Business continuity, resilience and crisis management
Business continuity, resilience and crisis management tests whether the firm can keep delivering through disruption. The exam distinguishes BCP from operational resilience, and requires correct use of RTO, RPO and MTPD.
BCM lifecycle (ISO 22301)
Business impact analysis → recovery strategies → plans → exercising → maintenance. The BIA identifies critical activities and their dependencies (people, premises, technology, third parties), then sets recovery objectives:
- MTPD (maximum tolerable period of disruption): the point beyond which impact becomes intolerable.
- RTO (recovery time objective): the target time to restore the service; must be shorter than the MTPD.
- RPO (recovery point objective): the acceptable amount of data loss, measured in time.
Operational resilience
Resilience goes further than continuity: it asks whether the firm can prevent, adapt to, respond to and recover from disruption while remaining within impact tolerances for its important business services. UK firms (PRA SS1/21, FCA PS21/3) had to be able to remain within impact tolerances by 31 March 2025, having mapped services, set tolerances and tested severe but plausible scenarios. The EU equivalent sits alongside DORA's ICT resilience requirements.
Crisis management
A crisis team with clear roles (strategic/tactical/operational, or gold/silver/bronze), pre-agreed escalation triggers, communication plans for customers, regulators and media, decision logs, and regular simulation exercises.
Worked example
A payments service has an MTPD of 8 hours and an RTO of 4 hours. Testing shows the primary host recovers in 3 hours, but a single third-party authentication provider takes 24 hours. Reasoning: the service breaches its MTPD through the third-party dependency. Remediation options are a secondary provider, an in-house fallback, or contractual service credits plus tested workarounds. A continuity plan alone is inadequate; the dependency must be mapped and the tolerance re-tested.
Traps that cost marks
- Setting an RTO longer than the MTPD.
- Confusing RPO (data loss) with RTO (time to restore).
- Treating a written plan as evidence of resilience without testing it.
- Ignoring third-party and fourth-party dependencies when mapping services.