From Spreadsheets to Strategy: Why Half of Municipalities Still Don't Have Updated Business Continuity Plans
And what forward-thinking organizations are doing about it
When we asked webinar attendees if they had an up-to-date, active business continuity plan, 53% said no. That's not surprising. What is surprising is that 77% cited "not enough time" as their biggest barrier.
Sound familiar?
The Real Cost of Outdated Planning
Over the past few years, we've witnessed the devastating impact of disruptions on municipal operations. Wildfires tearing through Jasper. Floods in Abbotsford. Tornadoes destroying data centers in Huron County. Ransomware attacks crippling city services.
These aren't isolated incidents. They're becoming our new normal. Yet many municipalities are still managing their business continuity plans in spreadsheets that no one updates, with unclear ownership, and minimal collaboration between IT and business units.
The "It's an IT Problem" Myth
Here's what we keep hearing: "IT is expected to drive this."
But here's the reality: IT cannot define Recovery Time Objectives (RTOs, meaning how long your organization can survive without a critical service) for services they don't deliver. How can IT possibly know that tax administration needs to be back online within 24 hours without the business unit telling them?
The most successful BCP programs we've seen share three critical characteristics. We call them the ABCs.
Annual Funding - This is a program, not a project. One and done doesn't work.
Business Ownership - Departments must own their continuity plans. Period.
Collaboration - IT and business units working together to define realistic RTOs that drive technology requirements and costs.
The Collaboration Gap
When everything is marked "critical," IT disaster recovery costs skyrocket. But when departments properly assess their true recovery needs through structured impact analysis, something remarkable happens. Costs come down, plans become realistic, and organizations get better protection for their most essential services.
We've seen this play out dozens of times. Once departments understand the real trade-offs, not just saying "we need everything back immediately," they often realize that a three day or seven day RTO makes more sense than the 24 hour target they initially demanded.
Moving Beyond Emergency Management
There's a positive shift happening. Early on, virtually every BCP project was IT led. Now we're working more with Emergency Management departments who are bringing IT in collaboratively for the disaster recovery components. This is the way it should work. Emergency Management leading the strategy, with IT as a critical partner, not the sole owner.
The Modern Approach
The organizations succeeding with BCP are those who've moved beyond static documents and spreadsheets to structured, integrated approaches that do a few key things really well.
They integrate application catalogs with business services so you know which technologies support which critical functions. They calculate RTOs dynamically using validated frameworks to determine realistic recovery targets. They enable micro updates so plans stay current with minimal effort, like 2 to 3 hours per year per department.
They provide executive visibility through dashboards and scorecards to tell the resilience story. They test regularly with tabletop and functional exercises to validate plans. And they map dependencies so you understand the ripple effects when a system or facility goes down.
The Bottom Line
With new legislation like BC's Emergency and Disaster Management Act pushing municipalities toward mandatory business continuity planning, the question isn't whether you need a BCP. It's whether your current approach is sustainable.
If your plan lives in a spreadsheet, hasn't been updated in years, or if departments can't agree on realistic recovery targets, you're not alone. But you also can't afford to stay where you are.
The good news? Organizations are successfully implementing comprehensive BCP programs without overwhelming their teams. The key is structure, ownership, and tools that make maintenance manageable instead of impossible.
Want to see how organizations are modernizing their business continuity planning?
Watch the full webinar replay or reach out to discuss your BCP challenges. Sometimes the best investment in resilience is simply making it easier to maintain.
Ben Perry and Gary Walker from Perry Group Consulting recently hosted this webinar sharing practical insights from working with municipalities on business continuity planning across Canada. Gary is a certified business continuity professional through the Disaster Recovery Institute, and the team has worked with over 250 municipalities on technology modernization and digital transformation.