By Rachael Elliott
Successful business continuity planning used to be judged by a deceptively simple question: can the organization keep operating if its buildings, people, or technology are unavailable? This remains at the core of business continuity practices, but practitioners now have a wider remit to fit modern organizations, which are more a network of suppliers, software providers, outsourced processors, cloud platforms, logistics partners, specialist staff, and executive decision-makers. Business continuity is no longer about having an internal plan; it is having a plan that reflects how the organization really works.
That is also the central message from DRI International’s recent survey of business continuity and resilience professionals. Asked where the biggest blind spot exists in their organization’s business continuity plans, respondents chose outside vendors and supply chain by a clear margin, at 55%. Legacy IT systems followed at 25%, executive succession planning at 14%, and remote workforce at just 6%. Results suggest that professionals understand that the greatest business continuity weakness is often outside the formal boundary of the organization.
The outside vendor and supply chain blind spot
That 55% of respondents selected outside vendors and supply chain as their biggest blind spot is not surprising and shows that third-party dependency is no longer purely a procurement or supplier-management issue.
This is also supported by external research. Resilinc’s supply chain data found a 38% year-on-year increase in global supply chain disruptions, with factory fires, labour disruption, business sales, leadership transition, and mergers and acquisitions listed as the top five disruption categories. The same data also showed dramatic increases in climate-related alerts, including a 119% rise in extreme weather, a 214% rise in flood-related alerts, and a 101% rise in hurricane and typhoon alerts. Because disruption is rarely caused by a single category of risk and is usually a result of overlapping exposures, this is very relevant.
Third-party risk is now a core operational resilience issue. Deloitte’s global third-party risk management (TPRM) survey drew on insights from more than 1,300 TPRM leaders across 40 countries, showing the scale at which organizations are now trying to benchmark and mature their third-party risk practices. ORX, an operational risk management association focusing on the financial sector, describes third-party risk as a continuing challenge and priority, driven by dependence upon external ecosystems, regulatory scrutiny, geopolitical turbulence, cyber attacks, and concentration risk among large technology providers.
Digital supply chains have created significant exposure. The MOVEit attacks showed how a vulnerability in widely used file-transfer software could permeate third and nth-party relationships, affecting thousands of organizations and tens of millions of individuals. The Change Healthcare cyber attack demonstrated that disruption to a mission-critical third-party provider can create national-scale impacts across healthcare operations, financial flows, and patient access. Additionally, the CrowdStrike outage, while not a cyber attack, showed how a faulty update from a trusted technology provider could rapidly become a global business interruption event, with estimated Fortune 500 losses of $5.4 billion.
Taking this into consideration, supply chain and vendor risk can no longer be viewed as a static due diligence exercise: a supplier can be able to demonstrate that it is financially viable, but is it operationally sound? A logistics partner might be able to meet contractual service levels in normal conditions, but how robust would it be in the face of severe, simultaneous disruptions?
Resilience and business continuity professionals know that merely having a supplier list is inadequate and, instead, are looking to create a dependency map that links important products and services to the third parties, sub-tier suppliers, technologies, data flows, facilities, skills, and logistics. They also should be asking: which contractual commitments are watertight during a regional or systemic disruption? Which providers support multiple critical processes? Which outsourced services would become unavailable at the same time because they rely on the same cloud, software, telecoms, or payments infrastructure?
How the DRI Professional Practices help with this area
DRI’s Professional Practices for Business Continuity Management can help to apply discipline to this area. Professional Practice 2 asks organizations to identify risks across internal and external sources, including supply chain, cyber security, information technology, product or service delivery, legal, and regulatory impacts. Professional Practice 3 requires the business impact analysis to identify impacts when internal and external resources (including third-party providers, supply chain, and technology) are unavailable. Furthermore, Professional Practice 4 requires strategies that address the gaps identified by the risk assessment and BIA, including supply chain issues and the use of third-party service providers. Finally, Professional Practice 8 encourages organizations to exercise plans with internal and external stakeholders, rather than testing only the parts of the response which they directly control.
Legacy IT is resilience debt
Legacy IT systems ranked second in the blind spot survey, selected by 25% of respondents. Organizations keep old hardware and software because it is familiar to staff, embedded in business processes, and expensive to upgrade. However, old systems can be difficult to patch, easy pickings for cyber criminals, dependent on outdated skillsets, or can be too fragile to withstand aggressive testing.
Government and industry evidence shows that this is a very real concern and goes beyond the survey results.
The UK Public Accounts Committee reported that risky legacy IT systems make up an estimated 28% of the UK’s public sector IT estate. By January 2025, 319 legacy systems had been identified across government, with around 25% rated red because there was a high likelihood of risks occurring and impact levels would be extreme. Gartner has similarly reported that, on average, about 40% of infrastructure systems across asset classes have technical debt concerns, having implications for performance, scalability, resilience, and customer dissatisfaction.
Furthermore, the risk is not just that the old systems may fail, but that their recovery may fall beyond the organization’s recovery time objective (RTO). For example, a plan may assume four-hour data recovery and a manual workaround, but that target may no longer be realistic if staff lack legacy-system skills or parts required for repairs are unavailable.
