Why most housing BCPs don’t work in practice

Most housing organisations already have a Business Continuity Plan. The issue is not the absence of a plan, it is how it is used.

 

Plans exist but aren’t used during real incidents

Escalation is inconsistent or delayed

Decisions rely on instinct rather than agreed thresholds

Teams manage situations for too long before stepping up response

Across the sector, we see the same pattern. This is not because organisations are unprepared, it is because the link between everyday incident management and business continuity is missing.



We are extremely pleased with the service provided… the BCP is both robust and practical.
 
Director of Governance and Compliance, Housing Provider

Our approach

We do not start with templates or standards.

We start with how your organisation actually operates when something goes wrong.

1. Build a plan that reflects reality

We design Business Continuity Plans that are structured, clear, and usable under pressure.

They cover:

  • emergency response
  • crisis management
  • business recovery
  • roles, escalation and decision-making

Typically structured around clear sections so people know where they are and what to do at each stage.

This includes:

  • simple initial assessment checklists
  • clear escalation routes
  • defined roles from incident manager to crisis leader
  • practical recovery actions, not theoretical guidance

2. Connect BCP to operational response

The core of our work is joining up incident management and business continuity.

We work with you to:

  • define clear escalation triggers
  • align BCP roles with real-world responsibilities
  • introduce consistent decision-making thresholds
  • remove ambiguity around when to activate the plan

This creates a single, coherent response model rather than two separate systems.

3. Translate plans into departmental recovery

Most BCPs stop at the organisational level.

In practice, recovery happens in departments.

We work directly with teams to:

  • understand how disruption affects their day-to-day activity
  • identify dependencies on systems, suppliers and other teams
  • define realistic workarounds
  • build concise, role-based recovery plans

This approach is typically tested through structured exercises focused on real operational impact rather than theory.

4. Focus on decision-making, not documentation

Most failures are not caused by lack of planning.

They are caused by unclear decisions.

People are unsure:

  • when to escalate
  • when to activate the BCP
  • whether something is serious enough

We address this through:

  • clear escalation triggers
  • defined decision points
  • use of impact thresholds instead of instinct
  • structured discussion of grey-area scenarios

The aim is simple:

People know when to act.

5. Test the grey areas

We design and run exercises based on realistic housing scenarios, not generic disasters.

Examples include:

  • system outages affecting coordination and communication
  • heating or utilities failure affecting residents
  • safeguarding issues with potential regulatory visibility
  • contractor failure across multiple sites
  • social media or complaints escalating into reputational risk

These exercises focus on:

  • when to escalate
  • when to activate the BCP
  • how impact is assessed across services, residents and reputation

6. Turn learning into practical improvements

Every engagement produces clear, usable improvements.

These typically include:

  • refined escalation and activation triggers
  • improved on-call and out-of-hours readiness
  • clearer roles and handovers
  • better communication structures
  • strengthened logging and auditability

For example, improvements often focus on escalation clarity, role definition, and structured exercising programmes.

Abstract Coordination Network in Muted Tones

What you get

We support housing organisations with:

Full Business Continuity Plan development

Review and improvement of existing plans

Departmental recovery planning

Tabletop exercises and simulations

Training and awareness

Ongoing resilience improvement

Used by housing associations including

Proof from the sector

Business Continuity Planning with a housing association
See how we worked with a housing association to review and strengthen their Business Continuity Plan — improving escalation, sharpening decision-making, and turning the plan into something teams can actually use during real incidents.

 

Read more

The missing link between incident response and BCP

Instead of thinking about “major incidents”, most housing organisations deal with a steady flow of disruption.

Some of it is operational. Some of it escalates. Some of it crosses into crisis.

The problem is not whether these events are big enough.

It is whether the response is consistent, escalated at the right time, and aligned with how the organisation already operates.

Your Business Continuity Plan should not sit alongside normal incident response. It should extend it.

That means the same escalation routes, the same roles, the same decision-making structure, a clear point where the organisation shifts from managing to responding.

In organisations where incident response is already part of everyone’s job, the foundations are usually there.

What is missing is the join.

The link between day-to-day incident management and formal business continuity.

Without that join incidents are managed for too long, escalation decisions vary by person, teams hesitate in grey areas, the BCP is seen as something separate, only used in extremes.

Where this becomes critical is in situations that sit between normal operations and crisis, where it is unclear whether to escalate or not.

Find out more

Why cyber is now the main trigger

For most housing associations, cyber is now the primary route into a business continuity event.

Not because of the technical failure itself, but because of the operational impact it creates.

Typical scenarios include loss of access to housing management systems, degradation or loss of Microsoft 365 (email, Teams, SharePoint), supplier outages affecting key SaaS platforms, data integrity or security concerns following an incident

The technical response is only one part of the problem.

The bigger challenge is operational. How services continue without systems, How teams coordinate without reliable communication, how decisions are made without full information, how quickly the organisation moves from IT incident to business response

Most plans treat cyber as an IT issue.

In reality, it is one of the fastest ways to trigger a full organisational response.

Find out more