Business Continuity Review Document Checklist for Clients

This checklist supports clients to select and send the most relevant documents for their Chosen Review Package. If a document does not exist, the nearest equivalent can usually be substituted.

---

1. Basic – Continuity Snapshot

This package is designed to give a concise independent view of current continuity material, with priority findings and practical next steps.

Please provide up to 3 documents:

• BCM policy, continuity framework, or top-level business continuity plan
• One current business continuity plan for a critical business area or service
• Most recent exercise report, test report, or post-incident review

---

2. Standard – Resilience Review + Call

This package supports a more structured review of continuity and resilience arrangements, with key gaps, strengths, recommended actions, and a 30-minute advisory call.

Please provide up to 6 documents:

• BCM policy, continuity framework, or top-level business continuity plan
• Current enterprise risk register, with continuity or disruption risks if available
• Latest BCM risk assessment, if separate from the enterprise risk register
• One completed and approved BIA for a critical business unit or service
• One current business continuity plan for a critical business area or service
• Crisis or incident management plan with contact list

If available, exercise reports may also be included where they are more informative than a separate BCM risk assessment.

---

3. Premium – Capability Review + Call

This package supports a broader view of continuity and resilience capability, with written findings and a 60-minute advisory call (or two 30 minute calls).

Please provide up to 9 documents:

• BCM policy, continuity framework, or top-level business continuity plan
• Current enterprise risk register, with continuity or disruption risks if available
• Latest BCM risk assessment, if separate
• Completed and approved BIA for a critical business unit or service
• Documented continuity strategies or recovery strategy summary
• One current business continuity plan for a critical business area or service
• Crisis or incident management plan with contact list
• Last 2–3 exercise reports, test reports, or action logs
• Latest BCM audit report, independent review, or management review minutes

If available, a post-incident review from the last 2–3 years may be included in place of one exercise report.

---

Notes

• PDF, Word, Excel, and PowerPoint files are all acceptable.
• Draft documents can be provided, but approved versions are preferred.
• If unsure, send the closest equivalent and note what it is.
• NB Redaction of sensitive names, contacts, or commercial details is acceptable.

---