Customers have stopped accepting a continuity plan and started asking for evidence it works

Businesses must now provide evidence that their business continuity plans work in practice. Simply having a documented plan is no longer enough to satisfy customer expectations.

Buyers are increasingly asking suppliers when they last tested their plans, what problems they found and what changes they made after the exercise.

Why Are Buyer Expectations Changing?

Recent disruptions have shown that having a business continuity plan does not guarantee that an organisation can maintain its critical operations during a crisis.

As a result, buyers now focus on how well businesses can respond to unexpected events and recover within an acceptable time.

Financial services regulators have helped drive this change. They require regulated firms to identify critical business services, set recovery limits and test their ability to continue operations under severe but realistic scenarios.

These expectations are also spreading across supply chains. Regulated organisations must demonstrate that their suppliers can support business continuity during disruptions.

This means suppliers to banks, insurance companies, healthcare providers and large manufacturers may face stricter checks, even if they are not directly regulated.

What Do Buyers Expect From Suppliers?

Buyers increasingly focus on three key areas during supplier assessments.

1. Tested Recovery Time Objectives

Businesses must demonstrate that their recovery targets are realistic and achievable. For example, a supplier that promises to restore operations within four hours may face questions if it has never tested this target.

2. Records of Business Continuity Exercises

Buyers expect documented evidence of continuity exercises and their results. These records should include problems identified during testing and the corrective actions taken afterwards.

Exercises that report no failures or weaknesses may raise questions about whether the tests were designed to identify genuine risks.

3. Mapping of Critical Dependencies

Organisations must understand which suppliers, systems and employees support their critical activities. They should also assess the impact of losing access to these resources.

Dependency mapping is particularly important when several critical services rely on a single provider. Businesses must identify these risks and explain how they would manage a disruption.

How Does ISO 22301 Support Business Continuity?

ISO 22301 provides a framework for establishing and maintaining a business continuity management system. It covers business impact analysis, risk assessment, recovery objectives, documented procedures and regular exercises.

These requirements align closely with the evidence buyers now expect during supplier assessments.

However, the main challenge is often not the standard itself but how effectively an organisation implements its requirements. Businesses may have documented procedures without conducting realistic exercises or recording meaningful results.

Testing and exercising are therefore becoming important areas of scrutiny during customer assessments.

What Should Businesses Do Next?

Organisations certified to ISO 22301 should review their business continuity exercise records from the past two years.

They should check whether the records demonstrate what went wrong, how long recovery actually took and what corrective actions followed.

If every exercise is reported as successful without identifying any weaknesses, the organisation should review whether its testing approach is sufficiently realistic.

Businesses should use these findings to strengthen their recovery arrangements and maintain clear evidence of improvements.

As supplier due diligence becomes more demanding, organisations must demonstrate not only that they have a business continuity plan but also that they can put it into action when disruptions occur.