Business continuity planning for workforce disruption

Business continuity, crisis management, emergency planning and IT disaster recovery are connected, but they are not the same discipline and they do not discharge the same obligations. Crisis management is the leadership response in the acute phase. Emergency planning deals with immediate threats to people and premises, and in Australia it is governed by enacted work health and safety or occupational health and safety law in each jurisdiction rather than by any continuity framework. Disaster recovery is the technical restoration of systems and data. Business continuity is the wider capability that keeps prioritised activities running at an acceptable level while those other processes do their work, and that brings the organisation back to normal operation in a controlled way.

The workforce dimension is the part most often left implicit. Plans frequently describe which systems must be restored and in what order, without stating who is expected to perform the prioritised work, what authority they hold, what happens when they are unavailable, and which options for changing work, hours, duties or location are lawfully available. A continuity plan is a management instrument. It cannot override employment, industrial, work health and safety, privacy, consultation, discrimination or contractual obligations, and it cannot create a right to vary those arrangements that does not otherwise exist under an award, enterprise agreement, contract or statute.

ISO 22301:2019 is a voluntary requirements standard for a business continuity management system, updated by Amendment 1:2024; the ISO public overview material sets out the general approach. Certification is optional. Neither certification nor a well-run exercise establishes or proves legal compliance or real operating capability, and an organisation that never seeks certification can still adopt the useful disciplines: impact analysis, prioritisation, tested options, defined authority and verified evidence.

A workforce-aware business impact analysis begins with activities rather than departments. For each prioritised activity, the analysis records what the activity delivers, who depends on it internally and externally, what happens as disruption extends across defined time bands, and the point at which consequences change in character rather than degree — a delay becomes a safety issue, a service failure becomes a regulatory notification, a backlog becomes irrecoverable. Those thresholds are more useful than a single recovery-time figure, because they tell decision-makers when the response must change.

Tolerances should be expressed as the minimum acceptable level of service and the minimum capacity required to deliver it, not as an aspiration to maintain normal output with fewer people. That distinction matters. Stating that a function can run at sixty per cent capacity for five working days is a planning assumption that must be tested; asserting it without examining workload, skills, supervision and safety is a way of importing risk into the plan. Where an activity cannot be performed safely or lawfully below a given staffing level, that floor belongs in the analysis as a stop-work threshold with a named person authorised to suspend the activity.

The analysis should also record the sequence in which activities resume, the backlog each will generate, and who is authorised to defer or suspend non-critical work so that capacity can be redirected. Deferral decisions made in advance are far easier to execute than deferral decisions negotiated during disruption. No single metric or template is universally mandated; the useful test is whether the analysis supports a decision that a leader would actually be prepared to make and defend.

Dependency mapping fails when it stops at job titles. A title tells you almost nothing about whether the work can continue. The map needs to reach the attributes that actually make the work possible: specific skills and current licences or registrations; tacit knowledge held by long-tenured people and never written down; formal decision authority and financial or operational delegations; system permissions and administrative credentials; physical access to sites, plant or secure areas; and the hand-offs that connect the activity to upstream and downstream teams.

External dependencies deserve the same treatment. Labour hire, contractors, professional service providers, managed service vendors and outsourced payroll or contact-centre functions all carry their own workforce risk, and their continuity arrangements are rarely visible unless someone asks. Contractual service commitments are not the same as tested capability, and a supplier's continuity plan may assume access to the same labour pool the organisation is relying on.

Single points of failure become tractable once they are named. Cross-training, documented short-form runbooks and planned succession reduce single-person dependence, but they must be honest about their limits. A runbook does not confer competence, and cross-training does not confer a licence, a supervisory qualification or a delegated authority the person does not hold. Where a task legally requires a particular licence, authorisation or level of supervision, the continuity option is to arrange a genuinely qualified alternate in advance — not to assume the task can be covered informally.

The matrix below is a planning aid. It frames the questions leaders should be able to answer before disruption, the options that may be available, and the evidence that shows whether a control works. It does not determine legality. Whether a particular response is available in a given situation depends on the applicable instrument, contract and statute and on the facts, and fact-specific questions belong with a qualified legal adviser.

The value of a continuity plan lies in options that have already been tested for lawfulness. Under time pressure, organisations reach for whichever lever appears closest to hand, and the levers that appear closest are often the ones with the most conditions attached. Stand down is the clearest example. It is not a general continuity option and not an automatic right to stop pay: its availability depends on the Fair Work Act or an applicable enterprise agreement or contract term, and on the facts, including whether employees can be usefully employed because of a stoppage for which the employer cannot reasonably be held responsible. The Fair Work Ombudsman's stand-down guidance is a starting point, not a substitute for advice on a specific set of facts.

The same discipline applies to alternative duties, changes of location or hours, direction to take leave, reduced hours and temporary redeployment. Each depends on the source of the authority relied on — an express contract term, an award or enterprise agreement provision, a statutory power, or the employee's agreement — and several will engage consultation obligations about major change or roster change. Employment, award, agreement, general protections, discrimination, leave and pay obligations continue during disruption. A plan that assumes a change can simply be directed because the circumstances are exceptional is a plan that generates a second dispute on top of the first.

