Day 1: Operational Risk Map and Critical Activities

Sources of Operational Risk

• Classify people, process, system, external-event sources
• Connect risk with service flow dependencies
• Distinguish incidents from persistent control weakness
• Build event register for operating area

Loss Data and Indicators

• Collect financial and nonfinancial losses consistently
• Analyze event frequency, severity, time trends
• Use KRIs to anticipate deteriorating conditions
• Select indicators for a specific bottleneck

Applied Critical Dependencies

• Identify essential people, systems, suppliers, locations
• Expose failure points within service delivery
• Map dependencies between supporting and processes
• Create dependency map for critical service

Day 2: Business Impact Analysis and Recovery Objectives

BIA Scope and Impact Criteria

• Define products/services included in analysis
• Assess financial regulatory and reputational impact
• Recognize impact changes as disruptions lengthen
• Design a common enterprise impact scale

Selecting Recovery Priorities

• Determine maximum tolerable periods of disruption
• Set RTO from business, not technology
• Define RPO for data and services
• Calibrate objectives across interdependent units

Minimum Resources for Continuity

• Estimate minimum people, locations, technology needs
• Differentiate continuity resources from full recovery
• Connect resource needs with recovery times
• Prepare resource profile for priority service

Day 3: Continuity and Recovery Strategies

Operational Continuity Options

• Select alternative sites, suppliers, operating methods
• Balance cost against required recovery time
• Avoid strategies sharing vulnerable dependencies
• Design alternatives for a site-loss scenario

Technology and Data Recovery

• Connect RTO/RPO with technology capability
• Select backup and redundancy by criticality
• Define technology-business handoffs between teams
• Review recovery plans failing business objectives

Applied Supplier Continuity

• Identify suppliers supporting priority activities
• Assess supplier plans, capabilities, dependency locations
• Establish alternatives and notification requirements
• Prepare a third-party continuity assessment

Day 4: Plans, Crisis Management, and Disruption Communication

Building Usable Plans

• Write procedures by role and phase
• Set activation criteria and responsible authority
• Include contacts resources and approved alternatives
• Convert lengthy plan into response guide

Crisis Leadership and Escalation

• Separate incident management from crisis leadership
• Set escalation briefing and decision cadence
• Maintain decision rationale log under ambiguity
• Simulate a crisis-team meeting

Improving Stakeholder Communication

• Select messages for employees, customers, suppliers
• Coordinate operational content with public communication
• Avoid unverified recovery commitments during disruption
• Draft a concise disruption update

Day 5: Testing, Improvement, and BCMS Governance

Exercise and Testing Program

• Progress from tabletop to demanding simulations
• Select scenarios exposing specific dependencies
• Define success objectives and observable evidence
• Build a balanced annual exercise plan

Results Evaluation and Improvement

• Separate plan defects from participant performance
• Prioritize actions affecting RTO achievement
• Close weaknesses using verifiable evidence
• Write an after-exercise report

Continuity Management System Governance

• Link ISO 22301 with policy roles
• Define readiness indicators for senior management
• Trigger review following material operational change
• Develop improvement roadmap for continuity system

• BIA exercises establishing impact priorities and recovery objectives
• Disruption scenarios connecting operational risk with continuity
• Crisis simulations requiring staged decisions and communication
• Exercise-program design aligned with ISO 22301 principles