What if your biggest business continuity risk isn’t the disruption itself—but the first 60 minutes after it happens?
A system goes down.
A critical supplier stops responding.
A cyber incident affects your operations.
Your facility becomes inaccessible.
A key person is suddenly unavailable.
Customers are waiting. Employees are asking questions. Management needs answers.
And somewhere in the middle of all this, someone asks the question that should have been answered much earlier:
“What do we do now?”
Disruption is inevitable. No organization can completely eliminate it.
But confusion, delayed decision-making, unclear responsibilities, and untested plans do not have to be inevitable.
This is where The Mandar Approach to Business Continuity Management focuses on a simple principle:
Don’t just prepare a plan. Prepare the organization.
Business Continuity Management should not be treated as a document created for an audit and forgotten afterward. It should become a practical capability that connects risk, people, processes, technology, suppliers, leadership, and recovery.
Why Traditional Business Continuity Planning Can Fall Short
Many organizations have a business continuity plan.
But having a plan and being prepared are not necessarily the same thing.
A plan may exist, yet:
- Employees may not know their responsibilities.
- Emergency contact details may be outdated.
- Critical suppliers may not have been assessed.
- Recovery priorities may not be clearly defined.
- Technology recovery may not match business requirements.
- Business teams may not have participated in testing.
- Senior management may not know when to activate the plan.
The result?
The organization has documentation—but not necessarily readiness.
The Mandar Approach looks beyond documentation and asks a more practical question:
“If disruption happened today, could your people actually execute the plan?”
What Is the Mandar Approach?
The Mandar Approach is a practical way of looking at Business Continuity Management through the connection between business priorities, operational risk, management systems, resilience, and continual improvement.
Rather than treating BCM as an isolated compliance activity, the approach encourages organizations to connect business continuity with the wider management ecosystem.
That means looking at:
- Business: What must continue?
- Risk: What could stop it?
- People: Who needs to respond?
- Process: How will critical work continue?
- Technology: What systems and data are essential?
- Supply Chain: Which external dependencies matter?
- Leadership: Who makes decisions?
- Recovery: How quickly can operations be restored?
- Improvement: What will we learn from every test or incident?
The objective is to move BCM from “We have a plan” to “We are ready to respond.”
The Mandar Approach: Six Questions Every Business Should Answer
1. What Must Continue?
Not every business activity has the same level of importance during a disruption.
The first step is identifying what truly matters.
Ask:
- Which products and services are critical?
- Which processes directly support them?
- Which activities must continue during disruption?
- Which activities can temporarily stop?
- Which customers or stakeholders are most dependent on these activities?
This helps organizations focus limited resources on what matters most.
2. What Could Stop Us?
Once critical activities are identified, the next question is about vulnerability.
Potential disruptions may include:
- Cyberattacks
- IT failures
- Power outages
- Natural disasters
- Fire or facility loss
- Supplier failure
- Transportation disruption
- Telecommunication failure
- Loss of key employees
- Third-party service interruption
But the important point is not simply creating a long list of risks.
The organization needs to understand which risks can actually interrupt critical business activities.
3. What Do We Depend On?
This is where many continuity programs become more interesting.
A process may appear internal, but its ability to operate may depend on several external or hidden factors.
For example:
Customer Order → ERP System → Internet Connectivity → Cloud Provider → Payment Gateway → Warehouse → Logistics Partner
If any critical dependency fails, the customer order may be affected.
Therefore, BCM should look beyond organizational boundaries.
Your resilience is influenced by the resilience of your critical dependencies.
4. Who Makes the Decision?
During disruption, uncertainty increases quickly.
One of the most important questions is therefore:
“Who has the authority to decide?”
A continuity framework should establish:
- Who identifies and escalates an incident
- Who activates the continuity plan
- Who communicates with employees
- Who communicates with customers
- Who manages suppliers
- Who makes recovery decisions
- Who authorizes extraordinary expenditure
Clear responsibility reduces confusion when time is critical.
5. How Will We Continue?
Once the priorities and dependencies are understood, organizations can develop practical continuity strategies.
Depending on the business, these may include:
- Alternative suppliers
- Remote-working arrangements
- Backup infrastructure
- Data recovery capabilities
- Alternative facilities
- Manual workarounds
- Cross-trained employees
- Alternative communication channels
- Emergency logistics arrangements
The right strategy is not necessarily the most expensive strategy.
