The evacuation plan that management calls business continuity
Harborline Insurance employs 310 people across a head office and two branch offices. When the board asks about business continuity, the operations director points to three things: quarterly fire evacuation drills, a nightly tape backup of the claims system that is collected weekly by a vendor, and a 24/7 telephone hotline that staff can call to report an incident. He describes this as 'our BCM'. Last March a burst water main closed the head office for three working days. Staff were told to work from home, but the claims application requires hardware tokens that were left in the building, and call-centre agents could not reach the customer relationship management system because remote access had never been provisioned for their roles. New claims intake fell by 80%, and the hotline logged 40 calls about parking and none about claims. The board wants to know why the 'business continuity arrangements' did not work.
1. Using ISO 22301 and ISO 22300 concepts, explain why the three arrangements described do not constitute a business continuity management system. Anchor your answer in the specific facts of the event.
Read the worked answer
The three arrangements address different things, and none of them is business continuity as ISO 22300 defines it: the capability to continue delivery of products and services at acceptable predefined levels following a disruption. Evacuation drills are emergency response - they protect people and premises and stop once the building is safe. The tape backup is disaster recovery for one system: it protects data but says nothing about whether claims can be processed, by whom, at what capacity, or how quickly. The hotline is an incident communication channel, and the 40 parking calls show it was never designed around the activities that matter.
A BCMS under ISO 22301 is a management system, not a collection of arrangements. It requires context and scope, leadership, a BIA and risk assessment (clause 8.2), strategies and solutions (8.3), plans and procedures (8.4), an exercise programme (8.5), and evaluation and improvement (clauses 9 and 10). The 80% drop in claims intake is the diagnostic: no prioritized activity, no MTPD, no MBCO and no RTO existed, so nobody could say whether three days was tolerable or catastrophic. The arrangements were reactive and asset-focused; what was missing was a proactive, activity-focused capability.
2. What would a business impact analysis have revealed that the evacuation drills could not, and how would its outputs have changed the response on the day?
Read the worked answer
A BIA would have started from the activities that deliver products and services - new claims intake, customer service, claims assessment, payments - rather than from the building. For each activity it assesses impact over time: at what point does a day of lost intake breach contract terms, regulator expectations or cash flow? That produces the MTPD, and from it a prioritized RTO and a minimum acceptable capacity, for example 'claims intake at 50% within eight hours'.
The BIA also identifies dependencies and resources behind those activities: identity tokens, remote-access provisioning, CRM licences for call-centre roles, staff devices, mail handling, and the single-building concentration. The risk assessment would then have evaluated the likelihood and impact of losing access to the building. On the day, these outputs would have changed the response in three concrete ways: activation criteria and an incident team with authority to invoke remote working; a pre-tested task list for issuing tokens or using a soft-token fallback; and a communication plan aimed at customers and brokers rather than at parking queries. Drills could not reveal any of this because they test evacuation, not continuity of prioritized activities.
3. The operations director argues that a full BCMS is unnecessary because the company 'has never had a disaster'. How should that argument be assessed?
Read the worked answer
It confuses absence of evidence with evidence of absence, and it treats business continuity as a reactive service rather than a capability. ISO 22301 assumes disruption will occur and requires the organization to prepare in advance: identify prioritized activities and their timeframes, select strategies that meet them, and exercise and improve. A record of no disasters says nothing about exposure; the water-main event was a disruption with an 80% drop in intake, and the only reason it did not become a crisis was improvised home working.
The argument also inverts the purpose of the standard. A BCMS is not justified only by events already suffered; it is justified by the impact of events that could occur, which is exactly what the BIA and risk assessment exist to establish. The organization should measure the effectiveness of its capability through exercises and tests, not through luck. A proportionate response is possible for a 310-person insurer, but proportion does not mean omitting the BIA, the strategies and the exercise programme. It means scaling their depth to the organization's size and risk profile.