Business Continuity Planning and Crisis Response Fundamentals Training Course

Course overview

Business continuity failures are rarely caused by a missing document alone. They occur when critical activities, dependencies, recovery priorities and decision rights have not been tested under realistic disruption. For health, safety and environment functions, a prolonged outage can interrupt emergency communications, monitoring, waste management, regulatory reporting, contractor control and access to vital records. This course equips participants to convert operational knowledge into an organised continuity capability that can withstand incidents ranging from IT disruption and facility loss to severe weather, supply interruption and public-health events.

Participants learn the core business continuity planning cycle: establishing scope and governance, conducting a business impact analysis (BIA), identifying threats and dependencies, setting maximum tolerable periods of disruption and recovery time objectives, and selecting proportionate recovery strategies. They develop practical continuity plans, crisis response procedures, contact and escalation arrangements, communications protocols, exercise scenarios and review processes. The course aligns these activities with ISO 22301 and connects continuity planning with emergency response, incident management, HSE controls and organisational resilience.

Instruction combines short technical briefings with facilitated planning workshops, scenario-based decisions and peer review of plan content. Working from a realistic operational disruption case, participants build a usable business continuity planning pack containing a BIA worksheet, prioritised recovery requirements, continuity strategy options, crisis response checklist, communications matrix and exercise plan. The final day focuses on applying the pack to the participant's own function or site, giving both the attendee and sponsoring manager a clear route from course learning to workplace implementation.

Course objectives

By the end of this course, participants will be able to:

• Conduct a business impact analysis using critical-activity, dependency, impact and recovery-target worksheets
• Define maximum tolerable periods of disruption, recovery time objectives and recovery point objectives for priority services
• Map people, premises, technology, supplier and information dependencies using a continuity dependency map
• Evaluate disruption scenarios with a likelihood-impact assessment and prioritise continuity treatment actions
• Draft a business continuity plan with activation criteria, recovery actions, roles, contacts and stand-down procedures
• Create a crisis response escalation and communications matrix for internal, regulator, customer and media stakeholders
• Design and facilitate a tabletop continuity exercise using injects, observer notes and an after-action review template
• Build a corrective-action register that links exercise findings to plan updates, owners and review dates

Benefits of attending

Target competencies

Who should attend

• Business Continuity Coordinators — who need to establish or improve practical plans across functions or sites
• HSE Managers — who must connect continuity arrangements with emergency preparedness, regulatory obligations and operational controls
• Operations Managers — who own critical processes, recovery priorities and resource decisions during disruption
• Risk Managers — who need to translate risk assessments into tested resilience and recovery measures
• Facilities Managers — who must prepare for loss of premises, utilities, access and essential building services
• IT Service Managers — who support recovery objectives, system dependencies and coordinated incident-to-crisis escalation

Requirements and prerequisites

Participants should have working familiarity with their organisation's services, processes, sites or departmental responsibilities and be able to describe key stakeholders, suppliers and operational dependencies. Awareness of basic risk assessment concepts, such as likelihood, consequence and controls, is helpful, as is access to an existing emergency plan, incident procedure or process map where available. No prior business continuity qualification, ISO 22301 implementation experience or specialist crisis-management software is required. A complete beginner can attend, but should expect to work with operational scenarios and simple spreadsheet-based planning templates throughout the week.

Training methodology

The course is delivered through instructor-led explanations of continuity standards and methods, followed by guided application to an operational disruption case. Participants complete BIA fields, dependency maps, recovery-option assessments, activation checklists and communications matrices in small groups. Crisis simulations use timed injects such as facility loss, cyber outage and supplier failure to practise decisions under pressure. Instructors review draft plans against ISO 22301 expectations and provide practical feedback. The week closes with individual application planning, identifying the first BIA, stakeholder meeting and exercise each participant will run at work.

Course outline

Day 1: Continuity foundations, scope and governance

• Business continuity, emergency response and crisis management distinctions
• ISO 22301 business continuity management system structure
• Continuity policy, scope statement and programme governance
• Critical products, services and enabling activities
• Roles of plan owner, incident manager, crisis team and recovery lead
• Continuity interfaces with HSE, security, IT disaster recovery and suppliers
• Document control, review cycles and continuity evidence requirements

Workshop: Participants create a continuity scope statement and governance map for a simulated multi-site operation.

Day 2: Business impact analysis and dependency mapping

• Business impact analysis interview planning and stakeholder selection
• Time-based impact categories for safety, regulatory, financial and customer consequences
• Maximum tolerable period of disruption determination
• Recovery time objective and recovery point objective setting
• Minimum business continuity objective and minimum resource requirements
• People, premises, technology, information and supplier dependency mapping
• BIA validation, challenge questions and executive sign-off

Workshop: Participants complete and defend a BIA worksheet and dependency map for a critical operational service.

Day 3: Risk assessment and recovery strategy selection

• Disruption scenario identification and threat-source analysis
• Likelihood-consequence assessment for continuity threats
• Single points of failure and concentration-risk analysis
• Recovery strategy options for people, premises, technology and supply
• Alternate-site, remote-working and manual-workaround strategies
• Supplier continuity requirements and third-party recovery commitments
• Cost, feasibility and residual-risk comparison of recovery options

Workshop: Teams assess three disruption scenarios and produce a prioritised recovery strategy recommendation with assumptions and residual risks.

Day 4: Plan development and crisis response coordination

• Business continuity plan architecture and section design
• Plan activation triggers, authority levels and notification cascades
• Initial incident assessment and crisis escalation criteria
• Crisis management team roles, decision logs and situation reports
• Stakeholder communications matrices and message approval routes
• Operational recovery task lists, resource requests and status tracking
• Stand-down, transition to normal operations and post-incident review

Workshop: Participants draft an activation checklist, crisis communications matrix and first-24-hours recovery action plan for a facility outage.

Day 5: Exercising, assurance and workplace implementation

• Tabletop, walkthrough, simulation and live exercise formats
• Exercise objectives, scenario narratives, injects and facilitator guides
• Observer roles, evidence capture and performance criteria
• After-action review methods and root-cause questioning
• Corrective-action registers, ownership and target-date management
• Internal audit checks against ISO 22301 continuity requirements
• Ninety-day continuity implementation roadmap and management reporting

Workshop: Participants run a timed tabletop exercise, complete an after-action review, and produce a 90-day improvement roadmap for their own area.

Tools & standards covered

ISO 22301:2019, ISO 22313:2020, ISO 22361:2022, Microsoft Excel

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions