Frequently Asked
Questions
-
A Business Impact Analysis (BIA) is the process of analysing the impact over time of a disruption on the organisation. It identifies your time-critical business activities, maps operational interdependencies and establishes how long your organisation can manage without them, before suffering unacceptable harm. Importantly, it documents the resources (people, offices/factories, IT systems and Third Party providers. They are the ones that will be recovered first after a disruption in order to mitigate their impact. That’s why they are called “Prioritised Activities”.
The outcome is a statement and justification of business continuity requirements.
Not sure where to start? Let our consultants facilitate your impact analysis workshop to ensure no critical blind spots are missed.
-
Bad things happen. The problem is that we don't know who will suffer them, how bad they will be and when they will occur. Developing a Business Continuity Plan (BCP) is just like taking out insurance. Having insurance does not mean bad things won't happen, it will just mean your costs will be paid by your insurance company and makes it more likely that the impact of the disaster will be less. With a well-developed BCP, your organisation will suffer less from the disaster and recover more quickly (and the experience will be less stressful!).
Your organisation has spent great effort and money in getting to where it is - it would be a shame to lose it all if a disaster strikes. Your organisation needs a Plan B. You should find a way by which your organisation can continue to do business - even if it is the victim of a really bad event.Description text goes here
-
Having a well written document will be of no value if there is no underlying infrastructure that facilitates a smooth recovery from a disaster. As part of the BCP development, you will have established what resources (people, offices, IT systems and Third Party providers) each of your time-critical business activities require. The recoverability of these resources must be faster than the outage tolerance of the activities they support.
The plans need to be exercised (tested) at least annually. Having a well written plan, with no capability to implement a recovery is meaningless.
Not sure where to start? Let our consultants facilitate your path to efficiently develop a BCP that is fit for purpose and reflects the needs of your organisation.
-
Nobody would think it reasonable to stage a new musical - without having rehearsed it thoroughly before opening night. You should exercise your BCP and Crisis Management Plan at least annually to ensure that it is fit for purpose and that your organisation can comfortably achieve the recovery targets the business has set.
The two most valuable aspects of exercising is that it uncovers weaknesses in your plan before a real disaster strikes and it is a great way of training your executives to manage a crisis efficiently.
Struggling to keep your plan up to date? Our team can design, facilitate and document your annual resilience testing program so your team stays sharp.
-
nsurers are increasingly scrutinising operational resilience before writing policies or paying out complex business interruption claims. Having a validated, regularly tested BCP demonstrates active risk mitigation, which can lower your risk profile, ease premium negotiations and provide the audit trails required to fast-track insurance claim payouts after a disaster.
Preparing for insurance renewal? Our consultants can review your BCP to ensure it aligns with what underwriters look for to secure optimal coverage.
-
Developing a BCP is prudent risk management and a good practice in almost all circumstances. Not having a "Plan B" puts your organisation's welfare at risk and this exposure can be avoided with an appropriate BCP.
While a blanket "Business Continuity Plan" law doesn't apply to every single business, Australian legislation heavily penalises failure to manage risk. Under the Corporations Act (Directors' Duties), company officers must exercise due diligence regarding risk. Regulated sectors - such as financial institutions under APRA’s standard CPS 230, critical infrastructure operators under the SOCI Act and businesses bound by work health and safety (WHS) laws - face strict legal mandates to prove operational resilience.
Unsure of your compliance obligations? Our compliance specialists can audit your regulatory exposure and help you build a defensible framework.
-
This varies by size of organisation. Like many of these initiatives, it is unwise to do too much or too little.
Having a BCP that is 100 pages long and reads like "War and Peace" will mean that it will never be used when it’s most needed. Similarly, a two page document is unlikely to be helpful. For a small to medium sized organisation, an experienced practitioner should be able to develop a workable BCP in 30-40 person days.
Note that perfection is the enemy! To get better is the goal - it's more important to get started and learn and improve through exercising the plan.
Unfortunately, it can often be very challenging to find the time to devote to the development of a BCP.
Your goal should be to crawl, walk, run!
Unsure of the effort? Our consultants will help you find ways to accelerate the implementation of your BCP.
-
As the primary purpose of a BCP is to keep the business going after a disaster - a business manager should have overall responsibility for the project.
Note that although information technology is an important component of a BCP, it is probably unwise to have an IT person head up the BCP initiative, as many of the key decisions require intimate knowledge of the business.
A critical factor to the success of the project is to ensure you have the energetic and strong support from a senior business executive - preferably the CEO or a member of the senior leadership team.
You will find it very difficult to obtain the assistance you will need, without strong executive sponsorship. It is often very helpful to have a Steering Committee to help you through the process and gain the support you will require.
Unsure of who should do it? Our consultants can help you with pointers on the best approach.
-
If you are starting from scratch, you will probably need to allow at least three elapsed months as a minimum. Scheduling interviews with senior managers requires advanced planning and getting colleagues to review documentation often takes longer than anticipated.
A BCP for a large organisation can easily take twelve months to complete.
-
Generic templates from government portals (like business.gov.au) are a great starting point for basic compliance. However, a fill-in-the-blank template often fails under real-world pressure because it isn't tailored to your unique supply chain, technology stack or workforce layout.
Ready to upgrade from a generic document? Use our starter template, then let our resilience experts pressure-test it with your leadership team in a 30-minute review session.
-
When your organisation receives a ransomware from cyber criminals, your BCP cannot rely on locked-down laptops or encrypted servers. You need documented out-of-band communication protocols, clean immutable backups, manual workaround procedures for core operations and clear legal/PR notification workflows.
You also require a current and exercised Cyber Incident Response Plan.
