Identifying Business Activities That Must Continue During a Disruption

01Start with priority outcomes rather than the organization chart

Begin with the products and services that the organization has committed to deliver, including safety, regulatory and contractual duties that continue during disruption. Ask which outcomes would cause unacceptable harm if suspended. This prevents a common mistake: labeling every departmental responsibility “critical” because the manager regards it as important. A team may own a valuable activity that can be postponed without immediate material consequence.

Trace each priority outcome backward to the smallest set of activities needed to achieve it. For an urgent delivery service, these may include receiving an order, validating a release, confirming available stock, preparing shipping documents and communicating an exception. Keep normal enhancement and reporting tasks separate from the minimum flow. The result is a defensible boundary for continuity planning, rather than an indiscriminate list of tasks.

A useful workshop technique is to bring together the person receiving the service and the person who actually creates it. Ask both to walk through an urgent transaction, then remove a key system or facility. Their answers often differ. The discrepancy may reveal a manual approval or release step that never appeared in process architecture diagrams. Record it as a dependency and validate its significance before declaring the activity priority.

Technical context: ISO 22301:2019 — Business continuity management systems — Requirements (with Amd 1:2024) is one verified source for the concepts discussed here.

02Test the consequence of interruption over time

Assess effects on life and safety, legal compliance, customer harm, financial loss, operating capacity and reputation. Consequences may accelerate sharply after a specified interval; they are not necessarily linear. Operations, risk, legal and customer-facing managers should agree the basis for accepting or rejecting an interruption. Use actual obligations and process data where possible; do not invent a universal four-hour recovery threshold.

ISO/TS 22317:2021 provides guidance for undertaking business impact analysis but does not prescribe a uniform BIA method. Record the point at which impact becomes unacceptable and identify what assumptions support that judgment. Where business owners disagree, document the different consequences and involve the decision authority instead of averaging incompatible assessments.

Test the impact assessment with a counterfactual: If this activity stopped but the promised result could still be delivered through another safe route, is the activity itself critical or merely the normal way of working? This question prevents an overpopulated criticality register. Conversely, a low-cost control activity may be critical where its absence creates immediate harm even if it contributes no measurable revenue.

03Include activities required for safe suspension

An activity need not generate customer revenue to be essential. Isolating dangerous equipment, maintaining essential environmental controls, accounting for staff, protecting sensitive data and preserving critical records may remain necessary even if production ceases. Distinguish the work that prevents additional harm from the work that restarts output. Safety and legal obligations can override a purely financial ordering.

Ask what must continue to make a temporary shutdown safe. Record the accountable role, available equipment, emergency access route and expected evidence. A continuity plan that protects invoicing but leaves a hazardous process unattended is not proportionate to the actual business consequence. Validate these decisions with competent specialists for the activities concerned.

Minimum safety duties are sometimes assigned to functions that cease normal work during a disruption, such as maintenance or environmental monitoring. Put them explicitly in the essential-activities inventory. Assign a qualified person who can perform isolation, monitoring and required reporting if production shuts down. This also gives executives a credible boundary around cost-cutting decisions during an emergency.

04Map shared dependencies and hidden single points of failure

List the people, premises, utilities, information, technology, supplier services and approvals each priority activity requires. Several business units may independently claim that the same generator, specialist engineer or network connection will support their recovery. Aggregating their needs exposes conflicts that isolated interviews cannot reveal. Distinguish dependencies essential to minimum output from resources used for normal efficiency.

The dependency map should identify substitute capacity and the earliest point at which a missing input blocks service. Check provider commitments instead of assuming outsourced services remain available during a regional event. A written “backup supplier” is not a usable recovery option until access, lead time, capacity, quality and contractual arrangements have been verified.

A second-source agreement should identify activation conditions, quality acceptance criteria and a realistic available quantity. In an exercise, ask the supplier to confirm how many units or transactions it could actually provide while serving other customers. If confirmation is unavailable, mark the alternative unproven. This keeps a hypothetical backup from being represented to the board as operational redundancy.

05Specify minimum viable operation, not full restoration

For each priority activity, define the output that must be maintained in a degraded state. This could be an essential transaction type, a safe minimum throughput, controlled manual approvals or customer contact at a reduced cadence. Define quality and safety conditions that cannot be relaxed. The minimum may be less than normal volume yet still demand the same critical integrity checks.

Document the necessary people, systems, data and facilities at that level. Use operational measures that can be tested, such as validated dispatches or accepted service tickets, rather than “business continues normally.” Recovery teams need to know when a reduced service is acceptable, when to escalate to the customer and who can authorize a further reduction.

Service minimums should have a clear entry and exit. For a laboratory, accepting only urgent tests may be possible, but the organization still needs controls over sample integrity, competent analysis and result authorization. A useful minimum output statement describes the recipient, eligible work, capacity, non-negotiable controls and communications. This gives frontline teams a decision rather than a slogan.

06Validate choices against a realistic disruption

Run a tabletop scenario that removes a shared dependency, not merely a single team member. Ask process owners to demonstrate which activities they would stop, which they would continue and what evidence they would use to decide. Examine the first shift, the handover between shifts and the moment a temporary workaround becomes unsustainable. A sequence of documents is not proof of operational feasibility.

ISO 22301:2019, with its 2024 amendment, frames requirements for a BCMS; ISO 22313:2020 gives application guidance. The organization should translate that framework into exercised capabilities. Correct the activity classification when the scenario reveals a safety, supplier or information dependency that was missed.

During the exercise, observe what people really stop. Teams often continue familiar routine reporting out of habit while failing to resource the urgent service identified by BIA. Build a short priority instruction for each shift and check that employees can distinguish essential transactions from deferred ones. Rehearsing this choice under workload is more revealing than repeatedly asking owners to rate criticality.

07Keep the priority activity list connected to change

New contracts, automated workflows, site closures and new regulations can make an old activity list misleading. Link updates to product introductions, supplier changes, major system releases and management of change. Process owners should alert the BCMS coordinator when a new dependency appears or a previous substitute has been withdrawn. Revisit assumptions after real incidents and continuity exercises.

An executive view should show not only which activities were labeled priority, but which have validated alternatives and residual exposure. If the organization cannot provide minimum output when two locations fail together, describe that limitation explicitly and determine whether a strategy investment is justified. Priority classification is a planning decision that must remain operationally true.

Use change management to keep the list responsive. A new customer contract may turn a previously tolerable delay into an urgent commitment; a new automation platform may combine formerly independent workflows. Require the accountable service owner to confirm whether such changes alter the minimum critical path. Update the dependency and priority record together, not as isolated administrative corrections.

Closing Perspective

The right priority list is short enough to direct scarce recovery resources and detailed enough to protect the outcomes that matter. Its credibility comes from explicit consequences, cross-functional validation and an exercised minimum operating path.