A business continuity consultant helps an organisation build, test and maintain its business continuity programme: scoping, business impact analysis (BIA), risk scenarios, strategies, plan writing, exercises and audit preparation. Their value lies not in the volume of documents delivered, but in getting the client to make decisions and leaving behind a capability that works without them.
Demand is growing, but the classic engagement model (interviews, spreadsheets, email chasing, Word deliverables formatted by hand) hits a ceiling fast: every new client starts almost from scratch, and margin disappears into work the client never sees. This guide covers the anatomy of a typical engagement, where margin leaks, how to standardise without losing quality, and how to move from one-off projects to recurring revenue without making the client dependent on you.
The 30-second version
- NIS2, DORA, customer due-diligence questionnaires and cyber insurers are pushing organisations that never bought BCM consulting to start.
- Engagement time rarely goes into writing: it goes into collecting BIA data, consolidating it and chasing sign-offs.
- Standardise collection, consolidation and formatting; keep judgement, challenge and facilitation for yourself.
- A run offer (annual BIA refresh, yearly exercise, audit preparation) turns a project into recurring revenue.
- The client owns its decisions, its plan and its data: a clean handover is part of the deliverable.
Why is demand for business continuity consulting growing?
Four forces are converging:
- NIS2 widens the scope. Directive (EU) 2022/2555 covers 18 sectors (11 of high criticality in Annex I, 7 other critical sectors in Annex II) and generally applies from medium-sized enterprises upwards. Article 21 explicitly lists "business continuity, such as backup management and disaster recovery, and crisis management", and Article 20 requires management bodies to approve these measures, oversee them and follow training: continuity becomes a board topic. National transposition is uneven; France, for one, had not finally adopted its law as of mid-October 2026.
- DORA reaches financial entities and their ICT providers. Applicable since 17 January 2025, Regulation (EU) 2022/2554 requires an ICT business continuity policy and at least yearly testing of the plans (Article 11). Article 30 requires contracts for ICT services supporting critical or important functions to include an obligation for the provider "to implement and test business contingency plans". A software vendor or managed service provider serving banks and insurers has to be able to show it.
- Customer questionnaires travel down the supply chain. NIS2 (Article 21(3)) asks entities to take into account the cybersecurity practices of their direct suppliers. Out-of-scope SMEs therefore receive questionnaires asking for an RTO, a tested plan and the date of the last exercise.
- Cyber insurers ask about recovery. In practice, underwriting and renewal questionnaires often cover backups, restore testing and incident preparedness.
Recent incidents do the rest: the faulty CrowdStrike update of 19 July 2024 (around 8.5 million Windows devices affected, according to Microsoft) showed that one unmapped dependency could stop everything. For the detail of the obligations, see NIS2 essential vs important entities and our DORA guide 2026.
What does a typical business continuity consulting engagement look like?
The sequence follows the logic of ISO 22301; only the depth changes between a 100-person company and a multi-site group. The table reflects field experience: the deliverables of each phase, and what actually consumes the days.
| Phase | Purpose | BCP deliverables | Where the time goes, in practice |
|---|---|---|---|
| 1. Scoping | Sponsor, scope, method | Scoping note, continuity policy, in-scope processes | Securing an available sponsor and a scope that stops moving |
| 2. BIA (interviews, workshops) | Measure the impact of disruption over time | BIA records, MTPD, RTO, RPO, dependency map | Scheduling, chasing, consolidating inconsistent answers, getting sign-off |
| 3. Risks and scenarios | Decide what must be covered | Selected scenarios, gaps between business RTOs and technical capability | Getting measured, not theoretical, restore times from IT |
| 4. Strategies | Decide how to meet the RTOs | Costed options, management decisions | Getting a decision: it belongs to the client, and it takes time |
| 5. Plan writing | Make strategies executable | BCP, DRP, crisis management plan, action cards, contact directory | Rebuilding the same structure, formatting, version control |
| 6. Exercise | Check the plan holds | Scenario, timeline, post-exercise review, action plan | Writing a credible scenario for this specific client |
| 7. Handover | Make the client self-sufficient | Evidence pack, maintenance calendar, trained coordinators | Gathering evidence scattered across emails and shared folders |
Two findings come up in almost every engagement. The BIA is the bottleneck: analysis is quick; getting complete answers from process owners with other priorities is not. And perceived value is concentrated in three moments: the workshop where RTOs are challenged, the meeting where management decides, and the exercise. Everything else is necessary but invisible to the client. For the full method, see our 8-step business continuity plan guide and the BIA guide.
Where does margin leak in a BCP engagement?
On a fixed fee, every unplanned day comes out of your margin. Six leaks recur:
- Chasing BIA answers by email. A spreadsheet attachment, partial replies, three versions of the same file. The consultant turns into a project secretary.
- Consolidating spreadsheets. Columns edited, impact scales interpreted differently, dependencies typed as free text: consolidation sometimes takes longer than collection.
