When every function is described as critical, a business continuity plan has avoided its most important decision. People, time, access and cash may all be constrained after a disruption. Management must decide which services need to return first, what level of service is initially acceptable and which activities can wait.
Those choices should be made while there is time to examine their consequences. During an incident, pressure from customers, staff and suppliers can make every request feel equally urgent.
The priority is to identify what the business must be able to do to maintain essential commitments. That is a more useful starting point than listing departments or trying to restore the organisation chart in order.
Define an operation that can actually function
A hotel may be able to communicate with guests before it can accommodate them. A contractor may be able to supervise an existing site before it can mobilise a new one. A service business may be able to handle urgent requests while suspending routine work.
These are different operating states. Each needs a defined service level, the resources required and the person authorised to approve it. “Resume operations” is too broad to tell a team what it is expected to deliver.
The minimum service level should be credible to customers and sustainable for staff. It should also specify what the business will temporarily stop accepting. Continuing to take new commitments while recovery capacity is uncertain can create a second problem on top of the original disruption.
NIST's guidance on business impact analysis connects essential functions with the assets and resources that support them. For a management team, the practical question is what becomes impossible, delayed or more costly when a particular dependency is unavailable.
Test the dependencies behind the priority
A function labelled first priority may depend on something that has been assigned a later recovery date. Customer communication, for example, may require current booking records and a reliable view of service availability. Restoring a communications channel without those records can produce fast but inaccurate messages.
Map the people, information, premises, equipment and suppliers required for each essential function. Then examine whether those dependencies are available, recoverable or replaceable within the intended timeframe.
Alternatives need to be tested realistically. A second supplier may rely on the same transport route as the first. A temporary workspace may require connectivity or equipment that the business has not arranged. A nominated backup manager may lack the authority to approve expenditure.
These gaps are manageable when identified early. They become difficult when a plan has treated them as settled arrangements simply because a name or address appears in a document.
Link the recovery sequence to funding and authority
The ability to restart depends partly on the ability to pay for the restart. Temporary services, urgent purchases, transport, additional labour and supplier deposits may be required before customer receipts return.
Prepare a cash view for the proposed recovery sequence. Distinguish funds already available from insurance proceeds, financing or customer payments that remain uncertain. The timing of those receipts matters as much as their eventual amount.
Management should establish who can approve urgent spending, the limits of that authority and how decisions will be recorded if normal systems are unavailable. The control needs to work under disrupted conditions. A procedure that requires access to an inaccessible office has not solved the authorisation problem.
The plan should also define the route for decisions outside delegated limits. A named deputy and an agreed escalation method are more useful than an assumption that the director will always be reachable.
Safety and official restrictions determine whether particular operations can proceed. Business priorities do not override those constraints. The recovery sequence must reflect the evidence and clearances required for the actual activity.
Use an exercise to expose decisions
A discussion exercise should ask the team to work through a specific interruption. Assume, for example, that the premises cannot be accessed, the main supplier is unavailable and one key manager cannot be contacted. Give the team the information it would realistically possess at that point.
The useful output is the sequence of decisions. What service can still be offered? Which customers must be contacted? What information is missing? Who can approve the next expenditure? What must be confirmed before the service is expanded?
Record gaps as actions with owners and dates. Repeat the affected part of the exercise after those actions are closed. The purpose is to establish that the recovery arrangement works, not merely that staff have attended a meeting.
A business continuity plan earns its place when management can use it to make difficult choices under pressure. Deciding what can wait gives the essential operation a realistic chance to recover. It also gives customers and employees something more valuable than a general assurance: a clear account of what the business can do next.