Has your cyber incident response plan been exercised? Our consultants can work with your cyber resilience team to run a joint exercise to expose vulnerabilities before the hackers do.
-
The most critical stage of a BCP is the Business Impact Analysis, as it identifies what activities are most time-critical for the organisation. The main output of a BIA is a ranking of the most important business processes in the organisation - in terms of value ($ profit or sales per day) and the amount of time your organisation could survive without these being available - before it suffers unacceptable harm.
Having identified the top 10-15 “Prioritised Activities” and their value will give you a good idea of the scale of investment you will need to protect the organisation. For example, if your most critical activity is worth $1M/day - you would not spend $10,000 on the BCP and the supporting infrastructure to protect it. The value of these activities and the risk appetite of your organisation will provide you with a good guide on how much you should spend on its protection. Recovering only one or two days earlier will offset the cost of the BCP development.
Struggling to develop a business case to support the investment? Our consultants can work with to develop a conservative business case to help you justify the investment.
-
How do I get the appropriate support from my managers?
Ensure the project has a strong executive sponsor and establish a Steering Committee that has representatives from key parts of the business. Report your progress regularly and avoid surprises. Leave key decisions to the Steering Committee.
Want to learn about some useful methods to get management support stress-test your supply chain? Let our consultants map out your supply chain vulnerabilities and build a robust continuity supplier network.
-
Australian supply chains face unique compounding threats - from floods and bushfires cutting off transport corridors to global shipping shocks. Effective supply chain resilience requires the mapping of supplier dependencies, establishing geographic diversification, holding strategic buffer stock for critical inputs and pre-vetting alternative logistics providers.
Want to stress-test your supply chain? Let our consultants map out your supply chain vulnerabilities and build a robust continuity supplier network.
-
When your primary servers and office phones fail, it’s almost impossible to manage stakeholder communications. A well tested crisis communication plan relies on out-of-band infrastructure - such as pre-scripted emergency messaging templates, cloud-based mass notification systems, designated satellite or mobile fallback numbers and predefined authority matrices on who speaks to the media, staff and regulators.
Is your communication plan ready for a blackout? Let us help you set up redundant, secure crisis communication channels and protocols.
-
The key steps of a business continuity plan are:
Initiation: Establish the project, set scope and budget, obtain executive sponsorship, secure staff resources including a Steering Committee, develop a budget and schedule a kick off meeting.
Business impact analysis: Identification of the top 10-15 Prioritised Activities, estimating their value on a per day basis and how long the organisation can survive without them - before suffering unacceptable harm.
Risk assessment: Identification of key business continuity risks to your organisation, their likelihood and their potential impacts. Recommend mitigation strategies.
Develop Key Documents: The documents that contain the plans and details of the procedures the organisation will need to take to enable a recovery from any disruption, assuming the critical supporting resources are in the current state of recoverability.
Embedding, training, exercising and maintenance: Training of key staff involved in the recovery, making changes to onboarding of new hires and job description amendments. Establish a maintenance program to keep documentation current. Conduct an exercise to validate documentation.
Strategy: Develop alternative strategies to remedy the recoverability of the resources that are not fit for purpose. Decide on preferred strategies and implement projects to remedy.
-
CPS 230 (Operational Risk Management) is an APRA Prudential Standard that became effective in June 2025. It applies to Authorised Deposit Taking Institutions (ADIs), general insurers, superannuation funds, life insurers and friendly societies.
CPS 230 requires these regulated entities to maintain a formal operational risk management framework, identify and manage material operational risks and ensure the continuity of critical operations and set strict tolerance levels for their disruptions. It places particular emphasis on the risks posed by Third Party and cloud service provider dependencies and to ensure that material service providers maintain matching resilience standards. Compliance requires comprehensive end-to-end mapping, rigorous scenario testing and Board-level oversight. As Australian organisations increasingly rely on external providers, these dependencies must be addressed be updated on a regular basis.
Need to bridge the gap to APRA CPS 230 compliance? Our specialist regulatory resilience consultants can guide your gap analysis, mapping and Board reporting.
-
A Crisis Management Plan (CMP) focuses on leadership response - how your senior team communicates, makes decisions, coordinates with stakeholders, and manages the organisation's reputation during a crisis.
A Business Continuity Plan (BCP) focuses on operational recovery - how the organisation restores its critical activities and services after a disruption.
Both are essential and should be developed together so that they are aligned. Without a CMP, even a well-prepared organisation can suffer reputational and stakeholder damage during a crisis. Without a BCP, the organisation may struggle to restore operations even after the crisis is resolved.
-
RTO (Recovery Time Objective): How quickly must your system or process be back online after a disruption before the impact becomes catastrophic? (e.g., "We must restore billing within 4 hours.")
RPO (Recovery Point Objective): How much data loss can your business tolerate? This dictates your backup frequency. (e.g., "We can tolerate losing no more than 1 hour of transaction data.")
Aligning RTO’s and RPO’s with executive expectations is tricky. If your current IT recovery metrics don't match business needs, our consultants can align your technology roadmap with operational realities.
-
Climate change introduces two categories of risk for Australian organisations.
Physical risks include floods, bushfires, and extreme weather events that can disrupt operations, staff access, and supply chains. Australia's geographic remoteness amplifies these vulnerabilities — extended supply chains are particularly susceptible to climatic disruptions.
Transitional risks include evolving regulatory disclosure obligations. Listed companies and APRA-regulated entities face increasing requirements to assess and report on climate-related risks under TCFD frameworks and relevant APRA, ASIC and ASX guidance.
Continuity Matters helps organisations incorporate climate risk into their resilience programs and prepare for current and emerging disclosure requirements.
Not sure where to start? Let our consultants help you address the risks presented by climate change, with a focus on supply chain and single points of failure.