Business continuity starts with deciding which activities matter most and how long you could manage without each one. Get that right on the critical functions sheet and the impact analysis, the continuity arrangements and the testing all follow from it.
Part of the alphaZ ER series of Excel registers, built for listings that grow and need to be sorted and filtered. Supplied in fully editable MS Excel format, with a Google Sheets version included, and all text in Calibri font for improved readability.
The register is set up with:
- Importance and Recovery Priority drop-downs that set the continuity priority automatically
- Likelihood and Disruption drop-downs that set the disruption potential rating
- Conditional formatting to highlight high priorities, higher risks and renewal dates that have passed
alphaZ documents - tried and tested registers with no junk, jargon or unnecessary columns,
developed over 25 years through practical use in the real world.
Further guidance on business continuity:
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in every alphaZ toolkit that covers ISO 22301, from the standalone ISO 22301 Toolkit to the integrated toolkits, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like a hand reviewing and testing your continuity arrangements, keeping the register current as the business changes, or with your wider business continuity management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Business Continuity Risk Register Template
A business continuity risk register template in Microsoft Excel format for identifying your critical functions, analysing the impact of disruption to each one, recording your continuity arrangements and keeping track of how they are monitored and tested. A Google Sheets version is included.
ISO 22301 requires a business impact analysis and a risk assessment to set continuity priorities and decide the arrangements needed, and a programme of exercises and tests to show those arrangements work. This register holds all of that in one workbook, and it is one of the first documents asked for when business continuity is looked at during ISO certification audits.
What's Included in this Business Continuity Risk Register
The workbook is laid out as separate sheets, each doing one part of the job:
- Context - who completed the assessment and when, the areas covered, risk communication requirements, and the assumptions the assessment is based on.
- Critical Functions - each function the business depends on, with Importance and Recovery Priority drop-downs that set its continuity priority automatically, the required resumption time, dependencies and supporting resources, interested parties and relevant legislation.
- Impact Analysis - each critical function picked from a drop-down and reviewed for potential disruption, with its continuity priority carried across, a disruption potential rating from Likelihood and Disruption drop-downs, the control measures and continuity arrangements, the maximum tolerable period of disruption (MTPD) and recovery time objective (RTO), a residual rating, additional treatment and a review of costs and benefits.
- Monitoring and Testing - each continuity arrangement to be checked or tested, its rating, who is responsible, how often, the renewal date and how the results are communicated, highlighted once the renewal date has passed.
- Instructions - the continuity priority and disruption potential tables behind the ratings, and the frequencies used in the drop-downs.
From Critical Function to Continuity Arrangement
The sheets are linked in the order the analysis is done. Deciding what matters comes first, on the critical functions sheet. The impact analysis then looks at what could disrupt each function and what is in place to reduce the likelihood of disruption, shorten it and limit its impact. Monitoring and testing closes the loop by showing the arrangements are checked rather than assumed. Because the priority and the disruption rating are both colour coded, a top-priority function with a high disruption rating is easy to spot.
Who Needs a Business Continuity Risk Register?
Any organisation implementing or maintaining ISO 22301, or an integrated management system that includes it. It is just as useful without certification in view - customers, insurers and tender questionnaires increasingly ask how you would keep delivering through a disruption, and a maintained register answers that with evidence rather than a statement.
Pairs with the Business Continuity Plan
The register is the analysis, and the plan is what people follow on the day. The continuity arrangements recorded here are written up in the F-Q94 Business Continuity Plan, and the results of each exercise or test can be recorded on the F-Q93 Continuity Test Record.
Blank Template and Sample Data Version
This file is supplied blank, ready for your own critical functions. A sample data version is included with an alphaZ subscription - the same register populated with typical critical functions such as IT systems, payroll, premises, production and customer support, each with its priorities, impact analysis, continuity arrangements and recovery times, and a monitoring and testing schedule.
Would you rather we prepared it for you?
A day of remote support can be spent on the risks to your business rather than to the person doing the task - business risk assessments written around your operation, your market and your dependencies, with your critical functions and continuity arrangements recorded in this register so the two agree.
Business Risk Assessment Preparation