Business Resilience Management Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Business Continuity Managers, Risk Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-BC-020

Before you join: Participants should understand their organisation's main products, services, operating sites and critical dependencies.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Business disruption rarely arrives as a single, contained event. A cyber outage can stop patient appointments; flood damage can isolate a distribution depot; civil unrest can disrupt staff travel and cash access; a critical supplier failure can halt production. Leaders need defensible decisions about priorities, tolerable downtime, customer commitments, safety, communications and recovery funding while facts remain incomplete. Business resilience management turns continuity plans from static documents into managed capabilities that protect people, essential services, regulatory duties and organisational viability.

This course develops the methods expected of professionals responsible for advanced business resilience. Participants conduct business impact analysis, set recovery objectives, map dependencies, assess disruption risks and select recovery strategies. They build incident and crisis arrangements, address supplier and technology dependencies, test plans through structured exercises and convert findings into funded improvement actions. The course also examines operational resilience concepts, including important business services, impact tolerances and severe-but-plausible scenario testing.

Teaching combines concise instructor briefings with sector-based case work, facilitated group analysis, crisis simulations and planning sessions. Cases reflect issues faced by banks, public bodies, healthcare providers, manufacturers, NGOs and service organisations. Participants leave with a structured resilience management starter pack: a business impact analysis template, recovery strategy evaluation model, crisis governance framework, exercise design pack, supplier continuity checklist and 90-day implementation plan.

The course suits continuity practitioners moving beyond basic plan writing, as well as managers who own critical services, technology recovery, facilities, risk, security or supplier assurance. It is particularly relevant where an organisation must demonstrate that recovery arrangements are governed, tested, measurable and aligned with service priorities.

What you will be able to do

  • Conduct a business impact analysis using recovery objectives, impact categories and dependency mapping
  • Apply ISO 22301 requirements to establish business continuity governance and assurance arrangements
  • Assess disruption scenarios using ISO 31000, bow-tie analysis and residual risk statements
  • Select recovery strategies using cost, capacity, recovery time and dependency criteria
  • Design incident, crisis and continuity plans with clear activation authorities and communications routes
  • Map important business services and define impact tolerances for operational resilience
  • Plan and evaluate tabletop exercises and simulations using injects, evidence logs and corrective actions
  • Produce a phased resilience improvement roadmap with ownership, milestones and management reporting

Benefits of attending

For you

  • Build confidence presenting recovery priorities and resilience investment cases to senior management
  • Produce defensible business impact analyses rather than relying on generic continuity assumptions
  • Lead structured crisis exercises with clear objectives, injects, evidence and follow-up actions
  • Assess supplier, facility and technology dependencies that could undermine recovery plans
  • Create a practical 90-day plan for improving resilience arrangements in a current role

For your organisation

  • Clearer recovery priorities for critical services, customers, regulatory obligations and safety commitments
  • Better alignment between business recovery objectives and technology restoration capabilities
  • Reduced exposure from untested supplier, fourth-party and concentration dependencies
  • More consistent crisis decisions through defined authority levels, reporting and communications procedures
  • Auditable evidence of testing, corrective actions and management review for continuity assurance

Course modules

10 modules over 5 days

Participants can establish governance, policy and assurance arrangements for a business continuity management system.

  • ISO 22301 clauses, terminology and management-system intent for business continuity
  • Distinguishing business continuity, crisis management, emergency response and operational resilience
  • Governance accountabilities using the three lines model and RACI matrices
  • Resilience policy objectives linked to risk appetite and strategic priorities
  • Assurance evidence required for executive oversight, audit and certification
  • Programme maturity assessed against ISO 22301 requirements and improvement actions

Participants can conduct and validate a business impact analysis that sets recovery priorities.

  • Business impact analysis scope, assumptions, interview design and validation criteria
  • Process maps identifying products, services, dependencies and handoffs
  • Maximum acceptable outage, RTO, RPO and minimum business continuity objective
  • Impact categories covering safety, customers, finance, regulation, reputation and environment
  • Dependency mapping for people, facilities, technology, information and third parties
  • Prioritisation using recovery time objectives and resource requirements

Participants can assess disruption risks and create scenarios that test meaningful recovery assumptions.

  • ISO 31000 risk process applied to disruption scenarios and controls
  • Bow-tie analysis linking threats, preventive controls, consequences and recovery barriers
  • Scenario design using likelihood, velocity, duration and geographic spread
  • Single points of failure identified through dependency and concentration analysis
  • Risk treatment options: avoid, reduce, transfer, accept and prepare
  • Residual risk statements escalated through defined governance thresholds

Participants can evaluate and recommend recovery strategies for people, sites, technology and suppliers.

  • Recovery strategies compared by cost, time, capacity and residual exposure
  • Work-area recovery options: remote work, split teams, reciprocal and alternate sites
  • Technology recovery tiers aligned with RTO, RPO and system dependencies
  • Manual workarounds designed with controls, forms, staffing and reconciliation
  • Supplier continuity requirements embedded within contracts, due diligence and monitoring
  • Recovery resource assumptions tested against prolonged disruption scenarios

Participants can structure continuity arrangements with clear activation, command and communications procedures.

  • Plan architecture separating incident, crisis, continuity and recovery procedures
  • Incident escalation thresholds, activation authority and decision logs
  • Crisis management team roles, meeting cadence and action tracking
  • Command structures using Gold-Silver-Bronze principles and span-of-control limits
  • Communications matrices for employees, customers, regulators, media and suppliers
  • Plan content controlled through ownership, versioning and review cycles

Participants can support crisis leadership decisions and communications during uncertain, fast-moving events.

