Business continuity planning for workforce disruption

Business continuity is the planning, capability and recovery framework that supports the organisation through disruption. It is broader than crisis response — crisis response is the acute phase, while continuity is the sustained capability that allows the organisation to operate through the disruption and recover from it. Programs that focus only on response tend to underinvest in the recovery and continuity capability that determines how long disruption actually lasts.

Workforce disruption sits at the centre of most continuity scenarios, even when the proximate cause is technological or environmental. Illness clusters, key-person loss, industrial action, evacuation, system failure that prevents people working, and extended absence patterns each create disruption that workforce-aware planning can absorb and that workforce-unaware planning amplifies. This article focuses on the workforce dimension; the supporting governance technology that holds the obligations and evidence is described under GRC technology and the Strobe platform.

Business impact analysis should explicitly consider workforce capacity, key-person dependence and the conditions under which people can continue to operate. Pure-process analysis often understates dependencies that only become visible when the people who actually do the work are unavailable.

Workforce-aware impact analysis surfaces dependencies that other approaches miss — single points of expertise, knowledge concentrated in long-tenured staff, capability that exists informally but is not documented, and informal coordination networks that hold the operating model together below the formal structure. Each of those dependencies is a continuity risk that can be addressed in steady state but not at the point of disruption.

Critical roles should be identified explicitly — not just senior roles, but the roles whose absence would materially affect the ability to operate. For each critical role, the organisation should have at least a basic understanding of cover arrangements, cross-training and the documentation needed for someone else to step in temporarily.

Cross-training and short-form documentation are usually a better investment than detailed procedure manuals. The aim is to enable someone with adjacent knowledge to operate the role at a workable level for a defined period, not to enable an unfamiliar person to operate it indefinitely.

Realistic scenarios sit at the centre of useful continuity planning. Illness clusters, key-person loss, industrial action and system failure are each worth testing, alongside scenarios specific to the organisation's operating context — evacuation, supply chain disruption, regulator action, public incident.

Scenarios should be tailored to the organisation's actual operating context rather than drawn from generic templates. The point of scenario planning is to surface the specific weaknesses that matter, not to populate a register with abstract risks. A small number of well-tested scenarios produces more useful capability than a large number of untested ones.

Roles, decision rights and escalation paths should be defined and rehearsed before they are needed. A clear RACI — who is responsible, who is accountable, who must be consulted and who must be informed — for each scenario removes the need to negotiate roles at the point of disruption.

Rehearsal exposes the gap between defined roles and operational reality. Even a tabletop exercise will surface assumptions that did not hold, dependencies that were not mapped and decisions that did not have a clear owner. Plans that have never been rehearsed are difficult to rely on in conditions that did not exist when they were written.

Communication during disruption depends on contact arrangements that work outside normal operating channels. A current contact tree — verified, with primary and alternate channels — should be part of the program rather than assembled at the point of need.

Workforce communication should be calibrated to what is known, what is not yet known and what is being done. Silence in the early hours of a disruption is one of the most consistent contributors to escalation; an early holding message followed by a planned cadence is almost always better than waiting until the position is fully clear.

Continuity planning that ignores WHS and employment systems generates risk in the response itself. WHS and employment obligations do not pause during disruption — duty of care, consultation obligations, leave and pay entitlements, and contract terms all continue to apply.

Plans that have not considered how those obligations will be met in response conditions tend to produce secondary issues that compound the original disruption. Integration with HR, WHS and operational systems should be planned, with input from workplace advisory where the employment dimensions of a scenario are complex.

Plans that are not tested are difficult to rely on. A defined testing and improvement cycle — tabletop exercises, scenario walk-throughs, after-action reviews — is part of a working continuity program rather than an optional extension to it.

Testing should produce learnings and improvement actions, not only assurance. The most useful continuity programs treat each test as an opportunity to surface weaknesses and address them. Evidence of the program — plans, test records, action closure, training delivery — should be retained in a coherent set rather than scattered across folders, and is well suited to being held alongside other governance evidence in a GRC platform.

AWS supports employers in designing workforce-aware business continuity plans, running tabletop exercises, reviewing existing plans against current operating context and integrating the program with WHS, employment and GRC governance.