compliance.

Professional references should be able to confirm specific continuity responsibilities, duration of work, and the applicant's role in BCM activities.

Applicants should retain records of training, CPD, and experience documentation for the full certification cycle to support audits and renewal.

Scope of practice statements define what a certified professional may claim competence in; exceeding that scope without disclosure is an ethical violation.