Business continuity consulting

Most organisations have some form of business continuity plan. Fewer have one that would actually work under the pressure of a real outage.

We help Australian organisations build BCP’s that are grounded in reality; based on what your business actually does, what would genuinely cause harm if it stopped and what your staff can realistically do during a disruption.

A typical engagement will include the following:

We supply a template to enable you to quickly develop a Policy that documents the scope, governance and operation of the Program. This Policy should be developed to reflect the current and future resilience requirements of your organisation. During this initial phase, we also develop a Statement of Work that details the activities to be undertaken by us and your staff, deliverables, work schedule and project plan.

Business Impact Analysis (BIA)
This is the foundation of any effective BCP. We work with your leadership team to identify your Prioritised Activities (the activities in your organisation that are most time-critical) and the resources they depend on. They are ranked by their Maximum Allowable Outage time (how long your organisation can manage without them before suffering unacceptable harm) and identify the resources they depend on. This is where most BCP’s fail: plans that try to recover everything at once recover nothing effectively.

Review of Business Continuity Risks
In the context of the findings of the BIA, we identify the threats most likely to affect your organisation (cyber incidents, utility outages, supply chain failures, extreme weather, loss of key staff etc), assess their likelihood and potential impact and recommend possible mitigation strategies.

It is very common that we find that organisations have little knowledge regarding the recoverability of critical IT applications and data they use. This is particularly true for cloud based applications. Most Software as a Service vendors will not warrant a Recovery Time Objective for applications, unless a highly resilient service has been purchased. It is imperative that the agreement with your Third Party vendors reflects your tolerance for disruption you have established in the BIA.

Business Continuity Plan and documentation development
We develop the full suite of BCP documentation: the over-arching plan, Recovery Procedures for each of your Prioritised Activities, contact directories and supporting materials. Plans are written to be used under pressure, not stored in a drawer. Importantly, the Recovery Procedures will be developed based on the recoverability of your supporting resources in their current state.

IT Disaster Recovery review
IT recovery is often the weakest link. We assess whether your critical systems can actually be recovered within the timeframes your business requires and work with your IT team to close the gaps when they can't.

We have also found it is common for the IT Department to lack current IT Disaster Recovery Plans or they exist and have not been tested in the previous 12 months. The logical time to update your IT DR Plan is after the completion of a BIA, because you will then know the recoverability targets for your critical IT systems.

Implementation, training and exercising
Plans are only as good as the people who need to use them. We help embed the BCP through staff training and facilitated exercises that exercise the plan before a real disruption occurs.

 APRA-regulated entities

If your organisation is regulated by APRA (including ADIs, general insurers, superannuation funds, and life insurers) CPS 230 (Operational Risk Management) sets specific requirements for business continuity, critical operations and third-party risk management.

We have considerable experience helping regulated entities meet these obligations, from initial gap assessment through to full CPS 230 compliance.

What our customers say

“Our five year old business continuity plan was in need of a refresh … the guys at Continuity Matters sorted us out with a set of plans with recovery procedures for when things go wrong. We’re ready to face any challenge! Thank you Continuity Matters.”

Manufacturing company

“The Business Continuity risk assessment report was an eye opener for us. We had no idea that our suppliers posed such risks to our business. Thanks to the team at Continuity Matters we are in a position now to address those risks.”

Medical manufacturing organisation