Business Continuity Management Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Business Continuity Managers, Operational Risk Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-BC-025

Before you join: Participants should understand their organisation’s main products, operational processes or support services and have some exposure to risk, incident, operational resilience, technology or control responsibilities.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Banks and financial institutions must continue critical services when systems fail, premises become unavailable, cyber incidents disrupt operations, suppliers fail, or staff cannot work. Payment processing, customer access, treasury activity, lending decisions and regulatory reporting each have different recovery priorities and time limits. Business continuity management provides the discipline for identifying these priorities, setting recovery objectives, selecting workable strategies and proving that plans can operate under pressure.

This course develops the practical skills needed to build, maintain and test a business continuity management system for banking operations. Participants apply ISO 22301 principles, conduct business impact analysis, set maximum tolerable periods of disruption, recovery time objectives and recovery point objectives, and assess dependencies across people, premises, technology, records and third parties. The course also covers crisis structures, incident communications, IT disaster recovery, supplier continuity, exercise design, assurance reporting and management review.

Teaching combines focused instructor briefings with banking disruption cases, facilitated analysis, group planning tasks, tabletop simulations and structured application planning. Participants work with realistic scenarios such as payment system outage, ransomware, branch closure, loss of a critical service provider and unavailable operations staff. They leave with a reusable BCM documentation pack including BIA, recovery strategy, plan structure, exercise and assurance materials that can be adapted for their own business unit.

The course is suited to professionals who contribute to continuity, resilience, operational risk, technology recovery, crisis management or supplier oversight within banks, payment firms and other regulated financial institutions.

What you will be able to do

  • Conduct a business impact analysis using impact categories, MTPD, RTO and RPO
  • Map critical banking service dependencies across people, systems, premises and suppliers
  • Develop recovery strategies for priority banking processes and supporting technology
  • Draft business continuity and crisis management plan structures aligned with ISO 22301
  • Apply incident activation, escalation and communication procedures during major disruptions
  • Design continuity exercises using objectives, injects, observer guides and after-action reports
  • Assess third-party continuity arrangements against contractual and recovery requirements
  • Produce a 90-day BCM improvement roadmap with governance, owners and assurance measures

Benefits of attending

For you

  • Produce credible BIA findings using MTPD, RTO and RPO
  • Lead structured continuity planning discussions with business and technology stakeholders
  • Contribute effectively to crisis teams during operational disruption
  • Design exercises that identify plan weaknesses before real incidents occur
  • Present BCM priorities and remediation needs clearly to senior management

For your organisation

  • Clearer recovery priorities for payment, lending, customer service and reporting activities
  • Better evidence of BCM governance for internal audit and regulatory review
  • Reduced uncertainty during technology outages, cyber incidents and premises loss
  • Stronger oversight of critical suppliers and outsourced operational dependencies
  • More usable continuity plans supported by tested roles, communications and corrective actions

Course modules

10 modules over 5 days

Participants can establish the governance, scope and accountability needed for an effective BCM programme.

  • ISO 22301 clauses translated into accountable continuity management activities
  • Board policy, scope statement and BCM programme charter requirements
  • Three Lines Model roles for business continuity governance
  • Risk appetite statements linked to disruption tolerances and escalation
  • Regulatory expectations affecting banks, payment firms and outsourced services
  • BCM policy hierarchy: policy, standard, procedure and supporting records
  • Management review agendas, evidence packs and corrective action tracking

Participants can identify disruption scenarios and map the dependencies that affect service recovery.

  • Scenario-based risk assessment using threat, vulnerability and control analysis
  • Bow-tie diagrams linking causes, preventive controls, impacts and recovery controls
  • Operational risk event data converted into continuity planning assumptions
  • Supplier concentration and single points of failure assessment
  • Cyberattack, facility loss, people loss and third-party disruption scenarios
  • Risk treatment decisions recorded with owners, deadlines and residual exposure
  • Interdependency mapping between branches, operations, technology and payment rails

Participants can conduct a BIA and set recovery objectives for critical banking activities.

  • Business impact analysis interviews structured around products, processes and services
  • Impact categories: financial, regulatory, customer, safety, reputational and contractual
  • Maximum tolerable period of disruption established from escalating impacts
  • Recovery time objectives assigned to prioritised activities and dependencies
  • Recovery point objectives aligned with data loss tolerances
  • Minimum business continuity objective defined for each critical activity
  • Dependency maps capturing staff, premises, systems, suppliers and records

Participants can compare and select recovery strategies that meet agreed recovery objectives.

  • Recovery strategies compared against RTO, capacity, cost and risk criteria
  • Alternate site options: work area recovery, branch relocation and remote work
  • Manual workarounds designed for payments, lending and customer service
  • Technology recovery patterns: active-active, warm site, backup restoration and cloud
  • Workforce continuity plans covering succession, split teams and essential roles
  • Supplier recovery commitments tested against contractual service-level obligations
  • Strategy selection documented through assumptions, constraints and approval rationale

Participants can structure practical continuity and crisis plans for activation during disruption.

  • Plan architecture aligned with ISO 22301 documented information requirements
  • Incident activation criteria, authority levels and notification thresholds
  • Command structures using gold, silver and bronze response roles
  • Crisis communications protocols for regulators, customers, staff and media
  • Business unit recovery procedures sequenced by priority activities
  • Contact lists, call trees and alternates controlled through ownership
  • Plan annexes covering systems, suppliers, premises and manual forms

Participants can support coordinated incident decisions, reporting and stakeholder communications.