  • Situational awareness built from verified intelligence, assumptions and reporting rhythms
  • Initial crisis assessment using life safety, service impact and escalation criteria
  • Decision-making under uncertainty using OODA loops and pre-agreed authorities
  • Stakeholder messaging aligned to facts, empathy, obligations and approval routes
  • Media and social-media monitoring integrated into crisis communications
  • Ethical decisions balancing employee welfare, customer commitments and public interest

Participants can define important business services and assess whether disruption remains within agreed tolerances.

  • Important business services defined through customer outcomes and harm tolerances
  • Impact tolerances expressed as time, volume, value and affected population
  • Service mapping connects people, processes, technology, facilities and information
  • Severe-but-plausible scenarios test disruption beyond normal contingency assumptions
  • Vulnerability remediation prioritised by harm, substitutability and recovery complexity
  • Operational resilience reporting distinguishes service resilience from plan completion

Participants can identify and manage continuity exposure arising from critical suppliers and fourth parties.

  • Critical supplier segmentation using dependency, substitutability, concentration and exit difficulty
  • Contract clauses specify notification, recovery objectives, testing and audit rights
  • Fourth-party dependencies mapped for cloud, logistics and payment services
  • Supplier disruption playbooks cover alternatives, allocation and customer commitments
  • Financial-health and geographic-risk indicators trigger supplier contingency decisions
  • Exit plans address data return, transition support and service continuity

Participants can design, facilitate and evaluate resilience exercises that produce measurable improvements.

  • Exercise objectives derived from risks, plans, assurance needs and decisions
  • Tabletop scenarios test escalation, communications, prioritisation and executive judgement
  • Simulation control uses injects, observers, evidence logs and time jumps
  • Test results classified by findings, actions, owners and due dates
  • Corrective-action plans tracked through root-cause analysis and management review
  • Metrics cover exercise completion, recovery performance, action closure and readiness

Participants can manage recovery learning and build a phased plan for resilience improvement.

  • Recovery governance coordinates stabilisation, restoration, resumption and return-to-normal decisions
  • Damage assessment distinguishes immediate containment from recovery resource commitments
  • Recovery sequencing balances safety, service priorities, dependencies and cash constraints
  • Post-incident reviews use timelines, contributory factors and lessons identified
  • Lessons converted into funded actions, plan changes and control improvements
  • Management review evaluates performance, audit results, changes and improvement priorities
  • Resilience roadmap sequences governance, analysis, strategy, plans, testing and assurance
  • Personal application plan assigns first ninety-day resilience management actions

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Business impact analysis template
  2. Recovery strategy evaluation matrix
  3. Crisis governance and activation framework
  4. Operational resilience service-mapping model
  5. Exercise design and corrective-action pack
  6. Ninety-day resilience implementation plan

Who should attend

  • Business Continuity Managers — responsible for strengthening continuity programmes, plans and testing
  • Risk Managers — need to connect disruption risk assessments with recovery capability
  • Operational Resilience Leads — define important services, impact tolerances and scenario testing
  • Crisis Management Team Members — require clear command structures and decision processes
  • IT Service Continuity Managers — align technology recovery with business recovery requirements
  • Supplier and Procurement Managers — manage continuity exposure within critical third-party arrangements

Skills and tools covered

Business impact analysisRecovery strategy designCrisis managementOperational resilienceSupplier continuityExercise assurance

Tools and standards

ISO 22301, ISO 22313, ISO 31000, Bow-tie analysis

How the course runs

Training methodology

The course uses short instructor briefings to establish methods and standards, followed by case-based analysis of realistic disruption events. Participants work in groups to complete business impact, dependency, strategy and crisis decision tasks. Tabletop and simulation activities test escalation, communications, recovery priorities and executive judgement under time pressure. Facilitated reviews connect exercise evidence to corrective-action planning. Individual application planning helps participants adapt the course methods to their own services, sites, suppliers and governance arrangements.

Requirements and prerequisites

Participants should understand their organisation's main products, services, operating sites and critical dependencies. Prior experience of risk management, emergency response, IT service management, internal audit or business continuity planning is useful. The course assumes participants can read policies, interpret process information and contribute to management discussions about priorities and risk. No formal business continuity qualification is required. Participants do not need prior experience of ISO certification audits, crisis leadership or technical disaster recovery engineering.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants should understand their organisation's key services, dependencies and operating model. Experience in continuity, risk, operations, security, technology, facilities or supplier management is useful, but a formal qualification is not required.

Participants should bring a laptop if possible and may bring non-sensitive examples of current plans, impact analyses or exercise reports. Course materials provide the templates needed for all classroom and live-online activities.

It is designed for practitioners and managers who already have some responsibility for critical services, continuity planning, risk, crisis arrangements or recovery capabilities. It also suits leaders overseeing resilience improvement programmes or assurance requirements.

Emergency response training focuses on immediate life safety and site incidents, while basic continuity training often focuses on plan development. This course addresses governance, impact analysis, recovery strategy, operational resilience, supplier exposure, exercising and improvement management.

Participants can use the course templates to review recovery objectives, identify dependency weaknesses and improve exercise programmes. The final application plan identifies practical actions for the first ninety days after the course.

Training runs from 08:30 to 16:30 each day, providing about 6.5 contact hours daily. Time is divided between instructor briefings, case analysis, group tasks, simulations, feedback and individual application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Business Continuity