Business Continuity in the Age of Cascading Risk

The business continuity plans sitting in most corporate repositories share a quiet assumption: one bad thing happens, the plan activates, operations recover. Recent experience has made that assumption the most dangerous line in the document. A pandemic overlaps with a cyber attack. A port closure compounds a component shortage. Ransomware strikes during peak season, while the person who knows the recovery procedure is on leave.

Cyber incidents, supplier failures, climate events and geopolitical shocks no longer arrive one at a time. They compound. Business continuity planning built around single-event scenarios is quietly obsolete, and the fix is not a thicker plan. It is a business designed to absorb disruption.

Why traditional business continuity planning falls short

• Plans are written per scenario. Real crises combine scenarios and improvise new ones.
• Recovery assumes what the event destroyed. The plan relies on infrastructure, suppliers and people that the same event may have taken down. The backup site shares a power grid. The recovery runbook is stored on the encrypted file server.
• Exercises are designed to be passed. Annual tabletop sessions walk through a polite scenario, everyone performs well, and the report confirms the plan works. Nothing was stressed, so nothing was learned.
• The fragility lives outside the boundary. Cloud providers, logistics partners, payroll processors and single-source components sit beyond the plan's scope, which is exactly where the real exposure is.
• Ownership is too junior and too narrow. Continuity is often a compliance task in one function. The decisions that create resilience, such as sourcing, architecture and inventory, are made elsewhere by people who never see the plan.

How risks cascade

Consider a hypothetical regional distributor. A storm floods a supplier's site, so the purchasing team switches to an alternative supplier in a hurry. The new supplier needs to be set up in the finance system, and in the rush a fraudulent change-of-bank-details email is approved. The resulting investigation freezes payments for a week, at the moment when suppliers are already nervous. None of these events is dramatic on its own. Together they stop the business.

Three things make cascades more likely than they used to be. Systems are more tightly connected, so a failure in one travels quickly to others. Dependencies are more concentrated, with many organisations relying on the same few cloud, software and logistics providers. And buffers are thinner, because years of efficiency work removed the stock, capacity and people that used to absorb shocks.

Resilience as a design property

Leading organisations are shifting from documented recovery to designed resilience.

• Map what matters. Identify the handful of business services whose interruption is existential, then trace their full dependency chains across systems, suppliers, people and sites to find the concentrations.
• Set impact tolerances. For each critical service, agree how much disruption is tolerable before customers, safety or solvency are seriously harmed. A tolerance is a business decision, and it tells you how much resilience is worth paying for.
• Buy down fragility deliberately. Dual-source the critical, segment the connected, and hold buffers where the cost of redundancy is lower than the cost of outage. The same logic underpins the move in supply chain resilience from just-in-time to just-in-case.
• Decide before the crisis. Pre-authorised decision rights and thresholds, so the response on day one is not a governance debate. Who can shut down a system, stop shipments or speak to the regulator, and at what trigger?
• Test to failure. Exercises designed to find breaking points, including cyber scenarios where your own recovery systems are the target.

The question has changed from "how fast can we recover?" to "how much disruption can we absorb while still serving customers?"

Third parties and technology: where the fragility hides

Most critical services now depend on organisations you do not control. For the few suppliers that truly matter, ask harder questions. What happens to you if they are down for a week? Can you leave, and how long would it take? Where several of your critical suppliers share the same underlying provider, you have a concentration that no single contract reveals.

Technology deserves the same scrutiny. Recovery plans should assume a cyber attack may compromise identity systems, backups and communication tools together. Offline copies of critical data, tested restoration, segmented networks and an out-of-band way to communicate are no longer refinements. They sit at the centre of cybersecurity in the AI era, where attacks are faster and more convincing, and where a zero trust operating model limits how far any single failure can spread. As AI agents and automation take on more operational work, add them to the dependency map, along with the manual fallback for when they are unavailable.

Regulators are moving in the same direction. DORA has applied to EU financial entities since January 2025 and puts digital operational resilience and third-party risk under direct supervisory attention. NIS2 extends security and incident obligations across many essential and important sectors in the EU. Scope and national implementation vary, so confirm what applies to your organisation with counsel.

Exercises that teach something

A useful exercise is uncomfortable. Combine scenarios: a cyber incident during a supplier failure, with a key executive unreachable. Remove the assumptions people lean on, such as email, the shared drive or the head office. Include the executive team at least once a year, because their decisions are part of what is being tested.

Then treat the findings as an investment list, not a report. Each exercise should produce a short set of funded changes with owners and dates, and the next exercise should check they were made.

Where to start: questions to ask your team

• Which services are critical? Can we name the five or so business services we must keep running, and do the executives agree on the list?
• What do they depend on? Has anyone traced each one end to end, including suppliers of suppliers and shared technology?
• What is our tolerance? How long can each service be down before harm becomes serious, and who decided that?
• Who decides on day one? Are decision rights and triggers written down and known by the people who hold them?
• When did we last fail an exercise? If the answer is never, the exercises are too easy.
• Could we recover if our recovery tools were the target? Are backups isolated and has restoration been tested at scale?

Common questions

What is the difference between business continuity and operational resilience?

Business continuity traditionally focuses on recovering specific functions after a defined event. Operational resilience starts from the services customers rely on and asks how much disruption the organisation can absorb while still delivering them. Resilience includes continuity planning but adds dependency mapping, impact tolerances and design changes.

How often should a business continuity plan be tested?

At least annually for a full exercise, with smaller, focused tests through the year, particularly for technology recovery and crisis communication. Frequency matters less than difficulty. A demanding exercise once a year teaches more than quarterly walk-throughs that everyone passes.

Who should own business continuity in an organisation?

Accountability should sit with a senior executive, with each critical service owned by the business leader who runs it. A central team can coordinate method, exercises and reporting. It cannot own the sourcing, architecture and staffing decisions that actually create resilience.

Where Ganexa can help

Ganexa helps leadership teams build resilience around their critical services through executive advisory and strategic planning, covering dependency mapping, impact tolerances, crisis governance and exercises that genuinely stress the design. Our business process improvement work then removes the fragile handoffs and single points of failure the mapping exposes. To discuss where your organisation is most exposed, book a free consultation.