Business Continuity and Enterprise Risk Management Training Course

Duration 10 days 19 modules · 65 contact hours
Level Intermediate Certificate on completion
Who attends Business Continuity Managers, Enterprise Risk Managers and others
Fee from USD 2,200 KSh 190,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 9 Nov 2026 Course code SD-BC-023

Before you join: Participants should understand their organisation’s main products, services, operational processes and reporting lines.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Business interruption can arise from cyber incidents, utility failure, severe weather, supplier collapse, civil unrest, pandemics, fires, regulatory action or loss of critical premises. Many organisations hold emergency plans that do not identify their true recovery priorities, lack tested recovery strategies, or sit apart from enterprise risk decisions. This course addresses that gap by linking business continuity management systems (BCMS) with enterprise risk management (ERM), so that disruption planning is based on credible threats, quantified impacts and accountable recovery decisions.

Participants learn to design and maintain a BCMS aligned with ISO 22301 and integrate continuity requirements into an ISO 31000-based ERM process. They conduct business impact analysis, set recovery time and recovery point objectives, assess risks using likelihood-impact criteria, select treatment options, develop continuity strategies, and create incident, crisis and recovery plans. The course also covers supplier continuity, information and communications technology recovery, crisis communications, exercising, audit evidence, management review and continual improvement.

Teaching combines focused instructor briefings, worked cases from banking, public services, manufacturing, health services and international operations, facilitated group work, scenario simulations and individual application planning. Participants progressively build a BCMS and ERM evidence pack from the first week, then test and improve it during the second week. They leave with reusable templates and a completed continuity and risk management package that can be adapted for their own function, site or organisation.

The course suits managers and specialists responsible for resilience, risk, operations, safety, security, information technology, facilities, compliance or internal assurance. It is designed for professionals who need to turn risk registers and continuity policies into workable recovery arrangements with clear ownership, documented decisions and testable plans.

What you will be able to do

  • Design a BCMS scope, policy, governance structure and implementation roadmap aligned with ISO 22301
  • Conduct a business impact analysis using impact categories, recovery time objectives and dependency mapping
  • Assess enterprise risks using ISO 31000 principles, risk criteria and documented treatment decisions
  • Develop continuity strategies for people, premises, technology, suppliers, data and critical services
  • Produce incident response, crisis management and recovery plans with defined roles and escalation thresholds
  • Apply bow-tie analysis and risk registers to connect causes, controls, consequences and recovery actions
  • Plan and evaluate continuity exercises using scenarios, injects, observation records and corrective actions
  • Present an integrated BCMS and ERM package supported by evidence, metrics and management review inputs

Benefits of attending

For you

  • Build credible business continuity plans rather than generic emergency documents
  • Lead business impact analysis discussions with process owners and senior managers
  • Translate risk register findings into funded continuity treatment actions
  • Run scenario-based continuity exercises and record defensible improvement actions
  • Prepare evidence for BCMS audits, management reviews and customer assurance requests

For your organisation

  • Clearer recovery priorities for revenue, public services, safety-critical operations and customer commitments
  • Reduced disruption losses through tested continuity strategies and accountable recovery actions
  • Better alignment between enterprise risk reporting, continuity investment and executive decisions
  • Stronger supplier, technology and facility dependency controls for critical services
  • Audit-ready BCMS documentation supporting ISO 22301 certification or internal assurance

Course modules

19 modules over 10 days

Participants can explain how BCMS and ERM governance work together to manage disruption risk.

  • ISO 22301 clauses, intent and documented information requirements
  • ISO 31000 principles applied to continuity-related enterprise risks
  • BCMS, emergency management, crisis management and disaster recovery distinctions
  • Board accountabilities, executive sponsorship and three-lines assurance responsibilities
  • Risk appetite statements translated into continuity planning thresholds
  • Interested parties, legal duties and contractual continuity requirements

Participants can define a realistic BCMS scope, governance model and implementation boundaries.

  • Organisational context analysis using PESTLE and stakeholder mapping
  • Scope statements covering locations, services, functions and exclusions
  • Process ownership mapped through RACI responsibility assignment matrices
  • BCMS policy commitments, objectives and approval authorities
  • Governance forums, reporting cycles and escalation decision rights
  • Implementation roadmaps sequenced by risk, maturity and resource availability

Participants can apply a structured ERM process to continuity-related threats and opportunities.

  • Risk identification sources: incidents, audits, horizon scanning and workshops
  • Risk criteria defined through likelihood, impact, velocity and control effectiveness
  • Inherent and residual risk ratings documented within risk registers
  • Risk owners, action owners and acceptance authorities distinguished clearly
  • Treatment options compared: avoid, reduce, transfer, accept and exploit
  • Key risk indicators linked to escalation thresholds and reporting

Participants can develop credible disruption scenarios and assess their control implications.

  • Scenario construction from threat sources, vulnerabilities and triggering events
  • Bow-tie diagrams connecting causes, preventive controls and recovery barriers
  • Cyberattack, facility loss and utility outage scenario assumptions
  • Supplier failure scenarios assessed through concentration and substitutability
  • Severe weather and civil disturbance impacts on workforce availability
  • Control assurance evidence tested against stated risk treatment claims

Participants can design a business impact analysis that produces usable recovery priorities.

