Business continuity and crisis management · RiskAtoms Academy

By the end you will be able to

1Run a business impact analysis and set MTPD, RTO, RPO and minimum service levels.
2Choose a recovery strategy that keeps a service within its tolerance, and see why one strategy rarely covers every disruption.
3Describe how a crisis is run: who decides, how fast, and how the firm communicates.
4Explain how business continuity relates to operational resilience and to the liquidity contingency funding plan.

Why it matters

At 08:10 on 14 October 2025, two and a half hours into the payments outage, RiskAtoms Bank's crisis team chose to repair the failed database rather than go back to the night before. It was a reasonable call with the facts they had. It was also wrong, and by the time they changed course the clock read 12:40. The outage lasted 31 hours. A continuity plan is what lets a team make that kind of decision quickly, from options worked out in advance.

Core explanation

Plan, recover, decide

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025: 1,107 records of losses of £10,000 or more and near misses over 2016–2025 (£240.5m of net operational losses), an RCSA of 17 key risks and 29 controls, ten key risk indicators, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.

Two book events test the bank's continuity: the February 2020 flood, which moved staff to the recovery site for 6 weeks (£3.4m gross, £2.8m back from insurance), and the October 2025 payments outage (£18.4m). The recovery strategies and the hour-by-hour timeline below are extras.

Business continuity management is older than operational resilience and works one level down. Resilience (L3.7.15: Operational resilience) sets a tolerance for each service; continuity plans make sure every process, system, site and team behind it can be recovered fast enough. The international standard is ISO 22301 (2019 edition). The bank's liquidity has its own plan, the contingency funding plan of L3.5.10: Contingency funding plans; this lesson is about keeping operations running.

Business impact analysis

A business impact analysis asks, for each activity, how harm grows the longer it is down, and turns the answer into four numbers.

ExploreThe four numbers from a BIA, for payments

Click a box to see what happens there.

MTPD

The maximum tolerable period of disruption. For a service that the bank has named as important, the impact tolerance sets it: 24 hours for Faster Payments, 4 hours for CHAPS.

Choosing a recovery strategy

Each strategy buys a recovery time and a recovery point at a price, and each behaves differently against different disruptions. A hot standby survives a failed data centre in an hour but copies corrupted data just as fast; an immutable backup cannot be altered by an attacker but takes hours to restore.

Extra for this lessonRecovery strategies for the payments platform (illustrative)

Hours to recover, against Faster Payments (24 hours) and CHAPS (4 hours). R1 is today's arrangement.

Strategy	Cost a year	Hardware or site: FPS	Hardware or site: CHAPS	Corruption: FPS	Corruption: CHAPS
R1 Nightly backup, rebuild on spare hardware	£0.4m	30h breach	30h breach	30h breach	30h breach
R2 Warm standby, snapshots every 4 hours	£1.8m	8h within	8h breach	10h within	10h breach
R3 Hot standby, continuous replication	£4.5m	1h within	1h within	30h breach	30h breach
R4 Hot standby plus immutable copies every 4 hours	£5.2m	1h within	1h within	10h within	10h breach

The cheapest strategy that keeps Faster Payments within tolerance against both kinds of disruption is R2, at £1.8m a year. For CHAPS, none does: after corruption no restore is fast enough, so CHAPS needs a workaround that does not wait for the platform, such as releasing priority payments through a separate manual route.

Running a crisis

Crisis management takes over when a disruption threatens customers, finances or reputation. Many organisations run it on three levels, often called gold, silver and bronze after the UK emergency services' structure: an executive team that sets priorities and speaks for the bank; a tactical team that coordinates the response; and the operational teams fixing the problem. The plan names who sits where, who can decide what, and how quickly they meet.

Sort itWho decides?

Sort each decision from the October outage to the level that should take it.

Whether to pay customers' late-payment charges caused by the outage
What to tell the PRA, the FCA and the press, and when
Which CHAPS payments to release first by hand
Which backup to restore and the order to replay the day's payments

The formal version

For a resource with recovery time objective $\text{RTO}$ , detection and decision time $\delta$ and a service tolerance $T$ , and for a platform processing $\lambda$ transactions an hour:

\begin{aligned} &\delta + \text{RTO} \le T \le \text{MTPD} \\ &\text{transactions to rebuild} \le \lambda \times \text{RPO}, \qquad \lambda = \frac{400{,}000}{24} = 16{,}667\text{ an hour} \\ &\text{choose } \arg\min_{j}\ \text{cost}_j \ \text{ subject to } \ \delta + \text{RTO}_{j,k} \le T \ \text{ for every disruption } k \end{aligned}

With a nightly backup the RPO is 24 hours, so up to $16{,}667 \times 24 = 400{,}000$ payments must be reconstructed. The constraint must hold for every disruption, which is why the cheapest answer for one threat is often wrong for another.

Try it

Pick a strategy and a disruption, and see which payment services stay within tolerance.

Try itChoose a recovery strategy for the payments platform

Recovery strategy

What happens

Nightly backup, rebuild on spare hardware

Today's arrangement: the last restore test took 30 hours (finding F01)

IBS1 Faster Payments30h of 24h · over by 6h

IBS4 CHAPS30h of 4h · over by 26h

Bar: hours the service is disrupted. Vertical line: its impact tolerance.

