BCI Good Practice Guidelines Business Continuity Training Course

Course overview

Business continuity programmes often fail at the point where policy becomes operational practice. Recovery plans may exist, but they are not linked to a current business impact analysis, recovery strategies have not been costed or approved, dependencies are unclear, and exercises test documents rather than real decision-making. For health, safety and environment functions, these weaknesses can extend an incident’s impact on people, environmental controls, statutory obligations, critical services and public confidence. This course equips practitioners to build, assess and improve a business continuity management system using the Business Continuity Institute Good Practice Guidelines (BCI GPG) as the working method.

Participants work through the BCI GPG professional practices: policy and programme management, embedding business continuity, analysis, design, implementation, and validation. They learn to scope a BCMS, establish governance, conduct business impact analysis and risk assessment, define maximum acceptable outages and recovery time objectives, select proportionate continuity strategies, develop plans, and design exercising and maintenance arrangements. The course also addresses how to connect business continuity activity with incident management, crisis communications, supplier continuity, information security, emergency response and ISO 22301 requirements.

Teaching combines instructor-led explanation with facilitated workshops based on a realistic operational disruption scenario. Participants use BCI-aligned templates to map critical activities, assess impacts, identify dependencies, specify recovery requirements and evaluate strategy options. By the end of the week, each participant leaves with a documented BCMS improvement roadmap and a practical portfolio containing a programme scope, BIA outputs, recovery strategy rationale, plan structure and exercise design that can be adapted for their organisation.

The course is intended for practitioners who already contribute to resilience, emergency preparedness, risk, facilities, IT service continuity or HSE assurance and now need a disciplined, internationally recognised framework for leading business continuity work.

Course objectives

By the end of this course, participants will be able to:

• Apply the BCI GPG professional practices to structure a business continuity management system
• Define BCMS scope, policy, governance roles and programme measures for a named organisational context
• Conduct a business impact analysis using impact categories, maximum acceptable outage and recovery objectives
• Map critical activity dependencies across people, premises, technology, suppliers, information and equipment
• Evaluate continuity and recovery strategies using cost, feasibility, risk reduction and resource criteria
• Draft a business continuity plan structure with escalation, response, recovery and communications sections
• Design an exercise programme using scenario objectives, injects, observer criteria and corrective actions
• Produce a BCI GPG-aligned business continuity improvement roadmap for workplace implementation

Benefits of attending

Target competencies

Who should attend

• Business Continuity Managers — who need to establish or mature a BCMS using a recognised professional framework
• HSE Managers — who must connect continuity arrangements with life safety, environmental control and regulatory obligations
• Risk Managers — who translate enterprise risk findings into operational resilience and recovery requirements
• Emergency Preparedness and Crisis Management Leads — who need clear interfaces between emergency response, crisis leadership and continuity recovery
• IT Service Continuity Managers — who must align technology recovery priorities with business-led BIA requirements
• Internal Auditors and Compliance Managers — who assess BCMS evidence against BCI GPG and ISO 22301 expectations

Requirements and prerequisites

Participants should understand their organisation’s main products, services, sites and operational dependencies, and should have some exposure to risk management, incident response, emergency planning, business continuity or management systems. Familiarity with terms such as risk assessment, stakeholder, escalation, recovery time objective and corrective action is helpful, although these concepts are revisited during the course. Participants should bring access to a laptop and, where permitted, non-sensitive examples of existing policies, plans or BIA templates. No prior BCI membership, ISO 22301 lead auditor qualification, specialist continuity software or technical IT recovery expertise is required.

Training methodology

The instructor uses the BCI GPG professional practices as the course spine, then applies each practice to an evolving disruption case involving loss of a critical site, supplier failure and IT service outage. Short taught sessions establish the method; facilitated table workshops produce BIA records, dependency maps, strategy options and plan sections. Teams critique each other’s evidence against ISO 22301 expectations and use exercise injects to test recovery decisions. The final session converts the case learning into an individual BCMS implementation or improvement plan for the participant’s workplace.

Course outline

Day 1: BCI GPG foundations and BCMS governance

• BCI Good Practice Guidelines structure and six professional practices
• Business continuity, organisational resilience, emergency management and crisis management interfaces
• ISO 22301:2019 clauses and BCI GPG evidence expectations
• BCMS scope definition across products, services, sites and legal entities
• Business continuity policy, objectives and management commitment
• Programme governance using RACI roles, steering groups and escalation routes
• BCMS performance measures, maturity indicators and management review inputs

Workshop: Participants create a BCMS scope statement, governance RACI and initial programme dashboard for the case organisation.

Day 2: Analysis: impacts, risks and dependencies

• Business impact analysis purpose, interview design and stakeholder preparation
• Impact category definitions for safety, environment, regulation, finance, customers and reputation
• Maximum acceptable outage, recovery time objective and minimum business continuity objective
• Critical activity prioritisation and time-based impact assessment
• Resource dependency mapping for people, facilities, technology, information, suppliers and equipment
• Business continuity risk assessment and disruption scenario identification
• BIA validation, challenge sessions and executive approval of recovery requirements

Workshop: Participants complete a BIA worksheet and dependency map for a critical service under a multi-day disruption scenario.

Day 3: Designing proportionate recovery strategies

• Translating BIA recovery requirements into strategy design criteria
• People continuity options including cross-training, succession and remote working
• Premises recovery options including reciprocal sites, work area recovery and alternative locations
• Technology continuity options including backup, replication, manual workarounds and failover
• Supplier continuity assessment, contractual requirements and alternate-source strategies
• Strategy option appraisal using cost, capability, residual risk and implementation timescale
• Management decision papers and approval of business continuity strategies

Workshop: Teams evaluate competing recovery strategies and produce a recommendation paper with assumptions, costs and residual risks.

Day 4: Implementation: plans, communications and embedding

• Business continuity plan architecture and document control
• Incident activation criteria, command roles and escalation thresholds
• Response, recovery and return-to-normal operating procedures
• Crisis communications principles, stakeholder messages and media coordination
• Plan interfaces with emergency response, IT disaster recovery and supplier incident procedures
• Training, awareness and role-based competence requirements
• Embedding continuity into change management, procurement and operational governance

Workshop: Participants draft an activation-and-recovery plan section, including role cards, escalation triggers and stakeholder communications.

Day 5: Validation, assurance and workplace application

• Exercise programme design from orientation sessions to simulation and live recovery tests
• Scenario construction, exercise objectives, inject schedules and participant briefings
• Observer guides, evidence capture and exercise evaluation criteria
• Corrective action management, lessons learned and plan maintenance cycles
• BCMS internal audit preparation and ISO 22301 evidence trails
• Management review reporting and continual improvement priorities
• BCI GPG-aligned implementation roadmap and 90-day action planning

Workshop: Participants run a tabletop exercise segment and complete a personal 90-day BCMS improvement roadmap with owners, milestones and evidence outputs.

Tools & standards covered

BCI Good Practice Guidelines Edition 7.0, ISO 22301:2019 Security and resilience — Business continuity management systems, ISO 22313:2020 Security and resilience — Guidance on business continuity management systems, ISO 22317:2021 Security and resilience

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions