What is the difference between business continuity management and a business continuity plan?

Business continuity management is the ongoing approach to keeping your organisation delivering through disruption, covering risks, ownership, testing and improvement. The business continuity plan is the written document that captures those arrangements at a point in time. Buyers usually ask to see the plan, but they are really assessing whether the management behind it is real.

Do I need ISO 22301 to answer a continuity question?

No. ISO 22301 is a recognised business continuity standard and worth holding if it fits your market, but most public contracts do not require it. Evaluators care more about practical detail: your critical activities, recovery times, named owners and testing. Mention any certification you hold, then back it with operational specifics for the contract in question.

How much detail should a small supplier include?

Enough to show what happens, who does what, how fast service is restored and how the buyer is kept informed. Name your top risks, your recovery times and the roles responsible for activating the plan. Admit single points of failure and explain your mitigation. A page or two of specific, honest detail beats a long generic policy.

How often should I test and update my continuity plan?

Test at least once a year, and update the plan after any incident, staffing change or system change. Buyers often ask when you last tested and what you learned, so keep a short record of test dates and lessons learned. A plan that has clearly been rehearsed reads as far more credible than one that has never been used.

A Plain English Guide to Business Continuity Management for SME Bidders

Ask ten small suppliers what business continuity management means and you will get ten slightly different answers. Some think it is a folder gathering dust on a shelf. Others confuse it with insurance or health and safety. In UK public procurement it is something far more practical: it is the way you demonstrate to a buyer that your service will keep running when something goes wrong. Staff fall ill, offices lose power, a key supplier goes bust, a cyber incident locks you out of your systems. Buyers know these things happen, so they ask how you will cope.

This guide explains business continuity management in plain terms, shows what evaluators are looking for, and walks through three worked examples you can adapt. The demand for this evidence is not going away. Public bodies are advertising steadily, with 1,189 live tenders published, last 30 days across the market, and many of those service contracts include a continuity requirement somewhere in the schedules or the selection questionnaire.

What business continuity management actually means

Business continuity management, often shortened to BCM, is the wider management approach to keeping your organisation delivering through disruption. The document you show the buyer is usually called a business continuity plan. Do not treat the two as the same thing. The management side is ongoing: identifying risks, assigning owners, testing and improving. The plan is the written output that captures it at a point in time.

A sound approach covers a handful of connected areas:

Critical activities. The specific services you absolutely must keep running to meet the contract.
Recovery priorities. The maximum time each activity can be down before it causes real harm.
Risks and dependencies. The people, premises, systems, utilities and subcontractors your delivery relies on.
Response and recovery. Workarounds for short disruptions and step by step recovery for longer ones.
Communications. How and when you tell the buyer, and who is responsible for doing so.
Testing and improvement. How often you rehearse the plan and how you learn from incidents.

How it connects to other assurance

Business continuity sits close to incident management and to risk management in procurement. It also overlaps with information security. If you already hold certifications such as ISO 22301 for business continuity or ISO 27001 for information security, mention them, but do not let a certificate do the talking. Evaluators want to see the practical arrangements behind the badge. A certificate tells them you have a framework. Your worked detail tells them the framework actually works for their contract.

Why buyers ask for it and what they score

Public bodies build continuity requirements into contracts because a failure in your service can cascade into a failure of theirs. A council cannot let library cleaning lapse for a fortnight. A district authority cannot leave its IT helpdesk dark for days. A school cannot serve unsafe meals. When your service stops, the buyer's obligation to the public does not. So they ask, before signing, whether you have thought this through.

Central government guidance goes further for critical contracts, expecting continuity and exit planning, with supplier insolvency treated as a genuine continuity scenario. That is a useful signal for smaller suppliers: buyers increasingly want to know what happens if you, the supplier, get into difficulty, not just what happens if a server fails.

When an evaluator reads your response, they are typically checking for:

Specificity. Is this written for our contract, or is it a template with the service name swapped in?
Ownership. Who activates the plan, and are they named by role?
Speed. What are the recovery times, and are they realistic for a firm your size?
Single points of failure. Have you admitted where you are vulnerable and shown your cover?
Testing. How often do you rehearse, and what did the last test teach you?

Common mistakes that lose marks

The biggest error is answering with policy language. Sentences like "we are committed to maintaining service resilience at all times" say nothing an evaluator can score. Another mistake is claiming perfection. A twelve person firm that says it has no single points of failure is not credible. Evaluators trust suppliers who name their weak spots and explain their mitigation. Before you submit, run a sensible go or no go decision so you are only investing bid effort where you can genuinely meet the continuity bar.

Three worked examples you can adapt

The fastest way to understand a good response is to see one. Here are three, drawn from typical SME situations, each showing the risk, the response, the recovery aim and a model sentence for the bid.

Example one, a small cleaning contractor

A twelve person cleaning firm bids to clean council libraries.

Risk: two cleaners and the supervisor are off sick during a winter flu wave.
Response: cross-train staff so at least two people can cover each site; keep a standby bank of casual workers; hold site instructions centrally; require daily handover notes.
Recovery aim: continue core cleaning within 24 hours.
Model sentence: "If two or more operatives are unavailable, the operations manager will redeploy trained cover staff and inform the council contract manager within two hours."

Example two, an IT managed service provider

A twenty person managed service provider bids for a district council helpdesk.

Risk: the main office loses power and the ticketing platform is unavailable.
Response: staff can work remotely; the ticket system has a hosted backup; call logging can switch to email and phone; critical documents sit in cloud storage with access controls.
Recovery aim: restore ticket logging within four hours and normal service within one working day.
Model sentence: "We test remote working and system failover quarterly and maintain an incident playbook for supplier and customer communications."

Example three, a school meals caterer

A school meals SME bids for a catering framework.

Risk: refrigeration failure or a food supply interruption.
Response: dual suppliers for key ingredients; temperature alarms; emergency transport for chilled goods; an agreed contingency menu.
Recovery aim: maintain safe meal provision the same day.
Model sentence: "Our continuity plan prioritises food safety, with an immediate menu fallback and escalation to our alternate depot."

Notice what these share. Each names a real risk, a concrete action, a named owner and a time. That combination is what turns a vague reassurance into a scoring answer.

Building a plan you can reuse

You do not need a consultancy to produce a credible plan. Start small, keep it honest, and refine it as you bid. A simple checklist gets most SMEs a long way:

Identify your top five contract risks.
List critical suppliers and staff by role.
Define recovery times for each critical activity.
Write step by step actions for the first hour, first day and first week.
Keep buyer contact details and clear notification triggers.
Test the plan at least once a year.
Update it after any incident, staffing change or system change.

The first-hour, first-day, first-week structure is worth dwelling on. Short disruptions need workarounds you can trigger immediately. Longer ones need recovery steps and a communication plan. Separating the two shows the evaluator you understand that not every incident is a crisis and not every crisis resolves in an afternoon.

Turn each bid into a stronger template

Because continuity questions recur across tenders, it pays to build a reusable core that you tailor each time. A reusable bid content library lets you keep a strong base answer and swap in the contract-specific risks, service levels and recovery times. The trick is discipline: never submit the base version untouched. Map it to the service level agreement and the specification each time, so the buyer sees a plan built for their service.

If you want the formal definition to sit alongside your own notes, the platform tools from KimonBids include a glossary; you can read the glossary entry for a concise reference. Watch the market too. There were 714 pipeline notices published, last 30 days, an early signal of work coming down the line, and reviewing those pipeline notices gives you time to prepare continuity evidence before the contract notice appears rather than scrambling at the deadline.