Recovery time (RTO)30h

Data lost (RPO)24h

Payments to rebuild400,000

Running cost£0.4m a year

Faster Payments (24h)Breach

CHAPS (4h)Breach

Hot standby copies bad data as faithfully as good data, so against corruption it falls back to the last clean copy. No strategy brings CHAPS back within 4 hours after corruption: that service needs a workaround that does not wait for the platform. Illustrative recovery times and costs.

Worked example

The October outage, hour by hour

Extra for this lessonThe crisis timeline (illustrative)

The book records a 31-hour outage costing £18.4m. The timeline below is this lesson's reconstruction, consistent with the findings and the two tolerance breaches.

TimelineTuesday 14 to Wednesday 15 October 2025

1 / 8

Tue 14 Oct 05:40 · hour 0

Payments start to fail

An overnight upgrade of the payments database, deferred twice, completes; outbound payments begin to fail.

Two decisions shaped the outage: at hour 2.5 to fix forward, and at hour 7 to restore from backup. The first cost 4.5 hours; the restore then took 24, close to the 30 hours of the last restore test.

What the post-incident review records

Detection was quick (30 minutes). Decisions were slow because there was no rehearsed back-out plan to choose, and recovery was slow because the restore had never met its target. Customer communication started within two hours. CHAPS needed a manual route that had to be improvised.

Regulatory lens

Continuity and resilience. The UK resilience rules (L3.7.15: Operational resilience) do not replace business continuity; they set the service-level target that continuity plans must meet, and expect firms to test communications as well as recovery.
ISO 22301:2019. The international standard for business continuity management systems, replacing the 2012 edition; a 2024 amendment added climate action changes. It uses the terms in this lesson: business impact analysis, MTPD, RTO, RPO and MBCO.
Capital and losses. Outages are operational losses under “business disruption and system failures”; flood and fire damage under “damage to physical assets”. Insurance recoveries reduce the net loss: the flood cost £3.4m gross and £0.6m net.

Public dataCrowdStrike, 19 July 2024

A faulty content update for CrowdStrike's Falcon sensor was released at 04:09 UTC and reverted at 05:27 UTC, 78 minutes later. Windows machines that received it crashed; Linux and Mac machines were not affected, and it was not a cyberattack. Microsoft estimated that about 8.5 million Windows devices were affected, under 1% of the total.

Spark Atoms

Spark Atom78 minutes to fix, days to recover

CrowdStrike reverted its faulty update 78 minutes after releasing it. Recovering the machines that had already crashed took far longer, because many had to be fixed one by one. The RTO of a fleet is set by its slowest manual step, not by the vendor's fix.

Spark AtomSix weeks at the recovery site

When the bank's regional operations centre flooded in February 2020, its staff worked from the recovery site for 6 weeks. The recovery site control (C29) is rated effective in both design and operation: a plan that has been used for real is easier to trust than one only tested.

Key takeaways

Business continuity recovers the processes, systems, sites and teams behind a service; resilience sets the service's tolerance that they must meet.
A business impact analysis gives four numbers: MTPD, RTO (shorter than MTPD), RPO and the minimum service level while degraded.
Strategies trade cost against RTO and RPO, and behave differently by threat: replication beats a site failure but copies corruption. R2 is the cheapest that protects Faster Payments; nothing restores CHAPS within 4 hours after corruption.
Crisis management runs on three levels with pre-agreed authority; in the October outage, with no rehearsed back-out to choose instead, the decision to fix forward cost 4.5 hours before a 24-hour restore began.
Liquidity crises have their own plan (the contingency funding plan); operational crises need this one.

Reaction

Check what stuck

Glossary

Business continuity management: Business continuity management: the plans, resources and tests that let an organisation keep delivering its products and services at an acceptable level during a disruption.
Business impact analysis: Business impact analysis (BIA): working out, for each activity, how the impact of a disruption grows over time, and so how quickly and to what level it must be restored.
MTPD: Maximum tolerable period of disruption (MTPD): the time after which the impact of not resuming an activity becomes unacceptable.
RTO: Recovery time objective (RTO): the target time to resume an activity or restore a resource after a disruption; it must be shorter than the MTPD.
RPO: Recovery point objective (RPO): the point to which data must be restored, so the most data, measured in time, that can be lost.
MBCO: Minimum business continuity objective (MBCO): the minimum level of service that is acceptable while the activity is disrupted.
Crisis management: Crisis management: how the organisation's leaders take decisions, communicate and coordinate when an event threatens its customers, finances or reputation and the usual processes are not enough.
Hot or warm standby: Hot or warm standby: a second copy of a system kept running (hot) or partly running (warm) so it can take over when the first fails.
Immutable backup: Immutable backup: a copy of data that cannot be changed or deleted for a set period, even by an administrator.

Deep Dives & Origins

Deep Dives

International Organization for Standardization, ISO 22301:2019 Security and resilience: Business continuity management systems: Requirements. Intermediate.
CrowdStrike, Technical Details on Today's Outage, 19 July 2024. Introductory.

Origins

Estonian Centre for Standardisation (evs.ee), catalogue entry for ISO 22301:2019 and Amd 1:2024; PECB, definitions of MTPD, RTO, RPO and MBCO; Databarracks, BC command structures – Gold, Silver and Bronze.
CrowdStrike, Technical Details on Today's Outage, 19 July 2024; Computer Weekly, report on Microsoft's estimate of affected devices, July 2024; Microsoft, KB5042421 (the manual recovery steps), 2024.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.