This framework divides BCM into six broad areas:

Risk Analysis and Review
The potential threats and risks to an organization can be uncovered via a risk analysis and review of its internal operations and external operating environment.  Examples of risks due to internal operations include malfunction of critical manufacturing processes, failure of Information Technology (IT) systems and fire which destroys plant facilities.

Business Impact Analysis (BIA)
The potential impacts of risks actually occurring to an organization and affecting its ability to achieve its business operation and service can be obtained by conducting a business impact analysis.  The later would include, where possible, quantifying the loss impact from both a number of days of business disruption and a financial standpoint.

Strategy
Based on these potential loss impacts the organization would deliberate and select the appropriate strategy or strategies to safeguards its interests.  These strategies can be preventive or pre-emptive in nature.

BC Plan
From the selected strategies a detail business continuity plan (BC Plan) should be instituted in place to respond to risks which can occur and impact its business operation and service.  The BC Plan would specify and allocate the resources and thereby building up the capability of the organization to respond to risk occurrences.

Tests and Exercises
An established BC Plan should be subject to verification via Tests and exercises.  Tests and exercises expose probable errors and omissions in carrying out the established plan.  It examines if the resources committed are accessible, available and adequate for undertaking the recovery efficiently and effectively.  It checks if staff in the organization are familiar with recovery procedures.  Overall Tests and exercises validate if the BC Plan indeed meet its recovery objectives.

Program Management
Besides an established and thoroughly tested BC Plan the organization should demonstrate commitment in maintaining the currency of its plan through regular and systematic review of its risks and business impacts, realigning of its BCM strategies and revalidating of its BC Plan on a continuous basis.  BCM should become an integral part of the organization’s operations, audit, testing, quality assurance, change management and culture.  Ownership of BCM becomes embedded in individual business units where BCM risks reside.