7 Essential Business Continuity and Crisis Management Strategies
Disruption rarely respects organisational boundaries. A technology outage can stop customer service, interrupt payments, delay suppliers and trigger reputational pressure within hours. A continuity plan stored on a shared drive will not control that situation unless people understand the priorities, authority, dependencies and decisions behind it.
Business continuity and crisis management address different but connected needs. Business continuity protects the delivery of prioritised activities at an acceptable level. Crisis management provides the strategic leadership, coordination and communication required when an incident creates exceptional uncertainty or consequences. Organisations need both: continuity arrangements without crisis leadership can become fragmented, while crisis leadership without workable recovery options has little operational leverage.
The following seven strategies form a practical system for preparing, responding and improving. They apply across disruption causes because they begin with business impact rather than a list of individual threats.
Life-safety and emergency procedures remain essential, but they do not replace continuity arrangements. Evacuation may protect people during the first minutes of an incident; continuity planning determines how priority services will operate afterwards, and crisis management addresses consequences that threaten the organisation’s objectives or legitimacy.
Connect continuity planning with crisis leadership
Business continuity should not be treated as an emergency document owned by one specialist. It is a management capability that connects risk, operational resilience, incident response, technology recovery, supply arrangements, people and communications.
The ISO 22301 business continuity management systems standard provides a framework for organisations to establish, implement, operate, monitor, review, maintain and continually improve continuity arrangements. Whether or not an organisation seeks certification, the management-system logic is valuable: understand the context, assign leadership, plan controls, exercise them, evaluate performance and improve.
Crisis management sits above individual recovery plans when the disruption requires enterprise-level choices. It considers the wider consequences, sets strategic priorities and protects stakeholder confidence. A routine incident can become a crisis if its scale, duration, uncertainty or public impact exceeds normal management arrangements. Activation criteria should reflect those conditions rather than depend only on the technical cause.
Seven strategies for operational continuity and crisis control
1. Define governance, authority and activation criteria
Name an executive sponsor, continuity programme owner, plan owners and the members of the crisis management team. Define their responsibilities before disruption occurs. The structure should distinguish strategic decisions from tactical coordination and operational recovery, while keeping communication between all three levels.
Document who can activate and deactivate plans, incur emergency expenditure, suspend a service, move staff, invoke suppliers and approve external statements. Include deputies for critical roles and make sure authority remains available outside normal working hours.
Activation criteria should use observable thresholds: loss of a critical site or system, forecast breach of a recovery objective, serious harm, regulatory exposure, sustained supplier failure or rapidly increasing media interest. Clear thresholds reduce hesitation without removing professional judgement.
Keep role cards and contact arrangements short enough to use under pressure. The governance design should also address fatigue and shift handovers; a response structure that relies on the same small group for an extended incident is not resilient.
2. Use business impact analysis to set recovery priorities
A business impact analysis (BIA) identifies which activities must be recovered first and what happens as disruption continues. Assess impacts over time across customers, safety, finance, regulation, operations, reputation and contractual commitments.
For each prioritised activity, define the maximum tolerable period of disruption, the recovery time objective (RTO) and, where data is involved, the recovery point objective (RPO). These are not arbitrary IT targets. They should reflect business impact and be reconciled with technical and operational capability.
Map dependencies on people, premises, technology, information, suppliers, utilities and other internal processes. Consider concentration risk: two apparently different services may rely on the same identity platform, specialist employee or third party. The BIA should produce a defensible recovery sequence, not a catalogue in which every activity is labelled critical.
Agree the minimum acceptable level of delivery during disruption as well as the desired restoration time. This prevents teams from assuming that “recovered” always means full normal capacity and helps them design staged recovery that is realistic with constrained resources.
3. Design recovery strategies before writing procedures
A plan cannot create capabilities that do not exist. First decide how prioritised activities could continue or recover within their objectives. Options may include alternative premises, remote working, manual workarounds, redundant technology, data restoration, reciprocal arrangements, stock buffers, substitute suppliers or temporary service reductions.
Evaluate each option for time, capacity, cost, safety, security and sustainability. A workaround that supports 20 per cent of normal demand may be sufficient if the minimum acceptable service has been agreed. An alternative supplier is not a recovery strategy until commercial terms, access, specifications and mobilisation time have been tested.
Then write concise procedures around selected capabilities. Specify triggers, actions, owners, inputs, contact routes and exit conditions. Plans should be usable when normal systems, buildings or personnel are unavailable.
Recovery options must also address the return to normal operations. Temporary manual processes can create backlogs, duplicate records and control gaps that remain after the immediate incident. Define how accumulated work will be reconciled and who accepts the residual risk.
