Business continuity planning for supply operations

Impact analysis: what must not stop

Start by identifying the outputs whose interruption would cause disproportionate damage — a regulated product, a contractual service commitment, a customer whose loss would be structural — and work backwards to the sources, facilities, systems and skills each depends on. This produces a prioritised dependency list rather than an inventory of everything the business does, and it is the list against which every subsequent arrangement is justified.

Tolerance and recovery targets

For each priority output, agree how long it may be interrupted before the consequences become severe, and how much has to be restored at the first step. These targets are commercial judgements and belong to business owners, not to the continuity team. They are what convert planning into procurement: an arrangement that restores supply more slowly than the agreed tolerance is not a solution and should be recorded as an accepted exposure.

Arrangements are contracts and reservations, not intentions

A plan that names an alternative site, a standby provider or a reciprocal arrangement is only as good as the commitment behind it. Reserved capacity should be contracted with notice periods and priority stated. Alternative sources should be qualified. Where an arrangement is informal, the plan should say so plainly, because unwritten goodwill tends to evaporate in events that affect several customers of the same provider simultaneously.

Triggers, roles and the first hour

Plans fail at invocation more often than in content. Someone must be named as able to declare that the plan is in force, the criteria should be written, and the first actions should be short and unambiguous. Contact details, standby arrangements and access to the plan itself must survive the loss of the systems the plan is protecting, which is why a copy that only exists on the affected network is not a copy.

Testing turns a document into a capability

A walkthrough discussion finds gaps in logic; a functional exercise finds the ones that matter, such as an expired contact, a standby facility that cannot handle the actual product mix, or a recovery procedure requiring people who all sit in the affected location. Testing on a defined cycle, and after any material change to sites, sources or systems, keeps the plan aligned with an operation that has moved on since it was written.

Frequently asked questions

How is continuity planning different from managing a live disruption?

Continuity planning is the preparation: identifying critical dependencies and buying arrangements in advance. Managing a live event is the execution, which draws on those arrangements but mostly consists of decisions the plan could not anticipate.

Should suppliers be required to have their own continuity plans?

For critical sources, yes, and the requirement is more useful when it asks for specifics — alternative production locations, recovery targets, evidence of testing — than when it asks whether a plan exists. Reviewing those specifics also reveals dependencies your own map had missed.

How often should plans be reviewed?

On a fixed cycle and on change. Site moves, new sourcing arrangements, system replacements and reorganisations all invalidate parts of a plan, and a document reviewed only annually will spend much of the year describing an operation that no longer exists.