  • BIA objectives, interview protocols and process-owner data requirements
  • Impact categories covering financial, regulatory, safety, service and reputational harm
  • Maximum tolerable period of disruption determined for critical activities
  • Recovery time objectives set using escalating impact thresholds
  • Recovery point objectives specified for data-dependent business processes
  • BIA questionnaires structured for consistent cross-functional comparison

Participants can map critical dependencies and identify single points of failure.

  • End-to-end process maps identifying upstream and downstream dependencies
  • People dependencies assessed by skills, authority, location and availability
  • Technology service maps linking applications, infrastructure, data and interfaces
  • Premises dependencies reviewed for access, capacity, utilities and security
  • Third-party dependency matrices ranked by service criticality and alternatives
  • Single points of failure recorded with practical mitigation actions

Participants can set defensible recovery targets and sequence recovery activities.

  • Recovery priorities derived from BIA findings and risk tolerance
  • RTO, RPO and maximum tolerable downtime reconciled consistently
  • Minimum business continuity objectives defined for degraded operations
  • Recovery sequence charts showing prerequisites, handoffs and decision gates
  • Resource requirements estimated for initial response and sustained recovery
  • Executive decisions documented where recovery objectives exceed current capability

Participants can evaluate and select proportionate continuity strategies for critical services.

  • Strategy options assessed against cost, feasibility, risk reduction and recovery targets
  • Workforce continuity methods: cross-training, split teams and remote working
  • Alternate site strategies compared for relocation, reciprocal and mobile options
  • Technology recovery strategies covering backups, replication and manual workarounds
  • Supplier resilience measures including dual sourcing and contingency contracts
  • Cost-benefit cases prepared for executive continuity investment decisions

Participants can create an incident management structure with clear roles and escalation paths.

  • Incident classification criteria based on severity, impact and urgency
  • Gold, silver and bronze command structures adapted for organisational use
  • Incident team roles defined through role cards and delegations
  • Escalation triggers linked to authority, notification and activation requirements
  • Decision logs capturing rationale, approvals, actions and outstanding issues
  • Situation reports structured for operational and executive audiences

Participants can prepare crisis communications arrangements that protect trust and decision quality.

  • Crisis leadership principles for uncertainty, pressure and incomplete information
  • Stakeholder communication matrices identifying audiences, owners, channels and timing
  • Holding statements drafted for customers, regulators, employees and media
  • Rumour control procedures using verified facts and approved spokespersons
  • Employee welfare communications addressing safety, wellbeing and work instructions
  • Regulatory notification obligations incorporated into crisis communication plans

Participants can align continuity requirements with information technology recovery capabilities.

  • Business requirements translated into application recovery and data protection needs
  • Disaster recovery plans aligned with business recovery time objectives
  • Backup policies assessed for frequency, retention, restoration and segregation
  • Cyber incident recovery sequencing coordinated with forensic preservation requirements
  • Manual workarounds designed for unavailable systems and degraded communications
  • Cloud service dependencies reviewed through contracts, regions and exit arrangements

Participants can manage continuity risks arising from suppliers and supply chain dependencies.

  • Supplier segmentation based on criticality, spend, substitutability and impact
  • Due diligence questions covering supplier BCMS, testing and recovery capabilities
  • Contract clauses specifying notification, recovery commitments and audit rights
  • Supply chain mapping identifies tier dependencies and geographic concentrations
  • Contingency sourcing plans address qualification, inventory and approval lead times
  • Supplier disruption reviews integrated with procurement governance and risk reporting

Participants can produce practical continuity plans that teams can activate under pressure.

  • Plan architecture linking policy, procedures, playbooks and supporting records
  • Activation checklists specify triggers, authorities, contacts and immediate actions
  • Recovery playbooks organised by critical activity and disruption scenario
  • Call trees maintained with alternates, validation dates and confidentiality controls
  • Contact directories protected through access controls and offline availability
  • Document control procedures manage versions, approvals, distribution and retention

Participants can design continuity exercises that validate plans, decisions and recovery capability.

  • Exercise objectives tied to identified risks, plans and assurance needs
  • Tabletop, simulation, technical recovery and live exercise formats compared
  • Scenario injects timed to test escalation, decisions and communications
  • Observer guides capture evidence against predefined performance criteria
  • After-action reviews distinguish root causes, symptoms and improvement actions
  • Corrective action registers track owners, deadlines, verification and closure

Participants can measure BCMS performance and prepare evidence for audit and management review.

  • Continuity metrics covering plan currency, exercise completion and action closure
  • Internal audit programmes mapped to ISO 22301 requirements
  • Audit evidence sampled from records, interviews, observations and test results
  • Nonconformities classified with containment, corrective action and effectiveness review
  • Management review inputs include performance, risks, changes and resource needs
  • Continual improvement priorities selected using trends and assurance findings

Participants can plan BCMS implementation activities, stakeholder engagement and adoption controls.

