Continuity plans age between annual reviews

Review a business continuity plan at a defined interval and when a material change challenges its assumptions. A calendar reminder can organise the review, but a service may change well before that reminder arrives. The useful question is whether the plan still describes a recoverable service at the level the business needs.

For South African teams, the University of Cape Town's June 2024 Business Continuity Policy provides a public example of linking continuity to operations, testing, management decisions and continual improvement. Its annual activities are institutional commitments for UCT, not a universal statutory review interval for South African businesses. UCT Business Continuity Policy

Choose the planned review interval with the service owner, taking account of consequences, applicable obligations and the pace of change. Record the reason for the interval. A high-impact service with frequent changes may need closer attention than a stable, lower-impact process.

Alongside that interval, establish a route from operating changes to the continuity owner. Relevant changes include a new application, location, supplier arrangement, operating hours, workload or dependency. A change need not cause an incident to make a recovery assumption obsolete.

Identify who screens the change, who examines its continuity effect and who can approve revised priorities or resources. Put that responsibility into the existing change process, so continuity review does not depend on someone remembering a separate document months later.

Begin with the previous approved service description. What work must continue during disruption? What capacity and time limits were accepted? Which people, information, facilities and systems were assumed to be available? Compare those assumptions with the proposed or completed operating change.

UCT's policy describes continuity in terms of acceptable timeframes and predefined capacity during disruption. That is a useful reminder to examine the service delivered, rather than treating an available application as the entire outcome. Its scope and governance remain specific to the university. UCT policy and definitions

The matrix is an original review aid. It does not prescribe a recovery time or a legal notification deadline. Keep assumptions identifiable so an owner can approve, revise or reject them individually.

A supplier's contractual recovery promise may concern only its own component. Check the interfaces and responsibilities that connect that promise to your service. Avoid declaring the whole process recoverable because each team has separately reported that its part is ready.

A document check can establish that contact details, references and responsibilities are consistent. A discussion exercise can expose uncertainty about decisions. A technical test can provide evidence about an observed recovery operation. Choose the method that answers the changed assumption, and state its limits.

NIST's information-system contingency guidance distinguishes several recovery approaches, including alternate equipment, alternative locations and manual processing, and includes plan maintenance within its planning process. These are US planning resources, not South African legal duties. Their value here is the connection between the recovery approach and the arrangement that must remain usable. NIST contingency planning

For a revised manual route, check who can perform the work, what information they need, how long the route can operate and what cannot proceed safely. For a changed integration, agree a controlled test with competent technical staff. Protect live operations, personal information and approval controls during verification.

Use a recovery tabletop when coordination or authority needs examination. The existing guide addresses US and Canadian discussion exercises; its distinction between a discussion and measured recovery is useful here, but it does not establish local reporting requirements.

Fictional change review. A service previously needed to process 30 priority cases per day during disruption. A new contract increases the minimum to 50. The existing continuity plan describes a manual route for 36 cases per day, based on its older planning assumptions.

The comparison is 50 required − 36 planned capacity = 14 cases per day not covered. Over two days the arithmetic gap would be 28 cases, assuming constant demand, no backlog carried in and no other processing route. These are scenario assumptions, not measured capability.

The owner must address both problems: the numerical shortfall and the absence of current capability evidence. Renaming the plan or increasing its stated capacity to 50 resolves neither. Possible responses include resources, a revised service arrangement or an authorised treatment of the gap, subject to actual commitments.

No annual review interval excuses ignoring the change. This example is a decision aid, not a statutory review schedule or evidence that manual processing is suitable for the real service.

Record the change reference, affected assumptions, evidence inspected, unresolved questions and decision-maker. If the new arrangement has not been tested, say so. Do not replace the old plan with a polished document that quietly assumes an unproven capability.

A review can conclude that no revision is needed, but the record should explain why the changed operation leaves the recovery arrangement valid. Where a revision is required, name an owner, a completion condition and the evidence needed to close it.

Update the controlled plan and communicate the relevant changes to people who would use it during disruption. Check that approved instructions can be found when normal systems are unavailable. Superseded copies should be handled through the organisation's document controls.

Preserve the distinction between a planned capability, a demonstrated capability and a remaining gap. Management can then decide whether to limit the service, fund a change or accept a defined residual risk through its authorised process.

No universal interval is established here. Apply relevant obligations and set a justified cadence, with additional review when material changes affect the plan.

No. Screen its effect and choose proportionate evidence. A corrected contact reference and a redesigned recovery dependency require different checks.

Technical evidence supports the decision, but business service priorities and acceptable disruption need the appropriate business authority.

UCT Business Continuity Policy GEN014 — June 2024 public institutional policy; checked 8 October 2026. Its requirements apply to UCT.

NIST contingency planning — US information-system planning overview, updated 22 June 2020; checked 8 October 2026.

QSE Advisory is part of the QSE Advisory brand family. Preparation was AI assisted. The review matrix and implementation method are editorial guidance, not reported testing or client results.

Spotted an issue? Contact our editorial desk.