- Rewriting the same plan structure. Activation criteria, crisis organisation, contact directory, procedures: the skeleton is identical from one client to the next, yet rebuilt by hand.
- Formatting Word deliverables. Broken styles, overflowing tables, numbering redone after every review round.
- Rebuilding evidence for the auditor. Who approved which BIA, when the exercise took place, which actions are closed: without a history, everything has to be dug up again.
- Plans going stale after handover. Six months later the contact directory is wrong. The client concludes the plan is useless, and the next engagement becomes harder to sell.
What they share: these tasks concern moving and formatting information, not expertise. That is exactly what can be standardised.
How do you scale BCM consulting without losing quality?
The rule: standardise the method and the data collection, never the content or the judgement. A generic plan does not survive its first exercise.
A versioned method library
Scoping template, impact scales, BIA questionnaire, plan structure, post-exercise review template: anything that does not depend on the client should exist once, be versioned, and improve from one engagement to the next. The free BIA template and the business continuity plan generator are a starting point.
Sector process catalogues
Two retailers look far more alike than a retailer and a hospital. A sector catalogue removes the blank page, provided you present it as a hypothesis to correct: the client deletes, renames and completes.
Asynchronous BIA campaigns
Instead of back-to-back two-hour interviews, send each process owner a structured form with a due date, reminders and a review circuit: they fill it in, you check consistency, an approver signs off or returns it for correction. Workshops then stop being data-entry sessions and become the place to challenge RTOs and resolve gaps. That is where your expertise shows.
Deliverables generated from structured data
When the BIA, dependencies and strategies live in one data model, the Word document becomes an export. A corrected RTO flows into the plan instead of being retyped in four files. AI can produce a first draft from that data, but it knows neither the client's real workarounds nor its culture: the consultant reviews, corrects and owns the result.
Reusable exercise scenarios
Ransomware, loss of a site, failure of a critical supplier: the structure of a scenario is reusable, while the injects adapt to the client's actual dependencies. See our 10 crisis exercise scenarios.
One workspace per client, strictly isolated
A BIA holds weaknesses, critical suppliers and personal phone numbers. One workspace per client, with its own roles and audit trail, protects the client and protects you. Under the GDPR you are often processing this data on the client's behalf, so your contracts and tools must allow for it.
What you should not standardise: the scoping conversation with management, challenging the RTOs, facilitating the exercise and running the post-exercise review. That is what the client is paying for.
From one-off project to recurring revenue: what should a run offer include?
A plan delivered and then left alone decays within months. Keeping the programme current is therefore a real and often mandatory need: DORA requires ICT business continuity plans to be tested at least yearly, and ISO 22301 calls for exercises at planned intervals, an internal audit and a management review. A typical annual cycle:
- Q1: BIA refresh by campaign, with each owner starting from last year's approved values.
- Q2: review of plans and contact directory, integrating changes (applications, suppliers, organisation).
- Q3: yearly exercise and post-exercise review.
- Q4: corrective action follow-up, preparation for the audit and the management review.
| Model | Best for | Advantages | Limitations |
|---|---|---|---|
| Fixed fee | Initial build with a clear scope | Predictable budget; good margin if the method is mastered | Overrun risk (late BIA, scope creep) sits with the consultant |
| Time and materials | Long engagements, uncertain scope | No overrun risk; flexible | Every productivity gain cuts revenue; hard for the client to defend internally |
| Subscription (retainer) | Annual run: BIA, exercise, reviews, audit | Recurring, predictable revenue; ongoing relationship | Needs a precisely written service scope, or it becomes open-ended time and materials |
| Hybrid | Most practices | Fixed-fee build, then a run subscription | Two contracts to align, especially on data ownership |
The time-and-materials trap deserves a name: if you bill by the day, efficiency reduces your revenue. Standardisation only pays off with fixed fees or subscriptions, where the client buys an outcome (a current BIA, an exercise delivered, an audit prepared) rather than days.
How do you keep the client in ownership of its plan?
A consultant who has become indispensable has done the job badly. Three principles protect the client's independence.
The client decides. RTOs, strategies, acceptance of residual risk and budget are management decisions. The consultant prepares, costs, recommends and facilitates the decision; the consultant does not sign. Get every decision approved in writing: it is also audit evidence of leadership (ISO 22301, clause 5).
The client operates. A named internal business continuity manager, trained coordinators, procedures written with the teams. If you are the only person who can launch a BIA campaign or find the latest version of the plan, you have become your client's single point of failure.
The client keeps its data. Plans, BIA, evidence and history must be retrievable at any time in a usable format. Write reversibility into the contract: who holds the workspace, who pays for the tool, how data is returned.
A clean handover includes, at minimum: approved and dated plans, the BIA with its approvals, the dependency map, the latest post-exercise review and its actions, the maintenance calendar, and access transferred to the internal team. Finally, internal audits must be objective and impartial: the firm that built the programme can prepare the audit, but should not perform it.
