Most organisations that have a continuity plan do not have a business impact analysis, and the plan shows it. It protects what is visible — the server room, the head office — rather than what is load-bearing, because nobody established which activities actually carry the products that pay for everything else.
That is the whole job of the analysis, and it is narrower than it sounds. Not "what could go wrong", which is risk assessment and a different question. It asks: if this activity stopped, what would it cost at one hour, one day, one week, one month — and at what point does the loss stop being recoverable. The answer is a curve, not a number, and the shape of it sets the priorities.
The curve is where intuition is usually wrong. Two activities that feel equally important diverge sharply once plotted: one degrades gently for a fortnight, the other breaches a contractual or regulatory limit on the second day. Without the curve both get the same attention, which means the second is under-protected and the first over-protected, and the money spent on it was spent twice over on the wrong thing.
Then come the dependencies, and this is where plans quietly break. An activity is rarely stopped by its own failure. It is stopped by a system, a supplier, a building or one person it depends on — and a plan that restores the activity while leaving the dependency down restores nothing. The dependency most often missed is the person: the one who knows the sequence, holds the credentials, has the relationship with the supplier. An organisation chart does not show that, and a plan drawn from the chart assumes it away.
Which leads to the test that separates a real plan from a filed one. Exercising a plan does not mean reading it in a room. It means attempting one recovery for real — restoring one system from backup, running one process the alternative way — and writing down what did not work. A first restore attempt almost always surfaces something: media that will not read, a procedure that assumes a system already up, a password in the head of somebody on leave. Finding that in an exercise costs an afternoon. Finding it in an incident costs the thing the plan was written to protect.
The order matters more than the paperwork. The analysis first, because it decides what the plan is for; the plan second; the exercise third, because it is the only part that tells you whether either of the first two was true.
If your sole supplier for the most critical input stopped for two weeks, after how many days does production stop — and who has that written down?