Most organisations don’t need a new business continuity plan.
They already have one.
The problem is that it no longer reflects how the business works, and it isn’t trusted when something actually happens.
That’s what a refresh is supposed to fix.
The issue is that many refreshes don’t change anything. You get an updated document, but the same behaviours in an incident.
To avoid that, you need to be clear on three things:
- what’s wrong (assessment)
- what needs to change (the work)
- what good looks like (outputs)
Most organisations blur these together. That’s where refreshes lose value.
If you’re starting from an existing plan, begin with a gap assessment to understand what will fail under pressure. We’ve covered that here: Business Continuity Planning: How to Review Your BCP. Once you’re clear on what needs to change, this guide explains what a refresh actually involves and how to scope it properly.
1. Start with assessment: what’s actually broken
Before you do any work, you need a clear view of where the current plan fails.
This is the role of a gap assessment.
It should answer questions like:
- what breaks first in a real disruption
- where roles and escalation are unclear
- whether recovery assumptions are realistic
- whether the plan is usable under pressure
This is not about scoring maturity.
It’s about understanding failure.
A gap assessment gives you a baseline:
where are we today, and what would go wrong?
Without this, a refresh is guesswork.
2. The refresh itself: what work actually needs to happen
Once you’re clear on the gaps, the refresh is the work required to fix them.
This is where most organisations fall into the trap of “update the document”.
A proper refresh is broader than that.
Re-engage the business
Plans drift because people disengage.
You need to:
- bring stakeholders back into the process
- re-establish ownership
- make the plan relevant to how decisions are actually made
Train the business
A plan people don’t understand won’t be used.
The refresh should include:
- walkthroughs of response
- clarity on expectations
- confidence in roles
Review the impact profile
The business has changed. The plan needs to reflect that.
Check:
- critical services and value streams
- stakeholder expectations
- dependencies (people, suppliers, systems)
- acceptable downtime
If you don’t update this, you prioritise the wrong things.
Review the risk profile
Risks evolve.
A refresh should ensure:
- emerging threats are captured
- cyber is properly integrated
- operational dependencies are understood
Review recovery strategies
This is where most plans are weakest.
You need to test whether:
- recovery approaches are realistic
- sequencing makes sense
- dependencies have been thought through
Develop scenario-based response (where needed)
If the plan doesn’t properly cover real events, fix it.
For example:
- ransomware
- SaaS outage
- loss of site or supplier
This is about making response tangible, not theoretical.
Review roles and responsibilities
As organisations change, plans don’t keep up.
Check:
- whether the structure still works
- whether roles reflect reality
- whether the right people are assigned
Identify and prioritise gaps
This is the core output of the work phase.
Not every issue gets fixed immediately.
But you should leave with a clear view of:
- what’s missing
- what’s unrealistic
- what needs to change
3. Outputs: what a refresh should leave you with
This is where your SOW blog ties in — outputs should be defined and agreed.
A strong refresh should result in:
- updated continuity plans aligned to the current business
- clear roles and escalation structures
- realistic recovery strategies
- scenario-based runbooks
- defined manual workarounds
- training and awareness across key teams
- evidence of testing or readiness to test
- a prioritised gap list and improvement roadmap
The key point:
outputs are the result of the work — not the work itself. If you need to define this work commercially, see our guide to structuring a scope of work and deliverables for a BCP refresh: 10 Deliverables for a BCP Refresh Scope of Work
Why most refreshes don’t work
Most refreshes skip the structure above.
They:
- blur assessment and delivery
- focus on updating documents
- don’t challenge assumptions
- don’t involve the right people
So they achieve:
- better formatting
- the same risk
What good looks like
A good refresh doesn’t just improve documentation.
It:
- reflects how the business actually operates
- defines how it responds under pressure
- rebuilds trust in the plan
- shows where the gaps are and how to fix them
Final thought
A business continuity plan refresh should be simple to understand:
- assessment tells you what’s broken
- the refresh fixes it
- outputs prove it’s been done
If those three things aren’t clear, the refresh won’t deliver what you need.