The right strategy is one that is appropriate to the organization’s risk, business requirements, and recovery objectives.
6. How Will We Know It Works?
This is where testing becomes essential.
Imagine discovering during a real crisis that:
- The emergency contact list is outdated.
- The backup system does not support the required process.
- The supplier’s emergency contact is unavailable.
- Employees don’t know who should activate the plan.
- The recovery timeline was unrealistic.
These are exactly the kinds of weaknesses that testing can expose before an actual disruption.
Test. Learn. Improve. Repeat.
Real-World Lessons: What Disruptions Have Taught Businesses
COVID-19: Continuity Became Everyone’s Responsibility
The COVID-19 pandemic forced organizations around the world to reconsider how work was performed.
Office-based organizations had to consider remote operations. Supply chains were disrupted. Customer behavior changed. Employees faced new constraints.
The organizations that had digital capabilities, communication mechanisms, remote-working arrangements, and crisis-management structures had important building blocks that could be adapted.
The broader lesson was clear:
Business continuity cannot be separated from how the business actually operates.
Thailand Floods: Your Supply Chain Can Become Your Risk
The 2011 Thailand floods affected manufacturing operations and supply chains connected to the region.
The event demonstrated that a company does not need to experience a disaster at its own location to suffer operational consequences.
A critical supplier may be thousands of kilometers away and still determine whether your business can deliver to customers.
This makes supplier continuity and dependency mapping important parts of modern BCM.
Colonial Pipeline: Cybersecurity and Business Continuity Are Connected
The 2021 Colonial Pipeline cyberattack demonstrated how a cyber incident can affect physical business operations and wider supply chains.
The lesson for businesses is important:
Cyber risk is not only an IT problem.
When technology supports critical business processes, a technology incident can quickly become a business continuity incident.
Business Continuity Is Not Just About Disaster
One misconception about BCM is that it is only relevant when something catastrophic happens.
In reality, continuity thinking can help organizations deal with much smaller disruptions too.
Consider a manufacturing company where one critical machine fails.
If the company has:
- Alternative production capacity
- Maintenance procedures
- Spare parts
- Trained personnel
- Supplier support
- Clear escalation procedures
the disruption may be contained.
Without those capabilities, a relatively small equipment failure can create significant operational consequences.
Resilience Is Often Built Before the Crisis
The response to disruption begins long before disruption occurs.
It begins with decisions about processes, systems, suppliers, people, training, documentation, technology, and leadership.
Business Continuity Management and Disaster Recovery
Business Continuity Management and Disaster Recovery are closely connected but should not be treated as identical.
Disaster Recovery
Disaster Recovery generally focuses on restoring IT systems, applications, infrastructure, data, and technology services.
Business Continuity Management
BCM takes a wider view of organizational operations.
It considers:
- People
- Processes
- Technology
- Facilities
- Suppliers
- Communications
- Critical products and services
- Recovery requirements
In simple terms:
Disaster Recovery asks: “How do we restore technology?”
Business Continuity asks: “How do we keep the business operating and recover critical activities?”
Where BCM Connects With Other Management Systems
One of the advantages of an integrated management approach is that organizations do not need to treat every discipline as a separate island.
Business continuity can connect with areas such as:
- ISO 9001: Quality Management
- ISO 14001: Environmental Management
- ISO 45001: Occupational Health and Safety
- ISO 27001: Information Security Management
- ISO 27701: Privacy Information Management
- ISO 50001: Energy Management
- ISO 22301: Business Continuity Management
- ESG: Environmental, Social and Governance considerations
- Cyber Security: Protection of technology and information assets
- Supply Chain Management: Dependency and supplier resilience
When these areas are considered together, organizations can identify common risks, reduce duplication, and build a more connected management system.
The Most Common BCM Mistakes
Creating a Plan and Stopping There
A plan is only the starting point.
Preparedness requires people who understand and can execute the plan.
Making BCM an IT-Only Responsibility
IT is critical, but business continuity extends far beyond technology.
Operations, HR, procurement, facilities, finance, communications, security, management, and business functions may all have important roles.
Ignoring Suppliers
Your organization may be operationally ready while a critical supplier is not.
Supplier continuity should therefore be considered when identifying dependencies and recovery strategies.
Not Testing the Plan
An untested plan creates confidence. A tested plan creates evidence.
Not Updating the Program
Organizations change.