Senior management should not just be asking “How old is the system?” but should rather question “What business service would fail if this system failed, and is there a tested route to recover it?”
How the DRI Professional Practices help with this area
The DRI Professional Practices help by recognising a connection between technology, impact, and recovery capability. They explain how the BIA should set recovery time objectives and recovery point objectives, comparing those objectives with actual capability. Professional Practice 4 explains that recovery strategies should meet those objectives, including high-availability systems, multiple data centres, cloud computing, third-party services, and manual workarounds (where appropriate). Professional Practice 6 calls for recovery plans that identify applications and dependencies, change management, problem management, and exercise and maintenance arrangements.
Succession planning is the quiet continuity risk
Executive succession planning was selected by 14% of survey respondents. While below supply chain and legacy IT, its risk may be under-recognised because it is less visible until it fails.
Succession planning is frequently framed as a board or human resources issue. However, it should also be considered a business continuity issue. External evidence suggests that many organizations are not as prepared as they think. NACD research found that almost a third of public company respondents reported that if their CEO left the next day, their board did not have a successor identified to fulfil the role effectively, with a further 10% unsure. Spencer Stuart’s 2024 Director Pulse Survey found that only 49% of surveyed directors had worked on an emergency CEO succession plan in the previous 12 months. PwC argues that succession planning should be treated as a living governance document covering expected and unexpected transitions, interim candidates, and clear process ownership.
While succession planning is not often in the remit of business continuity professionals, they can assist by operationalising leadership continuity. This might include asking the following questions:
- Who has delegated authority if the chief executive, chief operating officer, chief information officer, or crisis lead is unavailable?
- Who can approve emergency expenditure?
- Who can communicate with regulators, investors, media, and employees?
- Who owns recovery decisions for critical business services?
- Are alternates named, trained, and exercised?
Succession planning is not only about who becomes the next CEO; it also should be about whether the organization can still make legitimate, timely, and trusted decisions when named individuals are unavailable.
How the DRI Professional Practices help with this area
The DRI Professional Practices again help here. Professional Practice 1 outlines the governance structure, leadership support, steering committee and accountability for the business continuity programme, while Professional Practice 5 explains the importance of an incident management organization with defined roles, responsibilities, lines of authority, delegation of authority, and succession of authority. Meanwhile, Professional Practice 6 explains why recovery teams need to include primary and alternate members and Professional Practice 9 emphasises the importance clear communications governance, which becomes especially important during leadership transition or executive absence.
Remote workforce risk has matured, but not disappeared
Only 6% of respondents selected remote workforce as the biggest blind spot. The low percentage suggests that many organizations have absorbed remote and hybrid work into normal operations.
The next step in maturity is to stop viewing remote work as a location strategy (and, in some cases, a temporary one) and start testing it as an operating model. Can a crisis management team form quickly when senior leaders are dispersed? Can employees access plans if the IT environment is compromised? Can managers account for staff during a regional emergency? Can new starters, contractors, and outsourced teams respond with the same confidence as long-serving employees? Too frequently, such questions are viewed as ‘pandemic questions’ rather than ‘business as usual’ resilience strategies.
How the DRI Professional Practices help with this area
The DRI Professional Practices are helpful here as well. Professional Practice 4 includes directing personnel to work from home as a continuity strategy, while Professional Practice 7 highlights the importance of awareness and training so personnel can respond calmly and efficiently. Meanwhile, Professional Practice 9 requires crisis communications plans that reach internal and external interested parties through appropriate channels, and Professional Practice 8 requires scenario-based exercises, notification tests, and integrated exercises that include the people and resources required to recover operations.
What the percentages really tell us
The survey results point to three broader conclusions.
First, resilience concern is shifting from asset-focused to dependency-driven. Buildings, staff, and systems remain important, but the greatest concerns now revolve around the links among organizations.
Second, confidence is highest where organizations have had to make adaptations in the full public eye. Remote working was stress-tested during COVID-19 and then absorbed into operating models. While the risk of remote working remains important, it has now become more business as usual for many organizations. By contrast, supply chain and legacy IT risks often remain hidden until exposed by a disruption.
Third, business continuity plans should be judged by how operationally effective they are. A plan that names a supplier, lists an alternate site, identifies a recovery team, and states an RTO may be considered mature. However, will the plan work when tested by concurrent, cascading, or systemic disruptions?
For resilience and business continuity professionals, a way forward might be to strengthen the relationship between risk assessment, business impact analysis, recovery strategy, training and exercising, and governance. The DRI Professional Practices are useful for this because they connect these disciplines.
The messaging coming out of this survey is both practical and strategic. Organizations do not only need better business continuity plans, they also need a better understanding of what those plans are supposed to protect.
The author
Rachael Elliott is Director of Global Strategy and Innovation for DRI International. Rachael has particular expertise in the technology side of resilience, and has a keen interest in how artificial intelligence can help to transform the resilience of organizations. Her research has been used in the UK Parliament to help develop government industrial strategy as well as in the BDO High Street Sales Tracker, which Elliott was instrumental in developing and is still the UK’s primary barometer for tracking high street sales performance. She maintains a keen interest in competitive intelligence and investigative research techniques.
