Here is a question that tends to produce a long silence. If the sole supplier of your most critical input stopped for two weeks, after how many days does production stop — and who has that written down?
The silence is the finding. Not because nobody has thought about it, but because the answer lives in several heads and no document. The continuity plan, meanwhile, is thorough about evacuation, fire, assembly points and the alternate office nobody has visited.
That imbalance has a cause. Continuity planning is usually assigned to whoever owns facilities or HSE, and they plan the disruptions they can see: the ones that affect the building. The disruptions that actually halt an operation are usually commercial or technical — a single-source raw material, one bespoke machine with a six-week lead time on a part, a legacy system only one contractor can restore, a licence renewal nobody tracked.
A business impact analysis is the unglamorous instrument that finds them. It works backwards from what the organisation cannot afford to lose rather than forwards from what might go wrong: which outputs matter, how long each can stop before the consequence becomes severe, and what each one actually depends on. The dependencies are where it gets uncomfortable, because they are rarely what the org chart suggests.
A plan that has not been exercised is a document, not a capability — and the exercise that teaches the most is not the full-scale drill. It is the tabletop where somebody asks who is authorised to approve an emergency purchase at two in the morning, and the room discovers it does not know.
If your sole supplier for the most critical input stopped for two weeks, after how many days does production stop — and who has that written down?