New technology is introduced. Suppliers change. Employees move. Facilities relocate. Processes are redesigned.
Business continuity must therefore be treated as a continual improvement process.
A Practical BCM Cycle
The Mandar Approach can be viewed as a simple continual cycle:
Identify → Understand → Prepare → Test → Respond → Recover → Improve
Identify what is critical.
Understand risks and dependencies.
Prepare realistic continuity strategies.
Test whether those strategies work.
Respond when disruption occurs.
Recover critical operations.
Improve using lessons learned.
The cycle then begins again.
How Do You Know If Your Organization Is Truly Prepared?
Ask your leadership team these questions:
- What are our five most critical business activities?
- How long can each activity remain unavailable?
- What are their most important dependencies?
- Which suppliers could stop our operations?
- Who has authority to activate our continuity plan?
- Can employees explain their role during a disruption?
- When was our plan last tested?
- What weaknesses were identified during the last exercise?
- Were those weaknesses corrected?
- Can we demonstrate that our recovery strategy works?
If these questions generate uncertainty, that uncertainty itself is useful information.
It tells you where to start.
Frequently Asked Questions About Business Continuity Management
What is Business Continuity Management?
Business Continuity Management is a structured approach that helps organizations prepare for, respond to, and recover from disruptions while maintaining critical business activities.
What is the Mandar Approach to BCM?
The Mandar Approach emphasizes a practical, integrated view of BCM that connects business priorities, risk, people, processes, technology, suppliers, leadership, recovery, and continual improvement.
Why is BCM important for businesses?
BCM helps organizations understand critical operations, prepare for disruption, establish responsibilities, reduce response uncertainty, and improve their ability to recover.
What is a Business Impact Analysis?
A Business Impact Analysis identifies critical business activities and evaluates the potential consequences of their disruption. It helps establish priorities for continuity and recovery.
How is BCM different from Disaster Recovery?
Disaster Recovery generally focuses on restoring technology, systems, applications, infrastructure, and data. BCM takes a broader view of maintaining and recovering critical business activities.
Should small businesses implement BCM?
Yes. Business continuity principles can be applied to organizations of any size. Smaller businesses can focus on their most critical processes, people, suppliers, systems, and dependencies.
How often should a business continuity plan be tested?
Testing frequency should reflect the organization’s risk profile, business requirements, regulatory obligations, contractual requirements, and changes to its operating environment.
Why is supplier continuity important?
A critical supplier failure can interrupt your operations even when your own facilities and employees are available. Understanding supplier dependencies can therefore be an important part of continuity planning.
Is BCM only about major disasters?
No. BCM can help organizations prepare for both major incidents and smaller operational disruptions, including system failures, equipment breakdowns, supplier interruptions, and loss of key personnel.
How can an organization improve its BCM program?
Start by identifying critical activities, understanding risks and dependencies, developing realistic continuity strategies, assigning responsibilities, testing plans, documenting lessons learned, and continually improving the program.
About the Author
Mandar Pandit
Owner & Director, ASPM Consulting
Mandar Pandit is the Owner & Director at ASPM Consulting, with expertise spanning Lean Management, Sustainability, ESG, Business Continuity, Information Security, Quality Management, Cyber Security, and organizational excellence.
His areas of expertise include LEAN Management, Sustainability, ESG, EcoVadis, TFS, ISO 27001, ISO 27701, ISMS, GDPR, BCMS, Cyber Security, ISO 9001, QMS, TQM, AS 9100, ISO 14001, GHG, ISO 45001, IATF 16949, and ISO 50001.
Through ASPM Consulting, Mandar works with organizations to strengthen management systems, improve operational performance, build resilience, manage risks, and address evolving requirements across quality, sustainability, information security, privacy, business continuity, and organizational performance.
His approach focuses on connecting compliance, operational excellence, sustainability, risk management, and business resilience with practical business outcomes.
Final Thought: Don’t Wait for the First Crisis to Test Your Readiness
Every organization has vulnerabilities.
Every organization has dependencies.
Every organization can experience disruption.
The difference is how prepared the organization is to respond.
Business continuity is not about predicting the future.
It is about preparing for uncertainty.
It is about knowing what matters, understanding what could go wrong, defining who will respond, and building the capability to keep critical operations moving.
The real measure of resilience isn’t whether disruption happens.
It’s what your organization does next.
Are you prepared to find out?
