Business Continuity Management Program Foundation
What the foundation layer must contain
A continuity program is a governance system, not a document set. Candidates must know the elements that make it function: a sponsor with authority, a documented policy, defined scope (products, sites, processes, legal entities), assigned roles, a lifecycle method (analyse, design, implement, validate, embed), and a budget line. Know the difference between the program (the permanent capability) and a plan (a time-bound product of the program). Understand the professional lifecycle vocabulary - impact analysis, strategy selection, plan build, exercise, review - and where each output feeds the next.
Traps that recur in questions
- Confusing the program sponsor (accountable executive) with the plan owner (accountable for a specific plan).
- Treating business continuity as a synonym for disaster recovery; recovery of technology is one strategy, not the whole discipline.
- Assuming a policy is a plan. A policy states intent and authority; it contains no procedures.
- Forgetting that scope decisions are business decisions recorded in the policy, not technical defaults.
- Selecting a methodology by tooling rather than by the standard the organisation has adopted.
Rule of thumb
Apply the "who decides, who delivers, who validates" test to every element. If a component has no named decision-maker, no named deliverer, and no named validator, it is not yet part of the program.
Worked example
A retailer writes a 40-page plan but has no policy and no sponsor. A question asks what is missing first. The answer is governance: without a policy and an accountable executive, the plan has no authority, no funding, and no obligation to be tested. Fix the foundation before rewriting the plan.