Organisational Resilience Training Course

Participants can establish governance roles, policy commitments and management oversight for continuity.

• Board accountability for resilience, risk appetite and disruption tolerance
• Policy statements defining scope, objectives, responsibilities and continual improvement
• Three lines model applied to continuity ownership and independent assurance
• RACI matrices assigning incident, recovery and escalation accountabilities
• Management review inputs, decisions, records and follow-up actions
• Budget cases linking continuity investment to critical service protection

Participants can define continuity scope using organisational context, obligations and stakeholder requirements.

• PESTLE analysis identifying external conditions that intensify disruption exposure
• Interested-party mapping for regulators, customers, communities, staff and insurers
• Legal, contractual and regulatory continuity obligations captured in registers
• Service maps connecting products, processes, sites and delivery channels
• Scope boundaries documented for business units, locations and outsourced activities
• Assumptions and constraints recorded before impact and risk analysis

Participants can map critical services and identify dependencies that constrain recovery.

• Critical service criteria based on safety, statutory duty, revenue and harm
• Value-stream mapping from customer demand through fulfilment and support
• Dependency maps covering people, facilities, technology, data and suppliers
• Single points of failure identified through upstream and downstream analysis
• Interdependencies between business units, shared services and external partners
• Service ownership validated through accountable executive and process-owner interviews

Participants can conduct a business impact analysis and document time-based disruption consequences.

• Business impact analysis methodology, questionnaires, interviews and evidence validation
• Maximum tolerable period of disruption established for critical activities
• Impact categories scored for people, customers, finance, compliance and reputation
• Time-criticality profiles showing escalating impacts after service interruption
• Minimum business continuity objective defined for degraded service delivery
• Resource requirements captured for staff, workspace, systems and information

Participants can set recovery priorities and measurable recovery objectives from impact analysis findings.

• Recovery time objective calculated from maximum tolerable disruption periods
• Recovery point objective matched to data-loss tolerance and transaction volumes
• Recovery sequencing based on safety, statutory obligations and service dependencies
• Minimum service levels specified for manual workarounds and phased restoration
• Priorities reconciled between competing business units through executive decisions
• Recovery objective registers maintained with owners, evidence and review dates

Participants can assess disruption scenarios and select risks requiring continuity treatment.

• ISO 31000 principles applied to continuity-related risk assessment
• Scenario analysis covering cyberattack, flood, pandemic, fire and supplier failure
• Threat, vulnerability and consequence analysis used for disruption pathways
• Bow-tie analysis connecting preventive controls, escalation triggers and recovery barriers
• Risk registers distinguish inherent exposure, controls and residual risk
• Scenario assumptions challenged using historical events and near-miss evidence

Participants can evaluate and select proportionate continuity strategies for critical services.

• Strategy options compared against recovery objectives, cost, feasibility and risk
• Workforce resilience measures: cross-training, succession, relocation and mutual aid
• Alternative site strategies: remote work, reciprocal space and standby facilities
• Technology recovery options: backups, replication, failover and manual processing
• Supplier continuity strategies: dual sourcing, inventory buffers and contractual clauses
• Cost-benefit analysis documents recommended recovery investments and residual exposure

Participants can design an incident management structure with clear authority and escalation routes.

• Incident command roles for strategic, tactical and operational coordination
• Activation criteria based on impacts, thresholds, uncertainty and decision urgency
• Gold, silver and bronze structures adapted to organisational accountabilities
• Incident logs record decisions, actions, timestamps, owners and evidence
• Situation reports communicate verified facts, priorities, risks and resource requests
• Escalation protocols define authority limits, notification triggers and handovers

Participants can prepare crisis communications that support timely, accurate stakeholder engagement.

• Stakeholder communication plans matched to information needs and decision rights
• Holding statements prepared for service interruption, safety incidents and cyber events
• Message mapping aligns facts, empathy, actions and approved spokesperson lines
• Media monitoring identifies misinformation, emerging concerns and reputational exposure
• Regulatory notifications sequenced against legal deadlines and evidence requirements
• Employee communications address safety, attendance, wellbeing and work arrangements

Participants can draft usable business continuity plans for service-level response and recovery.

• Plan architecture separates immediate response, continuity operations and recovery
• Role cards provide actions, authority limits, contacts and escalation triggers
• Call-tree design includes alternates, acknowledgement tracking and update intervals
• Action checklists sequence life safety, stabilisation and critical service restoration
• Plan assumptions, dependencies and exceptions documented for decision-makers
• Document control establishes approval, versioning, access and review requirements

Participants can align business recovery requirements with technology and information recovery arrangements.

