How do risk management, BCP and recovery fit together?

Risk management asks what could affect the organisation and how it should be addressed. Business continuity asks which activities must continue and under what arrangements. Recovery asks how affected activities can be restored. Treat these as connected responsibilities, with shared information and clear ownership.

A risk assessment and a business impact analysis serve different purposes. The assessment examines risks and controls. The impact analysis examines how the effects of an interruption develop over time, helping the organisation decide what to recover first and which dependencies need attention. Recovery priorities should reflect those operational needs, rather than the order in which teams happen to become available.

Document the handovers between emergency response, crisis coordination and recovery. The phases can overlap: a team may be protecting people while another is assessing recovery options. A common status report supports a shared picture without replacing the decisions and responsibilities in each plan.

• Agree who activates each plan and when escalation is required.
• Share current contacts, dependencies, priorities and decision records.
• Exercise the complete journey and track improvements to completion.

Web adaptation based on Mastering Business Continuity in an Uncertain World, Rudy Clonen, 2025, pages 17–18, 50–51. The original book is in English. This article offers a starting point for discussion; the approach should be adapted to the organisation and the assignment.