4. Establish command, control and situational awareness
During a crisis, teams need a common operating picture. Establish an incident log, decision log, action tracker and a regular meeting rhythm. Record confirmed facts separately from assumptions and unverified reports. This reduces conflicting narratives and preserves the rationale for important decisions.
The crisis team should repeatedly ask: What has happened? What is the current impact? What could change next? Which objectives are at risk? What decisions are required now? Assign actions with owners and deadlines rather than ending meetings with general intentions.
Avoid drawing the strategic team into every operational detail. Recovery leads need room to execute agreed procedures, while leaders focus on priorities, trade-offs, stakeholder consequences and decisions beyond delegated authority. LOTC’s related article on strategic resilience and crisis governance explores that leadership perspective.
For prolonged disruption, establish shift patterns, handover standards and welfare support. Decision quality declines when key people remain continuously engaged, and incomplete handovers can cause repeated work or contradictory instructions.
5. Prepare crisis communication as an operational capability
Communication must serve employees, customers, suppliers, regulators, emergency services, owners and the media without creating inconsistent promises. Identify each audience, what it needs to know, who owns the relationship and which channel remains available if primary systems fail.
Prepare approval routes, spokesperson arrangements, holding statements and secure contact lists. A useful first message acknowledges the situation, explains known impact, states what is being done and confirms when the next update will follow. Do not speculate or communicate certainty that the evidence does not support.
Internal communication deserves equal attention. Employees need instructions, safety information and a route for reporting operational intelligence. Monitor questions and sentiment because gaps between official messages and lived experience can damage trust.
Coordinate communications with legal, regulatory, cyber, safety and operational teams, but avoid an approval chain so slow that silence fills the information gap. Pre-agreed authority and templates allow timely communication while material facts are still being verified.
6. Exercise plans, teams and dependencies together
Reading a plan is not a test. Use a progressive exercise programme: walkthroughs to check logic, tabletop exercises to test decisions, simulations to practise coordination and technical tests to validate recovery capabilities. Include relevant suppliers and partners where the service depends on them.
Set explicit exercise objectives and use realistic injects, including incomplete information, competing priorities and secondary failures. The UK Government’s exercising best-practice guidance provides a baseline for integrating exercises into organisational resilience activity.
Assess whether teams met recovery needs, communicated effectively and used authority correctly. The purpose is not to demonstrate that the plan works; it is to discover weaknesses safely before a real disruption exposes them.
Use observers and evidence rather than impressions alone. Record decision times, missed dependencies, information delays and recovery results. A psychologically safe debrief will reveal more than an exercise designed to make senior leaders appear successful.
6. Exercise plans, teams and dependencies together
Reading a plan is not a test. Use a progressive exercise programme: walkthroughs to check logic, tabletop exercises to test decisions, simulations to practise coordination and technical tests to validate recovery capabilities. Include relevant suppliers and partners where the service depends on them.
Set explicit exercise objectives and use realistic injects, including incomplete information, competing priorities and secondary failures. The UK Government’s exercising best-practice guidance provides a baseline for integrating exercises into organisational resilience activity.
Assess whether teams met recovery needs, communicated effectively and used authority correctly. The purpose is not to demonstrate that the plan works; it is to discover weaknesses safely before a real disruption exposes them.
Use observers and evidence rather than impressions alone. Record decision times, missed dependencies, information delays and recovery results. A psychologically safe debrief will reveal more than an exercise designed to make senior leaders appear successful.
7. Maintain evidence, learn and improve
Continuity arrangements deteriorate as staff, systems, premises, suppliers and services change. Assign review dates and event-based triggers such as major organisational change, a new critical supplier, a material incident or a failed exercise.
After an exercise or disruption, conduct a structured review that separates observation from cause. Convert lessons into corrective actions with owners, deadlines and evidence of completion. Update BIAs, strategies, procedures and training rather than filing the review as a standalone report.
Use a small set of capability measures: completion of BIAs, plan currency, exercise coverage, corrective-action closure, recovery-test results and performance against objectives. Counting the number of documents produced does not demonstrate readiness.
Report material gaps to the same governance forum that approves risk and investment priorities. Where recovery capability remains below the required objective, leaders should explicitly fund improvement, reduce exposure or accept the risk rather than leaving the gap undocumented.
Build continuity capability with LOTC
Effective business continuity and crisis management is not measured by the length of a plan. It is demonstrated when an organisation can protect critical outcomes, make timely decisions, communicate credibly and recover within limits that have been understood and tested.
At London Optimum Training & Consultancy (LOTC), professionals and organisations can develop the practical judgement required to build and operate these capabilities. LOTC’s Business Continuity and Crisis Management course covers risk assessment, business impact analysis, continuity strategies, recovery objectives, incident response, crisis communication, exercising and continual improvement.
To discuss the course or a tailored organisational programme, contact LOTC or message the team on WhatsApp at 07553 430145.