  • Incident triage distinguishes operational incidents, crises and continuity activations
  • Initial situation reports capture facts, impacts, decisions and information gaps
  • Decision logs preserve rationale, authority, timing and outstanding actions
  • Common operating picture maintained through timed status reporting
  • Stakeholder notification matrices match event severity and legal obligations
  • Media holding statements prepared without speculation or unverified details
  • Human factors addressed through welfare, fatigue management and shift handovers

Participants can align business continuity requirements with IT recovery and supplier arrangements.

  • IT service continuity aligned with application criticality and recovery objectives
  • Disaster recovery runbooks distinguish failover, restoration and data validation
  • Cyber incident recovery coordinates containment, forensics, rebuild and business resumption
  • Third-party continuity due diligence reviews plans, tests and recovery capacity
  • Exit and substitution plans address failed critical service providers
  • Payment system contingencies cover settlement windows, liquidity and reconciliation
  • Data centre dependencies mapped across telecommunications, power and cloud providers

Participants can plan, conduct and evaluate exercises that improve continuity capability.

  • Exercise objectives derived from plans, risks, assumptions and assurance needs
  • Tabletop, walkthrough, simulation and live exercise formats selected appropriately
  • Inject scripts test decisions, communications, manual workarounds and escalation
  • Observer guides record evidence against objectives and expected behaviours
  • After-action reports separate observations, root causes and improvement actions
  • Corrective action registers assign owners, due dates and verification evidence
  • Training and awareness plans target responders, deputies and general staff

Participants can monitor BCM performance and report assurance findings to management.

  • BCM performance indicators measure plan currency, exercise completion and actions
  • Internal audit testing samples evidence against policy and ISO requirements
  • Management review evaluates suitability, adequacy, effectiveness and resource needs
  • Document control applies versioning, approvals, distribution and retention rules
  • Change management triggers BIA, strategy and plan reviews
  • Assurance reporting escalates overdue actions and unacceptable residual risks
  • Audit findings converted into prioritised remediation plans and milestones

Participants can prepare a prioritised plan for improving BCM within their area of responsibility.

  • Current-state gap assessment scored against ISO 22301 control expectations
  • 90-day BCM implementation roadmap sequenced by risk, dependency and ownership
  • Executive briefing packs present exposure, investment choices and decisions
  • Departmental action plans assign BIA, plan and exercise responsibilities
  • Governance calendar schedules reviews, tests, audits and management reporting
  • Personal application commitments identify first actions and stakeholder conversations
  • Success measures connect recovery readiness with business service priorities

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Banking business impact analysis template
  2. Critical service dependency map
  3. Recovery strategy options matrix
  4. Business continuity plan structure
  5. Tabletop exercise and after-action report pack
  6. 90-day BCM implementation roadmap

Who should attend

  • Business Continuity Managers — responsible for BCM policy, plans, testing and programme reporting
  • Operational Risk Managers — assessing disruption exposure and continuity control effectiveness
  • Banking Operations Managers — protecting priority processes, staff arrangements and customer services
  • IT Service Continuity Managers — aligning disaster recovery capabilities with business recovery requirements
  • Crisis Management Team Members — coordinating decisions, communications and recovery during major incidents
  • Third-Party Risk Managers — evaluating critical supplier continuity and substitution arrangements

Skills and tools covered

Business impact analysisRecovery strategy designCrisis response coordinationContinuity exercise designThird-party continuityBCM assurance reporting

Tools and standards

ISO 22301:2019, ISO 22313:2020, Bow-tie analysis, Three Lines Model

How the course runs

Training methodology

The course uses short instructor briefings to establish methods and standards, followed by banking-focused case work, facilitated group analysis and structured planning tasks. Participants analyse disruption scenarios involving payment services, cyber recovery, unavailable premises and supplier failure. Tabletop simulations develop incident assessment, escalation, decision logging and communications skills. Groups review BIA results, recovery options and exercise evidence before preparing an individual application plan. The instructor gives practical feedback on assumptions, recovery objectives, governance and documentation quality.

Requirements and prerequisites

Participants should understand their organisation’s main products, operational processes or support services and have some exposure to risk, incident, operational resilience, technology or control responsibilities. Experience working in banking, payments, insurance or another regulated financial institution is useful because cases focus on critical financial services and outsourced dependencies. No prior certification in business continuity is required. Participants do not need audit training, technical disaster recovery expertise or previous experience leading a crisis response. Familiarity with internal policies and reporting lines will help participants apply the material quickly.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand their business area, services or operational processes and have some exposure to risk, operations, technology or control work. Previous BCM training, crisis management experience and technical disaster recovery expertise are not required.

Bring a laptop if available and, where permitted, non-confidential examples of current continuity plans, BIA forms, incident procedures or supplier requirements. Participants should not bring customer data, security-sensitive material or confidential incident records.

The course is intended for continuity managers, operational risk staff, banking operations leaders, IT service continuity staff, crisis team members and third-party risk professionals. It is particularly relevant to banks, payment firms, insurers and regulated financial institutions.

Operational resilience training focuses on important business services, impact tolerances and wider resilience governance. Disaster recovery training focuses mainly on restoring technology; this course connects business priorities, crisis response, recovery strategies, IT recovery and supplier continuity.

Participants can use the templates and methods to refresh a BIA, assess a critical service dependency, improve a continuity plan or plan an exercise. The final module helps each participant identify immediate actions, owners and management discussions for their own area.

Training runs from 08:30 to 16:30 each day, providing about 6.5 contact hours daily and approximately 32.5 contact hours across five days. Time is divided among instructor briefings, banking cases, group analysis, simulations, documentation work and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Business Continuity