ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Business continuity scenario planning is the practice of taking a specific disruption, such as losing a site, a key supplier or a core system, and working through what would happen and how the organization would respond. It turns abstract risk scores into concrete decisions about people, systems and money.
This guide covers how to choose scenarios, run a workshop, score results and turn findings into actions. It works alongside your risk register, your exercise programme and your impact analysis.
Scores in a register describe likelihood and impact in general terms. Scenarios make them tangible by forcing teams to say who does what at hour one, day one and week one. Gaps appear that no spreadsheet reveals, such as an unlisted dependency or a recovery step that only one person understands.
ISO 22301:2019, listed at ISO 22301:2019 on iso.org, expects organizations to plan and exercise their continuity arrangements, and scenarios give both activities shape.
Start from the impact analysis: pick disruptions that would threaten your most critical activities. Effect-based scenarios, such as loss of premises, loss of technology, loss of people and loss of suppliers, keep the exercise independent of cause and cover many events with a few cases.
Add a small number of cause-based scenarios, such as ransomware or severe weather, where the specific trigger changes the response. Five to eight scenarios usually cover a whole programme.
Define who declares an incident, who leads the response, who speaks to customers and who authorizes spending. Ambiguity here is one of the most common weaknesses. During the workshop, ask each role holder to say what they would do and when, and compare it with the written plan. Any mismatch is either a plan error or a training gap, and either deserves an action.
Include deputies in the discussion, because real incidents rarely happen when the primary person is available.
A useful scenario has a clear trigger, a start time, a duration and a scope. State what is lost and what still works. Add a short timeline of developments, called injects, so that participants must react to new information rather than solve a static puzzle.
Keep it plausible. Extreme fiction reduces engagement, and events that participants recognize from recent news produce better discussion.
Invite the activity owners, technology, facilities, HR, communications and a decision-maker with authority to commit resources. A facilitator leads participants through the timeline while a note-taker records decisions, gaps and assumptions.
Ask the same questions each time: what is affected, what is the deadline, what do we do now, what do we need and who decides.
| Scenario | Typical trigger | Activities hit | Key question |
|---|---|---|---|
| Loss of a building | Fire, flood, access denial | Site-based teams, on-premise equipment | Where do people work within the tolerance? |
| Loss of a critical system | Cyber attack, failed change | Order processing, payments | Can we operate manually and for how long? |
| Supplier failure | Insolvency, outage | Production, support | Is there an alternate supplier ready? |
| Loss of key people | Pandemic, industrial action | Specialist functions | Who can cover and how quickly? |
Apply your risk criteria to each scenario. Score the impact by dimension, estimate likelihood and compare the result with thresholds. Record whether the current arrangements can meet the recovery objectives, since a gap in recovery time is often the most valuable finding.
The guide to RTO and RPO helps you compare demonstrated recovery with what the business needs.
Send a short pack a week in advance: the scenario outline, the objectives, the ground rules and the list of attendees. State that the aim is learning, not blame, so people speak openly about weak spots. On the day, bring the current plans, contact lists and dependency maps, and ask participants to use them as they would in a real event. If they cannot find something quickly, that is a finding.
Close with a short review of what went well and what to change, and circulate the notes within a few days while memories are fresh.
Most surprises come from dependencies. Ask what each activity needs: applications, data, facilities, suppliers, people and information. Use your dependency mapping as a checklist and see whether the scenario breaks any link.
Single points of failure often emerge here; see the note on single point of failure analysis.
Write down each gap as an action with an owner, a due date and a priority. Typical findings include outdated contact lists, untested backups, missing alternate suppliers and unclear authority to declare an incident.
Link actions to the risk treatment process so they are tracked, funded and closed.
Free business continuity risk assessment
What could stop your most important activities?
List your prioritized activities and what they depend on, pick from 32 disruption scenarios, rate them and choose continuity measures for each. Built to ISO 22301 clause 8.2.3, and free.
Run the free continuity risk assessment → or View premium report sample
Suppose your order processing platform is encrypted by ransomware at 9:00 on a Monday. Injects follow: at 09:30 the vendor confirms the outage may last three days; at 11:00 customers begin calling; at 14:00 the regulator asks for an update. Participants must decide whether to invoke the continuity plan, switch to manual order capture, notify customers and brief senior management. The exercise reveals that the manual forms are three years old, that only two people know the paper process and that the backup restore has never been timed. Each is recorded as an action. One short session produces more usable insight than a year of reading the register.
Scenarios should test communication as well as recovery. Ask who informs staff, customers, suppliers, regulators and the media, through which channels and with what approved wording. Check that contact lists are current and that an alternate channel exists if email or the main messaging system is part of the outage. Pre-approved holding statements save hours during a real event and are easy to prepare during a workshop.
Record any delay or confusion during the exercise, since unclear communication frequently worsens incidents more than the original technical failure does.
Avoid the usual traps.
A workshop is a discussion. An exercise tests the response. Use scenarios to design tabletop exercises and later live tests, and rotate the scenarios so the plans face different challenges. The guide to the business continuity exercise covers the formats.
Track simple measures to show the programme is worth the time: the number of gaps found, the share closed on time, the recovery times demonstrated against objectives and the number of scenarios covering each critical activity. Improvement across cycles shows that scenarios are changing behaviour, not just producing documents. If the numbers stall, change the scenarios or the facilitation approach.
Summarize each scenario in one page: what was assumed, what would happen, whether objectives were met, the main gaps and the actions. Show trends over time so leaders see improvement. Escalate any scenario where recovery objectives cannot be met.
Choose scenarios with a simple test: does it threaten a critical activity, is it plausible in the next few years, and would exercising it teach us something new? Score candidate scenarios on those three questions and pick the highest. Include at least one scenario that involves a third party, since supplier dependence is a growing source of disruption, and the guide to supplier continuity assessment shows how to gather evidence. Revisit the shortlist each year so the programme does not become repetitive.
Review scenarios annually and when the business changes, such as a new site, supplier or system. Update the injects to reflect current threats and retire scenarios that no longer apply. Keep old versions to show how the programme evolved.
Whichever format you choose, store each completed scenario, its scores and its action list together, so an auditor can follow the thread from workshop to closed action without hunting through folders.
If you prefer a ready format, the Business Continuity Risk Assessment Report and Workbook provides scoring, treatment and reporting fields that fit scenario results. Whatever tool you use, keep records consistent so results are comparable year on year.
It is working through specific disruptions to see how the organization would respond, what would be affected and where plans fall short.
Five to eight cover most organizations, using effect-based scenarios such as loss of site, system, people and suppliers.
Scenario planning designs and analyses the disruption, while an exercise tests the people and procedures against it.
Activity owners, technology, facilities, HR, communications and a senior decision-maker.
At least annually and whenever there is a major change in the business or threat picture.
September 30, 2026
