BCP · Business Continuity Plan

When operations stop, the leadership question is not whether the organisation has a plan but whether anyone can act on it in the next hour. A Business Continuity Plan (BCP) exists to convert strategy into instructions that work under stress: who acts, in what order, with what resources, toward which recovery targets. For the executive it answers the first-hours question directly — what the organisation does while the cause is still being fixed. Without it, every disruption becomes a bespoke project run from memory.

In practice the BCP is owned by a named manager, approved by executive management, and built on the results of the business impact analysis (BIA). It fixes activation criteria, workarounds and recovery sequences: if the warehouse burns, orders ship from the backup site within 24 hours; if the ERP is down, critical shipments move on paper forms for up to 48 hours. Copies are held outside the primary building and in the crisis team's shared vault, and the plan is reviewed at least annually and after every exercise or real event. In the UAE, NCEMA 7000 makes a maintained BCP an explicit expectation for organisations in vital sectors.

The classic failure is the plan on the shelf: written by a consultant to pass an audit — 100 pages, never rehearsed, unusable at 03:00. Its close relative is the plan that lists systems but not people, so authority and sequence dissolve exactly when they are needed. In the ERGP programme, plans and the decisions they must enable are covered in module M4, Crisis management and decision making.