Map the dependencies behind your first recovery priority

Begin a business impact analysis with one activity whose interruption would cause an unacceptable consequence. Describe how the impact grows over time, define the minimum useful service and map the dependencies needed to deliver it. Starting with a list of software systems can miss the people, authorisations, records and supplier cut-offs that determine whether work can actually resume.

New Zealand’s Business.govt.nz describes continuity planning as identifying critical business parts and preparing to restore operations. It distinguishes this from the immediate response covered by an emergency plan. The worksheet here is our suggested way to make that distinction operational; it is not a prescribed legal test. 1

Describe the activity in customer or operational terms. Explain impact over time rather than assigning every system the highest priority. Treat a workaround as an assumption until its capacity, access and authority are checked.

Use a statement such as “confirm and dispatch time-sensitive customer orders” rather than “restore the network”. Name the activity owner and the people affected if it stops. Explain which commitments, quality controls or safety considerations constrain the response, referring consequential questions to the appropriate specialist.

Discuss what changes after a short interruption, a full operating day and a longer disruption. The intervals are prompts, not mandatory tolerances. Record the evidence behind the assessment: a contractual cut-off, available stock, staffing capacity or another relevant constraint. Mark estimates clearly when reliable evidence is unavailable.

For New Zealand teams using offshore service desks or suppliers, write the location, time zone and service availability into the map. A listed contact is not evidence that a decision-maker can respond during the required window. Check the contracted support route and the authority of the person receiving an escalation.

Imagine a fictional distributor that believes it can dispatch manually if its order platform fails. Staff have paper forms, but only one person can access the current approved delivery addresses. The carrier also has a booking cut-off. Those dependencies determine whether the manual route is useful.

The activity owner defines a smaller minimum service for priority orders, checks that a competent alternate can retrieve the necessary authorised records, and verifies the carrier arrangement. The team documents which orders remain outside that workaround. This is an invented scenario, not evidence that manual dispatch is appropriate for every business.

If a dependency is unresolved, show the proposed recovery target and the demonstrated capability separately. Calling a target “four hours” does not establish that the organisation can meet it. The gap needs an owner and a management decision rather than a more optimistic colour on the worksheet.

Fictional dependency worksheet. A distributor needs to prepare 40 priority orders before a 15:00 carrier cutoff. Its scenario starts at 13:00. The manual route is estimated to handle 15 orders per hour, assuming authorised address access and competent staff remain available.

Even before allowing for loading or delays, the estimated route covers 30 ÷ 40 = 75% of the requirement. If address access is unavailable, that estimated capacity is not usable at all until the dependency is resolved. A form and a willing operator do not establish the needed inputs.

The activity owner should record the gap, investigate a feasible route and decide what service can legitimately be offered under the relevant controls. This calculation does not approve prioritising particular customers or bypassing dispatch checks. The rate is a planning estimate, not demonstrated performance, and no real customer records or carrier commitments were used.

Select one important assumption and validate it safely: retrieve a current contact route, confirm an alternate’s access or walk through the approved workaround with fictitious records. Use authorised tests proportionate to the activity. Do not interrupt a live service or expose customer information simply to complete the map.

Record the result, date, evidence owner and condition that would require a recheck. Changes to staffing, premises, contracts or technology may invalidate an earlier assumption. Transfer unresolved gaps into risk actions and escalation triggers and use the updated map to choose the next exercise.

They answer different questions. This worksheet focuses on the consequences of an interrupted activity and what recovery depends on. A risk assessment also considers scenarios and controls affecting exposure.

Yes. A short, current worksheet with checked assumptions can be useful. Add detail where the consequence or dependency warrants it.

No. Immediate protection and emergency response remain separate responsibilities. Connect the plans without allowing business recovery priorities to override safety.

AI assisted research and drafting. This article is general information; verify current requirements and obtain competent advice for consequential decisions.

1. Business.govt.nz continuity and contingency planning — Official New Zealand business guidance distinguishes continuity recovery from immediate emergency response and prioritises core activities.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.