• Business requirements translated into disaster recovery service-level targets
• Application dependency mapping identifies infrastructure, interfaces and data dependencies
• Backup strategies assessed for frequency, retention, immutability and restoration testing
• Cyber recovery plans address isolation, forensic preservation and clean restoration
• Manual workarounds controlled through data reconciliation and approval procedures
• Recovery runbooks coordinate business owners, technology teams and vendors

Participants can plan continuity measures for personnel, workplace access and essential resources.

• Personnel availability analysis considers absenteeism, skills concentration and welfare needs
• Remote-working readiness covers equipment, connectivity, supervision and information security
• Site loss scenarios assess access, utilities, security and environmental controls
• Alternative workplace plans specify capacity, activation steps and accessibility requirements
• Essential resource lists include fuel, medical supplies, cash and protective equipment
• Mutual aid agreements define mobilisation conditions, liability and cost recovery

Participants can assess and strengthen continuity arrangements across critical third parties.

• Supplier segmentation ranks vendors by criticality, substitutability and concentration risk
• Due diligence reviews continuity plans, test evidence and recovery commitments
• Contract clauses specify notification, recovery objectives, audit rights and data access
• Supply chain mapping identifies tier-one dependencies and hidden single-source exposures
• Contingency sourcing plans address qualification, quality controls and procurement authority
• Vendor incident protocols coordinate status updates, escalation and joint recovery actions

Participants can connect emergency preparedness with safe continuity and operational recovery decisions.

• Life safety priorities govern continuity decisions during emergency response
• Emergency response plans integrated with evacuation, shelter and accountability procedures
• Hazard registers inform continuity scenarios for chemical release and severe weather
• Occupational health controls address fatigue, psychosocial risks and extended operations
• Environmental incident recovery considers containment, monitoring and regulatory reporting
• Return-to-work criteria require safety verification before service restoration

Participants can design exercises that test plans, decisions and recovery capabilities.

• Exercise objectives linked to specific plans, capabilities and assurance questions
• Tabletop exercises test decisions through timed injects and escalating conditions
• Functional exercises assess command structures, communications and coordination procedures
• Recovery simulations test technology restoration, manual workarounds and reconciliation
• Observer guides capture evidence, decisions, bottlenecks and control failures
• After-action reviews convert findings into owned corrective action plans

Participants can measure continuity performance and manage improvement through assurance processes.

• Key performance indicators measure plan coverage, exercise completion and corrective-action closure
• Key risk indicators track dependency exposure, recovery gaps and supplier assurance
• Internal audit criteria test ISO 22301 conformity and operational effectiveness
• Nonconformities classified by severity, root cause and corrective action
• Lessons-learned registers integrate incidents, exercises, audits and near misses
• Management dashboards present resilience posture, trends and investment decisions

Participants can build engagement approaches that make continuity responsibilities routine and credible.

• Stakeholder analysis identifies sponsors, plan owners, users and resistant groups
• Competence matrices define training needs for incident and recovery roles
• Awareness campaigns reinforce reporting, preparedness and escalation behaviours
• Change impact assessments address workload, process changes and control ownership
• Communities of practice share incident learning and tested recovery techniques
• Annual planning cycles embed continuity reviews into operational governance

Participants can integrate continuity management with risk, security, safety and operational governance.

• Enterprise risk registers connect strategic risks with continuity treatment actions
• Information security incident response aligned with crisis and recovery governance
• Operational resilience tolerances linked to customer, regulatory and safety outcomes
• Insurance requirements reviewed against business interruption and recovery evidence
• Capital investment decisions incorporate resilience benefits and dependency reduction
• Assurance calendars coordinate audits, exercises, reviews and governance reporting

Participants can build, review and present an integrated organisational resilience programme for a defined critical service.

• Programme scope defines critical services, stakeholders, boundaries and planning assumptions
• Business impact analysis establishes priorities, recovery objectives and minimum service levels
• Risk scenarios justify selected continuity strategies and residual risk decisions
• Response arrangements combine incident command, communications and recovery plan procedures
• Exercise and assurance schedules demonstrate testing, metrics and corrective-action governance
• Peer review challenges feasibility, accountability, evidence and investment rationale