Risk Management
Business Continuity Planning for Business Groups
By ATTPL HOLDCO / ATTPL GROUP Editorial Team · · 3 min read
A practical business continuity plan for multi-company groups: risk assessment, critical processes, IT backup, crisis team, communication and testing.
What a business continuity plan covers
A fire at a warehouse, a ransomware attack, a flood that closes roads for days, the sudden loss of a key supplier or a senior manager: any of these can stop a business. For a group with several companies, one disruption can spread quickly through shared systems, people and finances. Business continuity planning prepares the organisation to keep critical work running and recover quickly. This guide sets out a practical approach.
A business continuity plan (BCP) is a documented set of steps that helps an organisation continue its most important activities during a disruption and return to normal afterwards. It covers people, premises, technology, suppliers, finance and communication. A disaster recovery plan, which focuses on restoring IT systems and data, is one important part of the wider BCP.
Step 1: Identify critical processes
List the processes in each company and ask a simple question for each: how long can we stop this before serious harm is done to customers, finances, safety or compliance? Payroll, customer orders, cash management, statutory filings and safety-critical operations usually rank high. For each critical process, agree the maximum acceptable downtime and the minimum resources needed to keep it running.
Step 2: Assess the risks
- Natural events: floods, extreme heat, storms and earthquakes, depending on location.
- Technology: server failure, cyber attacks, data loss and internet outages.
- People: loss of key staff, health emergencies, strikes.
- Supply chain: failure of a single-source supplier or transporter.
- Financial: sudden loss of a major customer or delayed payments.
- Regulatory: licence suspensions or sudden rule changes.
Rate each risk for likelihood and impact, and focus planning on the combinations that would hurt critical processes most.
Map dependencies across the group
Group companies often share more than they realise: one data centre, one payroll system, one bank account for collections, one transporter or one senior finance team. A disruption to any shared resource affects every company at once. Draw a simple dependency map that shows which companies rely on which shared people, systems, suppliers and premises, and make sure the most important shared resources have their own backup arrangements.
Step 3: Build recovery options
For each critical process, document how work will continue: alternate work locations or remote working, backup suppliers and transporters, cross-trained staff, manual workarounds when systems are down, and cash buffers or credit lines for short-term shocks. Keep contact lists and key documents available offline as well as in the cloud.
Step 4: Protect technology and data
Back up critical data regularly, keep at least one copy offline or in a separate location, and test restoration, not just the backup itself. Use multi-factor authentication, keep systems patched and train staff to spot phishing. CERT-In, India's national computer emergency response team, issues directions on reporting cyber incidents, so make sure your incident response plan reflects current requirements. ATTPL IT can help design backup and recovery for business systems.
Step 5: Form a crisis team and communication plan
Name a small crisis management team with clear roles: decision-maker, operations lead, IT lead, HR lead, finance lead and communications lead, each with a deputy. Prepare message templates for employees, customers, suppliers, banks and regulators. During a crisis, timely, honest communication protects trust as much as quick recovery does. Up-to-date employee contact data in a system such as ATTPL HRMS makes it easier to reach people fast.
Step 6: Test, learn and update
A plan that has never been tested will fail when it is needed. Run a short desk-top exercise each year in which the crisis team walks through a realistic scenario, and test IT recovery at least once a year. Update the plan after every exercise, real incident, office move or major system change. Insurance cover, such as fire and business interruption policies, should be reviewed at the same time; ATTPL Finance can help businesses review insurance options.
Building resilience across the ATTPL group
ATTPL HOLDCO works with its group companies on governance, shared services and risk. Read about our approach to internal audit for group companies, explore our services, or contact us to start a conversation.
Frequently asked questions
What is the difference between a BCP and a disaster recovery plan?
A BCP covers how the whole business keeps critical work going during a disruption. A disaster recovery plan focuses on restoring IT systems and data, and is one part of the BCP.
How often should a business continuity plan be tested?
At least once a year, through a desk-top exercise and an IT recovery test, and again after major changes in the business.
Do small and mid-sized companies need a BCP?
Yes. Smaller firms often have less cushion to absorb a disruption, so even a simple, well-tested plan can make a big difference.