The practical approach is to record, for each option, the authority relied on, the conditions attached, who may approve it, what consultation or agreement is required, and the point at which legal advice must be obtained before use. Where major change or restructuring is contemplated as an outcome rather than a temporary measure, the separate obligations discussed in the guide to employee communication during restructure apply and should not be collapsed into the continuity response.

Disruption exposes ambiguity in authority faster than it exposes any other weakness. The plan should name the continuity lead, the incident controller or crisis lead, the operational owner for each prioritised activity, the human resources or workplace adviser, the work health and safety lead, the communications lead, the privacy and security lead, the payroll and finance owner, and the executive authorised to commit expenditure or approve exceptions. For each, it should name at least one alternate who is genuinely available and has been briefed.

A responsibility matrix is useful only when the authority behind it is real. That means confirming that delegations are documented and current, that the alternate can actually exercise them, that escalation thresholds are stated in observable terms rather than as judgement calls, and that the people named have exercised the role in an exercise at least once. Delegations that exist only in a plan tend to fail at the first approval that requires a signature, a system permission or a bank authorisation.

Escalation should be defined by trigger rather than by seniority instinct: a stop-work threshold reached, a safety incident, a suspected data breach, an approach from a regulator or union, a decision requiring legal advice, or disruption extending beyond a stated tolerance. Recording who decided what, on what information and at what time is part of the operating discipline, not an administrative afterthought; those records are what allow the organisation to explain its decisions afterwards.

Communication capability depends on channels that have been verified recently. Contact details decay, personal numbers change, distribution lists inherit people who have left, and the intranet is unavailable in precisely the scenarios where it is most needed. Primary and fallback channels should be tested, and the test recorded. Messages should be prepared for distinct audiences — affected employees, managers, employees not directly affected, contractors and labour hire, customers, suppliers, and representatives or regulators where relevant — because a single all-staff message rarely serves any of them well.

Content discipline matters more than speed. Each message should distinguish what is known, what is not yet known, what is being done and when the next update will come, and should be accessible to employees with disability, employees who do not work at a screen and employees whose first language is not English. It is not universally true that an immediate holding message is the better course: in some situations a short delay to verify facts prevents a correction that damages credibility. What should be fixed in advance is the cadence and the person authorised to issue updates, not a promise about timing that the organisation cannot keep.

Consultation obligations continue during disruption. Work health and safety consultation with workers and health and safety representatives applies to emergency arrangements and to changes affecting health and safety — Safe Work Australia's material on emergency plan duties describes the model-law position, which has effect only as enacted in each jurisdiction. Industrial consultation obligations under an award or enterprise agreement are separate, with their own triggers.

Privacy obligations also continue. Workforce contact details, emergency contacts, and any health information collected during disruption must be collected, used, disclosed, secured, retained and destroyed lawfully. The OAIC's guidance on emergencies and disasters explains that particular permitted handling arrangements have a defined scope and conditions; an emergency does not operate as a general waiver. The federal employee-records exemption is limited in the entities, records and handling activities it covers, and should not be assumed to apply to every organisation or to every record created during a disruption.

Degraded operation is the condition in which safety risk most often increases. Fewer people do more work, supervision thins, unfamiliar staff perform unfamiliar tasks, manual workarounds replace system controls, and hours extend. Duties under the applicable enacted work health and safety or occupational health and safety law continue in full, and continuity arrangements are themselves a change to the way work is carried out. Safe Work Australia's overview of emergency plans reflects the model laws, which apply in a jurisdiction only as enacted there. Victoria has not adopted the model laws; Victorian duties arise under the Occupational Health and Safety Act 2004 (Vic) and its regulations, expressed in terms of employers and employees rather than PCBUs and workers, and Victorian arrangements should be described in Victorian terms.

The hazards worth planning for in degraded operation are predictable: fatigue from extended hours and consecutive shifts; excessive demands and low job control; role ambiguity when authority shifts; remote or isolated work introduced at short notice; exposure to distressed customers, aggression or traumatic material; and the cumulative effect of prolonged uncertainty. Fatigue limits and workload thresholds should be stated in the plan and treated as controls rather than guidance, with a named person authorised to stop or reduce work when they are reached.

Support arrangements have a role, but they are not controls for work design. An employee assistance program does not reduce workload, restore supervision or fix an unsafe manual workaround. Where a continuity arrangement is expected to run for more than a short period, the psychosocial dimensions should be assessed in the same way as any other change to work; the material on managing psychosocial risk during organisational change sets out that approach in more detail.

Most continuity testing measures whether a document exists and whether people can find it. Useful testing measures whether the organisation can operate. That means exercising the things that fail in practice: the call tree with real numbers dialled; role failover with the nominated alternate actually making the decisions while the primary is unavailable; the manual workaround performed end to end by the people who would perform it; a payroll or core-system outage run through to reconciliation; and a recovery rehearsal that includes the backlog, not only the restoration.

