Skip to content

Strategic Business Leader · Managing, monitoring and mitigating risk

Risk Mitigation Through Business Continuity and Crisis Planning

Updated 11 October 2026 · Fact-checked

Business continuity and crisis planning limit the damage when a risk event happens. A contingency plan covers a specific event, a business continuity plan keeps critical activities running, and a crisis plan sets who decides, who communicates and how the organisation recovers. In SBL, you apply them to the scenario.

Understand Risk Mitigation Through Business Continuity and Crisis Planning

Risk mitigation means reducing the likelihood or the impact of a risk. Controls such as policies and checks mainly cut likelihood. Business continuity and crisis planning work on impact. They assume something will go wrong and prepare the response in advance.

A contingency plan is a prepared response to a specific event, such as a supplier failing or a key system going down. It follows an "if this happens, we do this" logic. A business continuity plan (BCP) is wider. It identifies the critical activities the organisation must keep running, sets how quickly they must be restored, and arranges the people, premises, systems, suppliers and data needed to do that.

A crisis management plan deals with the event that threatens the organisation's reputation, survival or stakeholders. It sets up a crisis team, gives clear authority to decide quickly, and controls communication to staff, customers, regulators, investors and the media. Disaster recovery is a narrower part of continuity. It restores IT systems and data.

Good planning starts with a business impact analysis. You find which activities matter most, what an interruption would cost, and how long the business can tolerate it. Plans are then written, communicated, tested through exercises and reviewed. An untested plan is a weak control.

Boards own this. Continuity and crisis planning link to risk appetite, governance, stakeholder trust and ethics. A slow, evasive or dishonest response can turn an operational problem into a reputation crisis. In SBL, strong answers tie the plan to the specific scenario and its stakeholders.

Key rules to remember

Mitigation focus
Risk = Likelihood × Impact. Controls mainly reduce likelihood. Continuity and crisis plans mainly reduce impact.
Use it to explain why planning is still needed even when controls exist.
Plan hierarchy
Contingency plan (specific event) → Business continuity plan (critical activities) → Crisis management plan (organisation-threatening event)
Use the terms precisely. They overlap but are not identical.
Business impact analysis questions
Which activities are critical? What is the cost of interruption? How long can the business tolerate it? What resources restore it?
These questions structure most BCP answers.
Plan life cycle
Analyse → Design → Communicate → Test → Review and update
Examiners often reward comments on testing and review.

How to solve Risk Mitigation Through Business Continuity and Crisis Planning questions

Use this method for any SBL requirement on mitigating risk through continuity or crisis planning.

  1. 1Read the requirement. Note whether you must explain, evaluate, recommend or advise the board.
  2. 2Identify the risk event or events in the scenario and what they threaten: operations, people, data, reputation or finance.
  3. 3List the critical activities and the stakeholders affected, such as customers, staff, suppliers, regulators and investors.
  4. 4Match the response to the need: contingency plan for a specific event, continuity plan for critical activities, crisis plan for a threat to reputation or survival.
  5. 5Give specific measures from the scenario, such as alternative suppliers, backup sites, data backups, a crisis team and a communication plan.
  6. 6Add governance points: who owns the plan, how it is tested, how it is reviewed and how it fits risk appetite.
  7. 7Weigh cost against benefit and note limits, such as plans going out of date or staff not knowing them.
  8. 8Finish with a clear recommendation in the format asked, for example a briefing note to the board.

Quickest way: Event, Activity, People, Message, Test

When to use it: Use it when time is short and you need a structured answer quickly.

  1. Event: name the likely risk event in the scenario.
  2. Activity: state which critical activities must carry on and how fast they must restart.
  3. People: say who leads, who is on the crisis team and who has authority to decide.
  4. Message: set out who is told what and when, covering staff, customers, regulators and media.
  5. Test: close with testing, review and cost-benefit, then a recommendation.

Common mistakes in Risk Mitigation Through Business Continuity and Crisis Planning

  • Listing generic plan features with no link to the scenario.

    Students memorise a textbook list and write it out.

    Fix: Name the company's actual activities, sites, suppliers and stakeholders in every point.

  • Treating business continuity, disaster recovery and crisis management as the same thing.

    The terms overlap in everyday use.

    Fix: Define each in one line. Disaster recovery restores IT, continuity keeps critical activities going, crisis management handles the threat to the organisation and its reputation.

  • Ignoring communication and reputation.

    Students focus on operational fixes such as backup systems.

