In Brief
For financial and advisory businesses, disruption does not always mean the whole company stops functioning.
A critical system, employee, supplier, or source of information may become unavailable while customers and counterparties still expect services to continue.
ISO 22301 provides a structured Business Continuity Management System (BCMS) for identifying priority services, understanding their dependencies, preparing recovery arrangements, and testing whether those arrangements work. ISO describes ISO 22301:2019 as the international standard for establishing and continually improving a BCMS. [Source]
The key questions are:
• Which services must continue?
• How long can they be unavailable?
• What people, information, systems and suppliers do they depend on?
• What happens when one of those dependencies fails?
• Have the recovery arrangements actually been tested?
Your Business May Be Open While a Critical Service Is Down
- Consider a financial or advisory firm whose employees can still work, but its main customer platform is unavailable.
- Or a mortgage adviser who cannot access application records.
- An investment business loses access to an important data provider.
- A cyber incident forces a fintech company to isolate part of its network.
- A key employee responsible for an important client or process suddenly becomes unavailable.
None of these situations necessarily closes the company.
But each can prevent an important service from being delivered.
That is why business continuity should not begin with:
“How do we keep the office open?”
A better question is:
"Which services must we continue delivering, and what could prevent us from doing so?"
Financial Services Depend on More Than Technology
Financial, investment, lending, and advisory businesses operate differently, but many rely on the same basic chain of dependencies:
A client service may depend on a trained employee.
That employee needs access to information.
The information may sit inside a cloud platform.
The platform depends on technology and telecommunications providers.
The process may also depend on banks, lenders, payment providers, data suppliers, or other counterparties.
A failure anywhere along that chain can affect the final service.
This makes business continuity broader than IT disaster recovery.
Different Businesses, Similar Continuity Questions
The specific dependencies will vary by business. A lending or mortgage advisory firm may depend on customer records, lender portals, and application documents. An investment business may rely on market information, research, approvals and counterparties. A fintech business may depend heavily on cloud infrastructure, APIs and technology providers, while an advisory firm may rely more on client information, key personnel and project records.
The operating models differ, but the continuity questions remain the same: What must continue, how quickly must it recover, and what does it depend on?
Their systems may be different.
Their recovery priorities may be different.
But the management questions remain similar:
What must continue? How quickly must it recover? What does it depend on?
Start by Identifying What Cannot Wait
One of the most useful parts of business continuity management is the Business Impact Analysis (BIA).
The purpose is not to declare every process “critical”
It is to understand how the impact of disruption changes over time.
For example, an internal administrative process might tolerate a delay of several days.
A client deliverable may tolerate one day.
A transaction, payment, application, or time-sensitive customer process might require much faster recovery.
This distinction helps management focus its resources where disruption would create the greatest impact.
Instead of starting with technology, start with the service:
What happens if this activity is unavailable for four hours? One day? Three days?
Then determine what is required to keep it operating or recover it.
Map the Dependencies Behind Each Critical Service
Once a priority service has been identified, management should understand everything required to deliver it.
For example:
A business may control the first few layers directly but depend on other organizations for the rest.
This creates an important continuity question:
Does your continuity plan depend on another company's continuity plan?
For organizations that rely heavily on cloud systems, outsourced IT, telecommunications, payment providers, financial institutions, data platforms or other specialist suppliers, third-party disruption can become their disruption.
Could Your Organization Handle These Disruptions?
A continuity plan becomes more useful when it is tested against realistic scenarios.
1. What if your main operational system became unavailable for eight hours? Could priority services continue another way?
2. What if a cyber incident required critical systems to be isolated? Could essential operations continue safely?
3. What if an important supplier experienced a prolonged outage? Is there a practical alternative?
4. What if the employee responsible for an important client or process suddenly became unavailable? Could another competent person take over?
5. What if essential records could not be accessed? How long could the affected service wait?
6. What if email and normal communication tools became unavailable? How would employees, customers and management communicate?
And what if several of these events happened at the same time?
The objective is not to predict the next disruption. It is to expose assumptions and single points of dependency before they become real problems.
It is to identify assumptions and single points of dependency before they become real problems.
What ISO 22301 adds
In practical terms, an ISO 22301 approach brings several activities together into one structured management system. It helps an organization define what needs to be protected, conduct a Business Impact Analysis, understand risks and dependencies, develop continuity strategies, assign responsibilities, exercise recovery arrangements, and continually improve them through audit and management review.