  • Maturity assessments identify gaps against target BCMS capabilities
  • Implementation work breakdown structures assign deliverables, owners and milestones
  • Stakeholder engagement plans address resistance, priorities and decision requirements
  • Training needs analysis identifies role-specific continuity competence requirements
  • Awareness campaigns reinforce reporting, activation and recovery responsibilities
  • Change control evaluates continuity impacts from organisational and technology changes

Participants can produce decision-ready reports linking risk exposure, continuity capability and investment.

  • Risk dashboards combine exposure, control status, trends and treatment progress
  • BCMS performance reports connect recovery capability with critical service priorities
  • Heat maps used cautiously alongside narrative risk and control analysis
  • Board reports distinguish decisions required, assurance findings and accepted risks
  • Investment proposals quantify recovery gaps, options and residual exposures
  • Reporting calendars align risk committees, management review and audit cycles

Participants can adapt BCMS and ERM methods to regulated and safety-critical operating contexts.

  • Banking scenarios address payment outages, liquidity operations and regulatory notifications
  • Health service scenarios prioritise patient safety, clinical records and surge capacity
  • Manufacturing scenarios examine plant shutdown, hazardous materials and spare parts
  • Public sector scenarios address essential services, elections and community communications
  • NGO scenarios consider field security, humanitarian access and donor obligations
  • Cross-border operations assess legal, cultural and communications constraints

Participants can build, review and present a complete BCMS and ERM package for a critical service.

  • Scope, context and governance defined for a selected critical service
  • Risk register and bow-tie analysis prepared for priority disruption scenarios
  • Business impact analysis establishes impacts, dependencies and recovery objectives
  • Continuity strategies selected with assumptions, costs and accountable owners
  • Incident, crisis and recovery plans assembled into controlled documentation
  • Exercise design, metrics and management review inputs complete assurance evidence
  • Peer review tests coherence, feasibility, traceability and executive decision readiness

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. ISO 22301-aligned BCMS implementation roadmap
  2. Business impact analysis questionnaire and dependency map
  3. Enterprise risk register with bow-tie analysis template
  4. Continuity strategy options appraisal model
  5. Incident, crisis and recovery plan template set
  6. Exercise evaluation and corrective action register

Who should attend

  • Business Continuity Managers — responsible for establishing, maintaining or improving continuity arrangements
  • Enterprise Risk Managers — need to connect risk treatment with disruption preparedness
  • HSE Managers — manage operational resilience alongside emergency and safety responsibilities
  • Operations Managers — must protect critical services, production and customer commitments
  • Information Technology Service Managers — own recovery requirements for systems, data and technology suppliers
  • Internal Auditors and Compliance Managers — assess BCMS evidence, control effectiveness and management oversight

Skills and tools covered

Business impact analysisEnterprise risk assessmentContinuity strategy designCrisis plan developmentExercise programme managementBCMS assurance

Tools and standards

ISO 22301:2019, ISO 31000:2018, Business Impact Analysis, Bow-tie Analysis

How the course runs

Training methodology

The course uses short instructor briefings to introduce standards, methods and decision criteria, followed by worked cases and facilitated group exercises. Participants analyse disruption scenarios, complete business impact and risk assessment materials, and test planning assumptions through crisis and recovery simulations. Case material reflects regulated services, critical operations, third-party dependencies and technology outages. Individual application planning connects each method to participants’ own responsibilities. Instructor feedback focuses on practical document quality, governance clarity, recovery feasibility and evidence for assurance.

Requirements and prerequisites

Participants should understand their organisation’s main products, services, operational processes and reporting lines. Experience with risk registers, emergency response, operational risk, audit, safety management, information technology service management or resilience planning is useful. Participants should be comfortable reading policies, mapping processes and discussing operational dependencies with colleagues. No prior certification in ISO 22301, ISO 31000, auditing, project management or crisis management is required. The course explains the relevant standards and methods before participants apply them.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

You should understand the main services, processes or operational risks within your organisation. Prior work in continuity, risk, HSE, audit, operations or technology is useful, but ISO certification experience is not required.

Bring a laptop if possible, plus any non-confidential process maps, risk registers, incident plans or continuity policies you are permitted to use. Participants can apply course templates to realistic work situations without sharing sensitive information.

It suits managers and specialists with responsibility for continuity, risk, operations, HSE, security, technology, facilities, compliance or assurance. It is particularly useful where teams need to create or improve a formal BCMS.

Crisis management focuses on leadership and communications during an event, while disaster recovery concentrates on restoring technology. This course connects those areas with business impact analysis, recovery strategy, governance, enterprise risk treatment and BCMS assurance.

You can use the templates to scope a BCMS, run BIA interviews, update a risk register, identify recovery gaps and plan an exercise. The capstone package provides a structured starting point for a real service, function or site.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The first week builds BCMS and ERM foundations, impact analysis and strategy design; the second week develops plans, validates them through exercises, addresses assurance and completes the capstone.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Business Continuity