    Fix: Always cover stakeholder communication, honesty and a single spokesperson.

  • Forgetting to test and update the plan.

    Students see the plan as a document, not a control.

    Fix: Mention exercises, lessons learned and regular review as part of any recommendation.

  • Recommending expensive measures with no cost-benefit view.

    Students assume more protection is always better.

    Fix: Link the measure to the criticality of the activity and the board's risk appetite.

Worked examples

Example 1

A food manufacturer has one factory and one packaging supplier. A fire at the factory would stop all production. Advise the board how business continuity planning could reduce the impact of this risk. (10 marks)

Show the solution
  1. Identify the risk event: a fire that halts the only production site. The likelihood may be low but the impact is severe, so mitigation focuses on impact.
  2. Run a business impact analysis. Production and order fulfilment are critical. Decide the maximum tolerable downtime, for example by customer contract terms.
  3. Arrange alternative capacity: an agreement with another manufacturer or a standby site, so production can restart within the tolerable period.
  4. Reduce supplier dependence: qualify a second packaging supplier and hold buffer stock of critical materials.
  5. Protect people and data: evacuation procedures, off-site backup of orders, recipes and financial records, and a clear call-out list.
  6. Insure against loss, including business interruption cover. Insurance transfers financial loss but does not restore customers or reputation.
  7. Set governance: a named board member owns the plan, the plan is tested through exercises, and reviewed after changes in the business.
  8. Weigh cost: standby arrangements cost money, so match them to how critical each activity is and the board's risk appetite.

Answer: The board should perform a business impact analysis, set a tolerable downtime, and arrange alternative production capacity, a second supplier, buffer stock, off-site data backup and business interruption insurance. It should name an owner, test the plan regularly and justify the cost against the risk appetite.

Example 2

A listed airline discovers a data breach exposing customer details. The media is already reporting it. Explain the elements of a crisis management response and why each matters. (10 marks)

Show the solution
  1. Activate the crisis team immediately. A small senior group with clear authority avoids slow decisions. It should include operations, IT, legal, communications and a board link.
  2. Contain the damage first: isolate affected systems, stop further loss of data and preserve evidence for investigation.
  3. Communicate quickly and honestly. Use one spokesperson and a consistent message. Tell affected customers, staff, regulators and investors what is known, what is not and what is being done. Delay or denial would damage trust and may breach legal duties.
  4. Support those affected, for example by advising customers on protective steps. This shows the airline puts stakeholders first and is the ethical response.
  5. Investigate the cause and report to the board. Identify control failures so that they can be fixed.
  6. Recover and learn: restore normal service, rebuild confidence, review the crisis plan and update it with lessons learned.
  7. Link to governance: the board remains accountable. A tested plan, defined roles and a culture that reports problems early make the response faster.

Answer: The response should activate a crisis team, contain the breach, communicate honestly through one spokesperson, support affected customers, investigate the cause, and then recover and update the plan. Each element limits impact on stakeholders and reputation, and the board remains accountable.

Exam tips

  • Tie every measure to the scenario. Generic lists earn few marks.
  • Say which type of plan you mean: contingency, continuity or crisis. Precise terms show technical command.
  • Always cover communication with stakeholders. It is often the missed point in crisis questions.
  • Show professional skills: weigh cost against benefit, and write in the format asked, such as a board briefing.
  • Finish with a recommendation and mention testing and review. It shows you see plans as living controls.

Practice questions from Managing, monitoring and mitigating risk

Risk Mitigation Through Business Continuity and Crisis Planning in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Mitigation Through Business Continuity and Crisis Planning: frequently asked questions

What is the difference between a business continuity plan and a crisis management plan?

A business continuity plan keeps critical activities running or restores them within a set time. A crisis management plan deals with an event that threatens the organisation's reputation or survival, focusing on decisions, leadership and communication. A major event often needs both.

Is business continuity planning a risk response in the TARA framework?

It mainly sits under reducing risk, because it limits the impact of an event. Insurance within a plan is a form of transfer. Say which TARA response you are describing.

How do I use this topic in an SBL answer?

Spot the risk event in the pre-seen or exam scenario, identify the affected stakeholders and activities, then propose specific continuity and crisis measures. Add governance, testing and cost-benefit points and write in the format required.

Why does testing the plan matter?

A plan that has never been tested may fail when needed. Staff may not know their roles, backups may not work and contact lists may be out of date. Exercises and reviews find these gaps before a real event.