The objective is not to create more documentation. It is to make continuity planning systematic, testable, and repeatable.
ISO describes the standard as suitable for organizations of different sizes seeking to establish more robust business continuity capability.
Business Continuity Is Not the Same as Disaster Recovery
The two are related, but they should not be confused.
Disaster Recovery often concentrates on restoring technology, systems and infrastructure.
Business Continuity asks whether priority products and services can continue or recover, taking into account people, information, technology, suppliers, facilities, and other dependencies.
Restoring a server does not automatically restore a business service.
The system may be working while the required employee is unavailable, a supplier connection is down, critical information is missing or approval authority cannot be reached.
That is why continuity planning should start with the business service, not only the technology supporting it.
ISO 22301 and ISO/IEC 27001 Address Different Risks
For businesses that depend on digital platforms and handle sensitive information, business continuity and information security often overlap.
A cyber incident is a good example.
The organization may need to contain compromised systems while continuing important services.
ISO/IEC 27001 and ISO 22301 address different but complementary questions.
ISO confirms that ISO 22301 can be integrated with other ISO management system standards. [Source:]
An organization does not automatically need both certifications. The appropriate approach depends on its services, technology, customers, risks, and business objectives.
Where MAS Business Continuity Expectations Fit
Organizations should not assume that every business operating around financial services has the same MAS regulatory obligations.
Regulatory requirements depend on the organization's actual activities and regulatory status.
For financial institutions within MAS's regulatory scope, however, business continuity has specific relevance. MAS's BCM guidance calls for financial institutions to take an end-to-end, service-centric approach to ensuring the continued delivery of critical business services. [Source]
That principle aligns closely with the business-led approach described above:
Start with the service that needs to continue, then understand the resources and dependencies supporting it.
ISO 22301 certification should NOT be treated as a substitute for applicable MAS requirements.
A BCMS can instead provide a structured framework within which an organization identifies, implements, exercises and reviews applicable continuity controls.
Does Every Organization Need ISO 22301 Certification?
[NO.]
An organization can improve its continuity arrangements without pursuing certification.
Certification may become more relevant when continuity assurance is requested by clients, tenders, institutional customers, regulators, group companies or business partners; when services are highly time-sensitive; or when technology and third-party dependencies make extended disruption difficult to tolerate.
The decision should therefore be based on the organization's actual situation.
A better question than “Do financial companies need ISO 22301?” is:
Would a formal BCMS provide meaningful value given our services, disruption risks, customer expectations and obligations?
A Quick Business Continuity Readiness Check
Before discussing certification, management should be able to answer a few fundamental questions.
A. Can you identify your most important services?
B. Do you know how long each can reasonably be unavailable?
C. Do you know which employees, systems, suppliers and information each service requires?
D. Are alternative arrangements available if a critical dependency fails?
E. Does management know who can make decisions during a disruption?
F. Can employees and customers still communicate if normal channels fail?
And most importantly:
When were those recovery arrangements last tested?
If several answers are unclear, the main gap may not be a missing continuity document.
The organization may not yet fully understand how its critical services operate and what could stop them.
The Real Test Is Whether the Service Continues
Customers rarely experience disruption as a technical incident.
They experience it more simply:
“I cannot access the service.”
“My application has stopped.”
“The transaction cannot proceed.”
“Nobody can tell me what is happening.”
“The deadline has been missed.”
This is why business continuity should begin with the outcome the organization needs to maintain—not simply the system it wants to restore.
A mature BCMS works backwards from that outcome to identify the people, information, technology and suppliers needed to support it.
Could Your Critical Services Continue Tomorrow?
Consider a simple scenario.
Tomorrow morning:
your main platform becomes unavailable;
a critical employee cannot work;
and an important supplier says its service may not recover for several hours.
Could your organization quickly determine:
What must continue,
? Who takes responsibility,
? Which alternative arrangements should be activated,
? How stakeholders should be informed, and
? How long the disruption can be tolerated.
If those answers are unclear, it may be worth assessing your business continuity arrangements before a real disruption provides the test.
QuESH Consultants supports organizations with ISO 22301 readiness assessment, Business Impact Analysis, continuity-risk assessment, BCMS development, awareness and internal-auditor training, internal audits, implementation support and certification readiness.
A useful first step does not have to be certification.
It can begin by identifying:
Which services matter most, what could stop them, and whether your current recovery arrangements would actually work.
Request a 15-minute ISO 22301 Business Continuity Fit & Readiness Discussion with QuESH Consultants.