An exercise needs the same structure as any other controlled activity: stated objectives, explicit assumptions, injects that change conditions mid-exercise, independent observers, safety boundaries so the exercise itself does not create risk, and a record of what was observed rather than what was intended. Where an exercise is designed so that it cannot fail, it produces reassurance and no information. It is more useful to run a narrow exercise that surfaces two real defects than a broad one that confirms the plan reads well.

Every exercise should close with findings that have owners, due dates and a verification step confirming that the change was made and works. Frequency depends on risk and rate of change rather than a fixed rule: material changes to structure, systems, sites, suppliers or key personnel are better triggers than the calendar, though most organisations benefit from at least an annual cycle that touches each critical activity over time.

Recovery is a phase to be managed, not the absence of disruption. It should begin with stated restoration criteria — what must be true before an activity returns to normal operation — and a deliberate review of every temporary control introduced during the response. Manual approvals, elevated system access, relaxed segregation of duties, temporary delegations and short-term supplier arrangements should each be either formally retained with justification or withdrawn, and the withdrawal recorded.

Accumulated work is where recovery most often goes wrong. Backlog should be prioritised on the same basis as the original impact analysis, with explicit decisions about what will not be recovered, and communicated to the customers, regulators or internal stakeholders affected. Clearing a backlog by asking an already-depleted workforce to absorb it is a fatigue and psychosocial risk in its own right, and should be planned with the same limits that applied during the response.

The closing steps are administrative but consequential: reconcile data created under manual controls, return delegated authority to the substantive holders, confirm that access granted during the disruption has been revoked, meet or renegotiate commitments made to customers and regulators, and run an after-action review that records what actually happened, which assumptions held, which did not, and what will change. Findings should feed back into the impact analysis and the dependency map rather than sitting in a standalone report.

Example A — payroll and core-system outage with reduced availability. A services organisation loses its payroll and rostering platform on the Tuesday of a pay week while an absence cluster has already reduced available staff by around a quarter. The continuity lead applies the impact analysis: client-facing delivery for two priority contracts and the pay run itself are held at minimum service, while internal reporting, non-urgent onboarding and scheduled audits are formally deferred with a dated record. Time capture reverts to a pre-agreed offline method with supervisor verification, and manual approval limits are activated with restricted access and a log of every approval. Payroll and finance propose provisional payments based on the previous cycle for employees whose hours cannot be verified in time; the authorised executive approves the approach on advice, and a correction path with a stated date is set for the following cycle. Communications go out through a verified fallback channel, distinguishing what is known from what is not, and are repeated on a stated cadence. Fatigue limits are applied to the payroll team despite the pressure, with a second-day handover rather than extended shifts. On restoration, every provisional payment is reconciled, variances are identified and corrected, elevated access is revoked, and the after-action review notes that the offline time-capture method worked but that two supervisors had never used it. That becomes a training action with an owner and a verification date. The outage is contained, but not costlessly: the deferred audits still have to be rescheduled and one contract commitment is renegotiated.

Example B — notified industrial action affecting a critical operation. A distribution operation receives notice of proposed industrial action affecting a shift that supports a time-critical service. The organisation's first step is to obtain legal advice on the notice, the status of the proposed action and what it may and may not lawfully do in response; nothing about pay, engagement of other labour or the response to employees is decided before that advice is received and recorded. Continuity planning proceeds on the questions that are properly management questions: which activities are prioritised, what the safe minimum staffing level is, at what point the activity would be suspended rather than run understaffed, and which customer commitments would be varied. The work health and safety lead assesses the safety of any altered arrangement, and consultation with workers and health and safety representatives about those safety arrangements proceeds under the applicable enacted law. Communications are factual and neutral, avoid commentary on the merits of the dispute or on employees' choices, and are checked before issue. Established representative and dispute-resolution channels are used rather than bypassed. Escalation points are set in advance: a change in the notice, a safety threshold reached, or any proposal that could affect employees' entitlements or workplace rights goes back to the adviser and to legal advice before action. The evidence retained includes the notices, the advice sought, the safety assessments, the minimum-service decisions and the communications issued. The operation runs at reduced service for the period; the organisation cannot guarantee that outcome in advance, and the plan says so.

Australian Workplace Strategies, a division of Parke Corporation Pty Ltd, is a workplace consultancy. AWS assists employers with workforce-aware business impact analysis, continuity governance design, scenario development and facilitated tabletop exercises, consultation and communication design, assurance reviews of existing plans, and the workflow and evidence support available through GRC technology and Strobe. Where a continuity program needs to sit inside a broader compliance structure, the approach described in the guide to a workplace compliance framework that is monitored and evidenced is a useful reference point.

AWS does not provide legal advice. Questions about whether a stand down is available, whether a direction may lawfully be given, how a particular award or enterprise agreement term operates, the status and consequences of industrial action, or the application of privacy or work health and safety law to a specific set of facts should be referred to a qualified legal adviser, and the plan should say when that referral is mandatory rather than optional.

A platform supports continuity governance; it does not constitute it. Software can hold approved plan versions, dependency maps, delegations, contact-verification records, exercise findings and corrective actions, and can make overdue items visible. Accountability for the decisions those records describe remains with the named owners and the executive. Where the employment or industrial dimensions of a scenario are material, workplace advisory support alongside legal advice is usually the more efficient path.