Fragmented Plan and Regulatory Approval Gap
Lakeshore Financial Group has completed a BIA and selected a recovery strategy: a hybrid cloud site for its lending platform and a manual workaround for wire transfers. The business continuity plan is a 240-page document assembled from department templates. It names the CIO as incident commander but gives no alternates, and the crisis communications section lists a vendor that went out of business last year. The plan has no activation criteria, no devolution provisions, and no process for incorporating third-party recovery commitments. A new regulation requires the board to approve the plan annually and evidence that key suppliers can meet stated recovery objectives. The plan was last approved 26 months ago. Department heads say they keep their own copies and update them when they remember. The next board meeting is in six weeks. The new head of resilience asks for a remediation plan.
1. Identify the most significant plan development and implementation deficiencies and prioritize them for the six-week board cycle.
Read the worked answer
Prioritize deficiencies by regulatory exposure and operational consequence. The most serious are the absence of activation criteria and alternates for the CIO, because the plan may not be invoked correctly or may stall at the top. Next is the dead communications vendor and missing supplier recovery evidence, which directly violate the new regulation. Third is the lack of devolution provisions, which leaves no authority if leadership is unavailable. Fourth is version control and the 26-month approval gap, which undermine board assurance.
Do not begin by rewriting all 240 pages. Build a core plan of 25 to 35 pages covering scope, activation, roles, communications, devolution, and recovery priorities, with department and vendor annexes controlled separately. Assign an owner and alternate for each section, validate contact and vendor data, and obtain supplier attestations against stated RTOs.
For the six-week board cycle, deliver the core plan, a gap register, supplier evidence status, and a remediation roadmap. Request board approval of the core plan and conditional approval of annexes with dated milestones. This addresses the regulatory requirement while avoiding a document-quality exercise that misses the control failures.
2. Design a plan maintenance and control process that prevents recurrence, including ownership, review triggers, and evidence for the board.
Read the worked answer
Establish a controlled maintenance system with a single authoritative plan in a document management platform. Name a plan owner and section owners with named alternates. Require review at least annually and on triggers: merger, new system, vendor change, reorganization, exercise finding, audit finding, or regulatory change. Use a change-control log that records what changed, why, who approved, and what training or communication followed.
Maintain a supplier register that maps each critical vendor to the process it supports, the required RTO, the contractual commitment, and the latest evidence. Build a training and awareness calendar with completion tracking for managers and incident roles. Report quarterly to the audit committee: plan currency by section, open corrective actions, supplier evidence coverage, training completion, and exercise results.
For board evidence, provide a signed attestation that the plan was reviewed, that critical suppliers were validated, and that gaps have owners and dates. The EHR migration should be a trigger for review, not a reason to suspend maintenance.