Business continuity is the capability of an organisation to continue delivering important products and services at acceptable predefined levels following a disruptive incident. It encompasses the policies, processes, resources, arrangements and organisational capabilities used to maintain or restore critical activities when normal operations are interrupted. The concept is not limited to disaster scenarios.
A business continuity event can involve anything from a building becoming inaccessible to a major cyberattack, loss of a supplier, utility outage, technology failure, pandemic, severe weather event or sudden loss of key personnel. The essential question is what the organisation must continue doing, at what level, and within what timeframe when normal operating arrangements are unavailable. Business continuity therefore focuses on continuity of important organisational outcomes rather than merely keeping every system running.
Business continuity is closely associated with the international business continuity management discipline represented by standards such as ISO 22301. A business continuity management system provides a structured approach to establishing, implementing, maintaining and continually improving an organisation’s capability to respond to disruptions. The discipline commonly includes governance, business impact analysis, risk assessment, continuity strategies, plans and procedures, training, exercising, performance evaluation and continual improvement. The objective is not to predict every possible incident. Instead, organisations identify critical activities and develop capabilities that can operate across a range of disruptive scenarios. This scenario-independent approach can make continuity arrangements more useful because the same alternative workplace, communication mechanism or manual procedure may support several different types of disruption.
Business continuity differs from business continuity planning. Business continuity describes the capability and management discipline, whereas business continuity planning is the process of developing documented arrangements that explain how that capability will be applied. A business continuity plan is one output of that process, not the entire discipline. Business continuity also differs from disaster recovery.
Disaster recovery traditionally concentrates on restoring technology and information systems after disruptive events, while business continuity encompasses the wider business activities that must continue or be restored. A company can therefore have a functioning disaster recovery plan but still lack business continuity if employees, suppliers, premises, procedures or communications cannot support the critical business services that depend on the recovered systems.
A central concept in business continuity is prioritisation. Organisations rarely need every activity to continue at exactly its normal level during a major disruption. Instead, they identify important activities, dependencies and recovery requirements. Business impact analysis helps determine the consequences of disruption over time and can identify concepts such as maximum tolerable period of disruption, recovery time objectives and minimum business continuity objectives. Terminology varies between standards and organisations, and these concepts should not be treated as interchangeable.
The purpose is to establish evidence-based recovery priorities. If a critical customer-facing service can tolerate four hours of disruption but a regulatory reporting function can tolerate several days, the organisation may allocate resources differently. Business continuity therefore turns broad concern about disruption into prioritised operational requirements.
Business continuity strategies can involve multiple approaches. An organisation may use alternative premises, remote working, manual workarounds, alternate suppliers, spare capacity, duplicated technology, reciprocal arrangements, outsourced services or prioritised restoration. The appropriate strategy depends on the activity, disruption scenario, cost and required recovery speed. A manual workaround may be suitable for a process that normally operates electronically but can tolerate slower processing. A highly time-sensitive transaction service may require automated redundancy. The strategy must also consider dependencies.
An alternative workplace is ineffective if employees cannot access essential applications, authentication systems or data. Similarly, a backup supplier is of limited value if it cannot meet required quality, geographic or regulatory requirements. Business continuity therefore requires end-to-end analysis of how critical services are actually delivered.
Human factors are central to continuity. Employees need to know their responsibilities, communication channels and escalation routes during disruption. Plans that depend on a small number of individuals can fail when those individuals are themselves unavailable. Cross-training, documented procedures and succession arrangements can reduce this risk. Communication plans should address employees, customers, suppliers, regulators, insurers, emergency services and other relevant audiences according to the event. Messages should be accurate, authorised and appropriate to the circumstances. Business continuity also needs to consider accessibility, safety and realistic human limitations. A plan that assumes employees can work continuously without rest, equipment or safe access is not a credible continuity strategy.
Business continuity should be tested and maintained because organisational conditions change. New software, suppliers, offices, products, regulations and staff can invalidate previously effective arrangements. Exercises can range from discussion-based tabletop scenarios to technical recovery tests and full operational exercises. The objective of testing is not simply to demonstrate that a plan exists but to determine whether people, technology, suppliers and procedures can actually deliver the required continuity outcomes. Findings should be recorded, assigned to owners and addressed according to risk and priority. Tests should also consider dependencies that are outside the organisation’s direct control, because an internal plan may fail when an external service provider is unavailable.
Business continuity is therefore best understood as an organisational capability for maintaining important services during disruption rather than as a document kept for emergencies. It connects risk management, crisis management, incident response, disaster recovery, communications, facilities, human resources, procurement, cybersecurity and operational management. Effective continuity arrangements define priorities, establish realistic strategies, assign responsibilities, provide appropriate resources and are tested and improved over time. The underlying principle is that organisations should not assume that normal operating conditions will always be available. Instead, they should understand how critical outcomes can be sustained, degraded safely or restored when people, premises, technology, suppliers or other dependencies are disrupted.
