Programme overview
Technical depth: Practitioner · Practical mode: Case study
Introduction
Power failures, cyber attacks, supplier collapse, extreme weather and pandemics have shown that many organisations hold continuity plans that nobody has tested and that do not reflect what the business must recover first. This Core Concept course equips managers to build a business continuity management system aligned to ISO 22301 and to strengthen the wider organisational resilience it supports. Participants work from context and impact analysis through strategies, plans and exercising, apply each step to cases from several sectors and leave with a Business Continuity Programme Plan for their own organisation.
Course Objectives
- Assess an organisation's continuity capability and resilience attributes against ISO 22301 and ISO 22316
- Establish the scope, policy, roles and governance of a business continuity management system
- Conduct a business impact analysis and risk assessment and set recovery objectives for prioritised activities
- Select continuity strategies and structure plans that can be executed during a disruption
- Plan exercises, performance evaluation and management review that keep the programme current
- Produce a Business Continuity Programme Plan ready for approval by top management
Target Audience
- Business continuity and resilience managers building or maintaining a continuity programme
- Risk managers integrating continuity into enterprise risk management
- Operations and facilities managers responsible for critical sites and services
- IT service and information security managers linking technology recovery to business needs
- Quality and management system managers adding ISO 22301 to an integrated system
- Department heads acting as business continuity coordinators for their units
Course Outline
Day 1: Continuity and Resilience Foundations
- ISO 22300 Vocabulary: Disruption, Incident, Crisis and Resilience
- Continuity Drivers: Threat Landscape, Stakeholder and Climate Expectations
- BCI Good Practice Guidelines Professional Practices Overview
- Organisational Resilience Principles and Attributes Under ISO 22316
- Continuity Capability Gap Assessment Checklist
Day 2: The Business Continuity Management System
- ISO 22301 Clause Structure and the Plan-Do-Check-Act Cycle
- BCMS Context, Scope and Interested Party Analysis
- Business Continuity Policy, Objectives and Leadership Roles
- ISO 22313 Guidance on Programme Resourcing and Competence
- Integration with ISO 31000 Risk Management and ISO/IEC 27001
Day 3: Analysis, Strategies and Plans
- Business Impact Analysis Using ISO/TS 22317: MTPD, RTO and RPO
- Disruption Risk Assessment and Single Point of Failure Analysis
- Continuity Strategy Options for People, Premises, Technology, Information and Suppliers
- Supplier Continuity Assessment Under ISO/TS 22318
- Business Continuity Plan Structure Following ISO/TS 22332
Day 4: Exercising, Evaluation and Resilience Improvement
- Exercise Programme Design Using ISO 22398
- Incident Response Structure and Escalation to Crisis Management Under ISO 22361
- BCMS Performance Metrics and Internal Audit Checklist
- Management Review Inputs and Corrective Action Tracking
- Resilience Maturity Model and Improvement Roadmap
Day 5: Case Work and the Business Continuity Programme Plan
- Utility Outage Case Study: Testing Strategy Adequacy
- Healthcare Supplier Failure Case Study: Dependency and Recovery Gaps
- BIA Summary and Strategy Selection for an Own Organisation
- Business Continuity Programme Plan Drafting
- Peer Challenge Panel and Programme Plan Defence
Skills You Will Gain
- Business Impact Analysis
- Recovery Objective Setting
- Continuity Strategy Selection
- Business Continuity Planning
- BCMS Governance
- Exercise Programme Planning
- Resilience Assessment
- Management System Auditing
Why Attend This Course
- Leave with a Business Continuity Programme Plan for a real organisation, already tested before a peer panel
- Explain continuity priorities to top management in terms of impact, time and cost
- Recognise the gaps in existing plans that normally surface only when a disruption occurs
- Compare approaches with managers from finance, healthcare, utilities, government and manufacturing
Conclusion
Continuity is proved on the day of a disruption, not on the day the plan is approved. This course moves from resilience principles and the ISO 22301 management system, through impact analysis, risk assessment, strategies and plans, to exercising, audit, management review and resilience improvement. The final day applies the full cycle to case material and turns it into a Business Continuity Programme Plan, giving participants a defensible basis for building, testing and improving continuity capability in their own organisation.