Climate risk is no longer a future scenario for UK businesses. It is becoming part of the operating environment.
Flooding, extreme heat, water shortage, wildfire conditions and pressure on utilities are no longer risks that sit neatly in the “unlikely but serious” corner of a risk register. They are happening more often, affecting wider areas and creating practical problems for sites, staff, suppliers and customers.
That creates a useful but awkward question for business continuity: when does a risk stop being an exceptional scenario and start becoming something the organisation has to manage as part of day-to-day operations?
Business continuity still gives us a useful frame
There is a fair argument that, once something becomes likely enough, it should move out of the business continuity plan and into normal operational management. If flooding affects your premises every winter, it is not really a “what if” scenario anymore. It is a premises, estates, insurance and operating model problem.
But I would not throw business continuity out of the conversation too quickly.
Business continuity planning is still a useful way to think about climate-related disruption because it forces a simple discipline: what could we lose, what would the impact be, and how would we continue our most important activities?
Most good continuity plans are written around effects rather than causes. They do not need a separate response for every possible incident. They deal with the consequences:
- loss of premises
- loss of IT
- loss of people
- loss of utilities
- loss of key suppliers
- loss of access to a site
That approach still works. It keeps plans manageable and avoids the trap of writing a different plan for every possible version of disruption.
Where climate risk changes the assumptions
The issue is not that a business’s existing continuity scenarios are irrelevant. It is that some of the assumptions behind them may no longer hold.
A traditional loss-of-site plan might assume that staff can work from home, travel to another office, or use an alternative facility. A supplier failure plan might assume that another supplier can step in. A utility failure plan might assume that disruption is local, temporary and recoverable within a fairly predictable period.
Climate-related incidents can be different.
A major flood, heatwave, water shortage, wildfire or regional energy disruption may affect a whole area at once. Staff may be dealing with disruption at home. Roads and rail links may be affected. Alternative premises may be inside the same impact zone. Suppliers may have the same problem. Emergency services and utilities may be stretched. Recovery may not have a clear start and end point.
That is where some business continuity plans start to look more fragile than they appear on paper.
The plan may say “relocate to alternate site”. Fine. But is that site far enough away? Can people get there? Does it rely on the same power, water, transport routes, telecoms providers or local authority services? The plan may say “use remote working”. Fine. But what if staff are affected by heat, childcare closures, travel disruption, local flooding, poor air quality, or intermittent power at home?
The problem is not usually the plan wording. It is the recovery strategy underneath it.
Do we need climate-specific runbooks?
Possibly. But with care.
There is a temptation to respond to every emerging risk by writing another plan. Flood plan. Heatwave plan. Water shortage plan. Wildfire plan. Energy disruption plan. Before long, nobody knows which plan to open, and the organisation has more paperwork than capability.
A better approach is to keep the core BCP simple and create a small number of climate-related incident runbooks where they genuinely help.
Those runbooks should not repeat the BCP. If the organisation already has short consequence-based runbooks, the climate runbook should point to the relevant ones. If it relies on a single, larger BCP document, the climate runbook should point people to the relevant sections. Either way, the BCP still covers the consequences: loss of site, loss of access, loss of utilities, staff availability, supplier disruption and so on. The climate runbook helps the organisation manage the specific incident, identify which parts of the BCP are likely to be needed, and flag the assumptions that may no longer hold.
For example, a flood runbook might set out the warning signs, trigger points, early decisions, likely impacts and assumptions that need checking. If the loss-of-site runbook is needed, the flood runbook should prompt the team to ask whether the alternate site is outside the affected area, whether staff can travel safely, whether remote working is realistic, whether suppliers and couriers are also disrupted, and whether recovery is likely to take longer than usual.
These runbooks should not try to predict every detail. Some climate incidents develop slowly; others escalate quickly, but most come with uncertainty. The value is in setting out:
- early warning signs
- trigger points for escalation
- decisions that may need to be made
- dependencies likely to fail
- staff welfare considerations
- communications requirements
- actions to take before the situation becomes urgent
In practical terms, a flood runbook might help the organisation decide when to move stock, close a site, notify customers, divert deliveries or switch to remote operations. A heatwave runbook might focus on staff welfare, safe working conditions, cooling, vulnerable locations, IT rooms and operational productivity. A water shortage runbook might identify which activities depend on water and how those activities would be prioritised if restrictions tighten.
The runbook is not there to replace judgement. It is there to give the team a better starting point before pressure builds.
The more important work may sit outside the BCP
This is the part organisations can easily miss.
Business continuity can help expose the weakness, but it does not always own the fix.
If a site is increasingly exposed to flood risk, the answer may be drainage, barriers, relocation of equipment, changes to leases, insurance review or a longer-term premises decision. If heat is affecting productivity or safety, the answer may be building design, cooling, working patterns, welfare arrangements or changes to maintenance regimes. If water shortage could affect operations, the answer may be process redesign, storage, supplier agreements or clear prioritisation rules.
Those are not just BCP actions. They sit with estates, facilities, operations, procurement, finance, health and safety, risk and senior management.
This is where the conversation starts to move from business continuity planning into operational resilience: not just how the organisation responds, but how it reduces exposure in the first place.
That is why climate risk needs to be linked across the organisation. A BCP exercise might identify that an alternate site would not work during a regional flood. Good. But the next question is not “how do we describe that better in the plan?” It is “what are we going to do about it?”
A practical way to start
For most organisations, the sensible first step is not to create a large standalone climate continuity programme. It is to stress-test existing arrangements against a few realistic climate scenarios, then decide where a specific climate runbook would add value.
Ask, for example:
- What if this incident affects the whole region, not just us?
- What if staff, suppliers and customers are affected at the same time?
- What if transport disruption prevents people getting to the alternate site?
- What if remote working is available, but staff homes are also affected?
- What if the disruption develops slowly over several weeks rather than starting suddenly?
- What if recovery depends on a utility, supplier or public service that is also under pressure?
These questions quickly show whether the existing plan is genuinely resilient or just tidy.
They also help separate three different types of action:
- things to add to the continuity plan
- things to turn into climate-related runbooks
- things that need operational investment or management action outside the BCP
So what should change?
Climate-related disruption does not mean every organisation needs a completely new business continuity model. The core principles still work. Understand your critical activities. Understand your dependencies. Plan for the loss of important resources. Test your assumptions. Improve the strategy where it falls short.
But climate risk does make those assumptions more important.
If flooding, extreme heat, water shortage, wildfire conditions and energy disruption become more frequent, then business continuity plans cannot treat them as distant, isolated events. They need to test what happens when disruption is regional, prolonged and shared by the very people and organisations you expect to help you recover.
BCP is a good way to understand the consequences. Operational resilience is how organisations reduce the exposure.
That is the real shift: not a duplicate set of climate plans sitting apart from the BCP, but a more honest test of whether existing recovery strategies would work in the climate they are now operating in.