How should a consulting practice choose a business continuity tool?
A tool designed for one organisation rarely suits a firm serving ten. Questions to ask:
| Criterion | Question to ask | Why it matters |
|---|---|---|
| Multi-client isolation | Does each client have its own workspace, roles and audit trail? | Confidentiality, no cross-client mix-ups |
| Client access roles | Can a process owner contribute without seeing everything else? | Involve the business without exposing the whole BIA |
| Exports | Word and PDF plans, exportable data, evidence pack? | Presentable deliverables, real reversibility |
| Pricing | Does the price follow the number of clients? Who pays after the engagement? | Predictable margin as the portfolio grows |
| Data hosting | Where is the data? Are subprocessors listed? | A standard question from public-sector and financial clients |
| Frameworks | Are ISO 22301, NIS2 and DORA linked to the actual work? | Prepare audits without rebuilding everything |
| No lock-in | Can the client take its data back if it changes provider? | Client independence, and trust at signature |
If your practice still runs on spreadsheets, compare honestly: spreadsheet vs ResiPlan and our page for consultancies.
What ResiPlan does, concretely
- Operator mode: one isolated workspace per client, a single login to switch between them. Licences: Starter (up to 3 clients, €299 per month excl. VAT, billed monthly), Pro (up to 10 clients, €799 per month excl. VAT), Scale (up to 50 clients, €1,499 per month excl. VAT), Operator+ on quote.
- BIA campaigns sent to the client's process owners through a contributor portal where each person sees only the BIAs assigned to them: email reminders before the due date, return for correction, approval with separation of duties.
- Processes pre-filled by sector, with RTO and MTPD calculation.
- Plans pre-filled from the BIA, with an AI first draft that the consultant reviews and approves.
- Tabletop exercises, with findings turned into tracked corrective actions.
- Word and PDF exports and an ISO 22301 evidence pack; ISO 22301, NIS2 and DORA mapped.
- 7-day consultant trial with two fictional demo clients.
An honest caveat: software does not make anyone "compliant" and certifies no one; it structures the work of the consultant and the client without replacing it. Free 7-day trial, no credit card.
Checklist: is your continuity practice built to scale?
- Your method (templates, impact scales, BIA questionnaire, plan structure) exists as a single reference version.
- Sector process catalogues are presented to clients as hypotheses to correct.
- BIA collection runs through campaigns with due dates, reminders and approval.
- Workshops are used to challenge RTOs and make decisions, not to fill in forms.
- Deliverables are generated from structured data.
- Every management decision is approved in writing and dated.
- Each client has an isolated workspace with its own roles and audit trail.
- Evidence (approvals, versions, exercises, actions) is recorded as you go.
- An annual run offer is included in the initial proposal.
- The contract covers reversibility and the return of data.
- An internal business continuity manager can launch a BIA campaign and update a plan without you.
FAQ
How long does a business continuity consulting engagement take?
As an indication, 6 to 12 weeks for a first exercised version in an SME starting with two or three critical services, and several months for a multi-site group. The main drivers are the number of processes, the business teams' availability for the BIA and how fast management makes decisions. Writing is rarely the bottleneck.
Should a BCP engagement be fixed fee, time and materials or subscription?
Fixed fee suits the initial build when the scope is clear, time and materials suits uncertain scopes, and a subscription suits the annual run. Many firms combine a fixed-fee build with a run subscription. The more standardised your method, the more those two models outperform time and materials.
Do you need a certification to work as a business continuity consultant?
The title is not regulated. Personal certifications such as ISO 22301 Lead Implementer or Lead Auditor, or those from the Business Continuity Institute and DRI International, are reference points buyers recognise. In practice, clients also look closely at experience with organisations like theirs and with the regulations that apply to them.
Can the consultant write the plan on the client's behalf?
The consultant can draft, but not decide or operate. Degraded-mode procedures must be written with the business teams and decisions approved by management; otherwise the plan will not be followed on the day.
What happens to client data at the end of the engagement?
It belongs to the client. Provide in the contract for a complete export (plans, BIA, evidence, history) in a usable format, or for the workspace to be transferred to the internal team. A tool that makes this hard creates a dependency that experienced buyers refuse.
How do you adapt an engagement to NIS2 or DORA?
Add the client's regulatory status to the scoping (essential or important entity, financial entity, ICT provider to a financial entity) and map each deliverable to the relevant requirements: NIS2 Article 21, DORA Articles 11 and 30. For a financial entity, schedule the yearly test of ICT business continuity plans from day one.
Further reading
- Business Continuity Plan (BCP): 8-step guide for 2026
- BIA guide in 7 steps, with a free template
- ISO 22301 in 10 steps
- NIS2: essential vs important entities
- DORA guide 2026
- 10 crisis exercise scenarios
A continuity practice is judged less by the number of plans it delivers than by the number of clients whose plan is still true a year after the engagement ends.