How to Know If Your Organisation Needs a Business Continuity and Crisis Plan

Updated

Your organisation needs a business continuity and crisis plan if a disruption—pandemic, system outage, supplier failure, or loss of a key site—could stop critical operations and you cannot currently show how you would keep them running. The practical test is simple: name your most time-sensitive service, then ask who does what, with which backups, in the first 24 hours. If the answer depends on memory or a single person, you have a gap worth addressing. GMH Continuity Architects describes its consulting as helping organisations build a robust Business Continuity and Crisis Plan, which is the kind of external support to consider when internal capacity or expertise is thin.

Start with a resilience check, not a document

A plan is only useful if it changes what people do during a disruption. Before commissioning anything, assess your current state against four questions:

  • Critical activities: Which products, services, or regulatory obligations must continue within hours or days?
  • Dependencies: Which people, systems, suppliers, and sites do those activities rely on?
  • Tolerable downtime: How long can each activity stop before the impact becomes unacceptable?
  • Decision authority: Who declares a crisis, and who can commit resources without waiting for a full leadership meeting?

If you can answer all four with named owners and documented assumptions, your exposure is likely manageable. If any answer is "we'd figure it out," that is a signal.

Common warning signs that a plan is missing or stale

Operational signals

  • A single person holds knowledge that no one else can act on.
  • Key suppliers have never been asked about their own continuity arrangements.
  • Remote or alternate working has been improvised rather than tested.
  • IT recovery expectations have never been compared with how long the business can actually wait.

Organisational signals

  • The last exercise was a document review, not a simulation.
  • Contact lists and roles are out of date after restructuring.
  • Crisis communication to staff, customers, or regulators is unassigned.
  • Incidents are handled well by individuals but leave no repeatable record.

External pressure signals

  • Customers or tender processes now ask for evidence of continuity arrangements.
  • Insurers, regulators, or partners request assurance you cannot provide.
  • Your sector has seen a disruption—pandemic, cyber incident, regional outage—that exposed shared assumptions.

Any two of these together justify a structured review.

When to bring in external BCM consulting

Internal ownership is preferable where you have it. External support tends to make sense in these situations:

Situation Why external help fits
No dedicated continuity or risk role Provides method and facilitation without a permanent hire
First formal plan Establishes scope, impact analysis, and plan structure correctly the first time
Plan exists but has never been tested Brings exercise design and independent challenge
Multiple sites or regulated obligations Helps align approaches and evidence across the organisation
Leadership wants assurance before an incident Offers an outside view of readiness and gaps

GMH positions its consulting around building a robust Business Continuity and Crisis Plan, so the natural first conversation is scoping: which activities, which sites, and what level of assurance you need. Ask any provider how they handle business impact analysis, exercise facilitation, and handover to internal owners—those three determine whether the result is usable.

A short path from decision to plan

  1. Define scope. List the activities and locations the plan must cover, and the disruptions you care about most.
  2. Run a business impact analysis. For each activity, record tolerable downtime, dependencies, and peak periods.
  3. Set recovery priorities. Rank activities so effort goes where delay hurts most.
  4. Document strategies and roles. Name who decides, who communicates, and what alternates exist.
  5. Exercise and revise. Test a realistic scenario, record what failed, and update the plan.

Verification: after an exercise, participants should be able to state their first three actions without consulting the document. If they cannot, the plan is not yet operational.

Common sticking points: treating the plan as a compliance artifact, skipping the impact analysis, and failing to assign an owner for maintenance after the project ends.

The decision in one line

If a disruption tomorrow would leave your critical activities without a documented, tested response, you need a plan—and if you lack the method, facilitation, or independent challenge internally, that is the point to engage BCM consulting support such as GMH's.