Most organisations don’t need a new business continuity plan.
They already have one.
The problem is that it no longer reflects how the business works, and it isn’t trusted when something actually happens.
That’s what a refresh is supposed to fix.
The issue is that many refreshes don’t change anything. You get an updated document, but the same behaviours in an incident.
To avoid that, you need to be clear on three things:
Most organisations blur these together. That’s where refreshes lose value.
If you’re starting from an existing plan, begin with a gap assessment to understand what will fail under pressure. We’ve covered that here: Business Continuity Planning: How to Review Your BCP. Once you’re clear on what needs to change, this guide explains what a refresh actually involves and how to scope it properly.
Before you do any work, you need a clear view of where the current plan fails.
This is the role of a gap assessment.
It should answer questions like:
This is not about scoring maturity.
It’s about understanding failure.
A gap assessment gives you a baseline:
where are we today, and what would go wrong?
Without this, a refresh is guesswork.
Once you’re clear on the gaps, the refresh is the work required to fix them.
This is where most organisations fall into the trap of “update the document”.
A proper refresh is broader than that.
Plans drift because people disengage.
You need to:
A plan people don’t understand won’t be used.
The refresh should include:
The business has changed. The plan needs to reflect that.
Check:
If you don’t update this, you prioritise the wrong things.
Risks evolve.
A refresh should ensure:
This is where most plans are weakest.
You need to test whether:
If the plan doesn’t properly cover real events, fix it.
For example:
This is about making response tangible, not theoretical.
As organisations change, plans don’t keep up.
Check:
This is the core output of the work phase.
Not every issue gets fixed immediately.
But you should leave with a clear view of:
This is where your SOW blog ties in — outputs should be defined and agreed.
A strong refresh should result in:
The key point:
outputs are the result of the work — not the work itself. If you need to define this work commercially, see our guide to structuring a scope of work and deliverables for a BCP refresh: 10 Deliverables for a BCP Refresh Scope of Work
Most refreshes skip the structure above.
They:
So they achieve:
A good refresh doesn’t just improve documentation.
It:
A business continuity plan refresh should be simple to understand:
If those three things aren’t clear, the refresh won’t deliver what you need.