Plan Maintenance and Program Improvement
Keeping capability alive
Continuity capability decays without maintenance. Candidates should know the triggers for plan review: scheduled review cycles, organizational change (mergers, reorganizations, new leadership), process or technology change, facility change, supplier change, exercise findings, actual incidents, and regulatory change. Reviews should be documented with version history and approval.
Know the program performance metrics: plan coverage, review currency, exercise completion, corrective-action closure rate, training completion, and dependency validation. Maturity models describe progression from ad hoc to managed to optimized, and are useful for communicating improvement rather than for scoring.
Corrective action programs track findings from exercises, audits, incidents, and BIAs to closure, with priority based on risk. Governance oversight reviews metrics and trends, not just individual plans. Audit provides independent assurance, and candidates should distinguish self-assessment from independent audit.
Traps
- Reviewing plans annually only, missing change-triggered updates.
- Closing corrective actions administratively without verifying effectiveness.
- Treating metrics as ends in themselves rather than indicators of capability.
- Confusing a plan review with an exercise; reviewing a document does not validate it.
- Ignoring supplier and dependency changes that invalidate recovery assumptions.
Rule of thumb
If something that the plan depends on has changed, the plan is due for review now, regardless of the calendar.
Worked example
A company migrates its ERP to a new cloud provider. The continuity manager triggers an out-of-cycle review, updates the IT recovery plan and the affected business plans, validates the new provider's RTO commitments, and schedules a functional exercise to confirm failover before closing the change record.