Business Continuity Policy and Programme Management
Policy as intent, programme as system
A business continuity policy is a short, senior-level statement of intent. It establishes scope, objectives, authority, accountability and commitment. The policy is owned and approved by the board or executive, not by the BC manager, who drafts and maintains it. The programme is the ongoing governance system that turns policy into capability: roles, budget, planning cycle, performance measures, audit, management review and continual improvement. The lifecycle normally runs through analysis, design, implementation, validation and embedding, then repeats.
Scope and governance
Define scope across products, services, locations, people, technology, data, suppliers and third parties. Record assumptions and exclusions. Establish a sponsor, steering group, business unit owners, recovery teams and coordinator. Align with risk, security, health and safety, supply chain and regulatory obligations. Treat continuity as a programme, not a one-off project.
Traps
Questions often confuse policy with plan: policy answers why, what and who is accountable; the plan answers how, when and with what resources. Another trap is assuming the BC manager owns the policy. A third is a scope that omits suppliers or dependencies. Do not accept “the programme is complete” language; maturity is continual.
Worked example
A policy states: “The organisation will maintain continuity of critical services to a minimum acceptable level, with recovery times set by business impact analysis, reviewed annually and approved by the board.” The corresponding plan contains activation authority, procedures and resource details.
Rule of thumb: policy = intent, scope, objectives, accountability and review; plan = procedures, resources, contacts and activation.