Business Continuity Management, BCP and Crisis Leadership Training

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

Why Continuity Plans Fail

The recurring failure patterns: plans written to satisfy an auditor, untested assumptions about staff availability and supplier capacity, single points of failure nobody mapped, recovery times set without the business agreeing them, and contact lists two reorganisations out of date. Establishing what business continuity covers and how it differs from disaster recovery, incident response and crisis management, and why conflating them leaves gaps.

Break

The BCM Framework and ISO 22301

Policy, scope, governance and roles, and the plan-do-check-act cycle applied to a business continuity management system. How BCM connects to enterprise risk management, to cyber incident response, and to sector regulator expectations including Bank Negara's RMiT policy for financial institutions and operational resilience expectations more broadly.

Business Impact Analysis

Identifying critical activities and separating them from the merely important. Mapping dependencies across people, systems, data, premises, suppliers and utilities. Setting maximum tolerable period of disruption, recovery time objective and recovery point objective, and validating them with the business rather than assuming them. Handling the department that declares everything critical, and using impact over time to force prioritisation.

Lunch

Threat and Risk Assessment

Working through the disruption scenarios that matter in the Malaysian operating context: flood, fire, prolonged power and telecommunications loss, cyber attack and ransomware, key supplier failure, loss of premises access, and workforce unavailability. Assessing likelihood and impact, and identifying the concentration risks that turn a single event into a multi-site outage.

Break

Continuity Strategy Selection

Options and their real costs: work area recovery, remote working, alternate sites, manual workarounds, cross-training, supplier redundancy and contractual continuity obligations, data backup and replication. Matching strategy to the recovery objectives set in the BIA, and being explicit when the affordable strategy cannot meet the stated RTO.

Writing a Business Continuity Plan People Can Use

Plan structure, activation criteria and who holds the authority to activate. Task cards, call trees, and the discipline of writing for someone who was not in the planning workshop. Version control, distribution and offline availability, because a plan stored only on the system that just failed is not a plan. Day 1 wrap-up.

Recap and Day 2 Objectives

Review of Day 1 and the structure of the exercise day.

Incident and Crisis Management Structure

Standing up a crisis management team: roles, deputies and succession, escalation thresholds and who decides. The separation between operational response and executive decision-making, battle rhythm and situation reporting, decision logs and why they matter afterwards, and the handover discipline that keeps a multi-day response coherent.

Break

Crisis Communications

Stakeholder mapping and sequencing, holding statements and the first hour, keeping staff informed as a priority rather than an afterthought, and customer, supplier and regulator notification. Media and social media handling. Coordinating continuity communications with PDPA breach notification and, for entities within scope, cyber security incident notification to NACSA under the Cyber Security Act 2024.

Crisis Leadership Under Pressure

Deciding with incomplete and contradictory information, resisting premature certainty, and recognising the cognitive traps that appear under stress. Managing team welfare, shift rotation and fatigue across a long response, and setting the tone that determines how people behave when the plan runs out.

Lunch

Facilitated Tabletop Exercise

A multi-stage scenario that escalates from a contained operational disruption into a full crisis with regulatory, customer and reputational dimensions. Participants form their own crisis team, activate a plan, allocate roles, communicate to stakeholders and log decisions under time pressure, with injects introduced as the scenario develops.

Break

Exercise Debrief and Lessons Learned

A structured hot debrief: what was decided, what was missed, where the plan failed to help and where it did. Capturing findings as owned actions rather than observations, and the discipline of closing them before the next exercise.

Exercising, Maintenance and Embedding

Building an exercise programme that escalates from walkthrough to functional to full simulation, choosing frequency, and setting the triggers that force a plan review outside the annual cycle. Awareness and training, internal audit of the BCMS, and management review. Key takeaways, next steps, and close.