Course overview
Strategic risk is the exposure that can make the plan irrelevant: a technology shift, a regulatory change, a market that moves away from you, a supplier failure at the wrong moment. Business continuity is what keeps the organization functioning when one of them arrives. The two are usually handled by different people who rarely meet, which is how organizations end up with a strategy that ignores its own fragility and a continuity plan for events that were never the real threat.
This course covers strategic risk planning and continuity across five units: the foundations, risk assessment and scenario analysis, business continuity planning, crisis management and response, and embedding resilience. It is educational and does not certify participants or organizations.
Where the strategy is actually fragile
Rarely where the risk register says. It is fragile where the plan depends on an assumption nobody wrote down: that the key supplier stays solvent, that a regulation will not change, that the two people who understand the core system will still be there, that customers will keep behaving as they did last year.
Writing those assumptions down and monitoring each one is the single most useful strategic risk exercise available. It converts an abstract risk register into a list of specific things that would tell you, early, that the plan is in trouble.
Course objectives
By the end of the course, participants will be able to:
- Locate the risks that make a strategy wrong, not merely difficult.
- Rank services by the hours the business can survive without them.
- Shorten the gap between a promised recovery and a real one.
- Recover a service by hand when the primary system is gone.
- Declare an incident early enough for the response to matter.
- Sequence the first hour so decisions do not wait for consensus.
- Rehearse a recovery under real time pressure.
- Revise the plan on the evidence a real incident produced.
Course outline
Unit 1: Foundations of strategic risk planning
- Strategic risk against operational risk in the plan.
- Dependencies the strategy never put on an invoice.
- Risk appetite in a strategy, and the exposure it creates.
- Documented outages that followed an unfunded risk.
Unit 2: Risk assessment and scenario analysis
- Identifying exposure in markets, technology and suppliers.
- Loss of a site, a system or a supplier for three days.
- The hour at which a service outage becomes unrecoverable.
- Maximum tolerable disruption expressed in hours.
Unit 3: Business continuity planning
- Restoration order across services, and who set it.
- Recovery time objectives against what the systems deliver.
- Recovery point objectives and the data lost since backup.
- Manual workarounds and the dependencies they rely on.
Unit 4: Crisis management and response systems
- Activation thresholds and who is allowed to declare.
- Command of the response when there is no time to agree.
- What staff and customers are told before the facts settle.
- Calls to suppliers, authorities and the crews on site.
Unit 5: Embedding resilience and continuous improvement
- Rehearsing the switch to a workaround before it is needed.
- Rewriting the plan after a new system goes live.
- A second supplier that depends on the same single plant.
- Post-incident review that changes a plan, not a slide.
How the course is delivered
Sessions use documented material: strategy papers, assumption registers, impact assessments, continuity plans and post-incident reviews, which participants analyze and rebuild in discussion. Testing is covered through structured tabletop discussion of documented scenarios; there is no staged exercise or technical environment. The course is educational and does not certify participants or assess any organization's arrangements. Participants whose exposure is primarily technological should look at Digital Risk Management and Business Continuity.
Who should attend
- Risk managers and continuity professionals responsible for resilience.
- Strategy and planning leaders whose plans carry strategic exposure.
- Operations and site leaders who would execute the continuity plan.
- Executives and board members accountable for organizational resilience.
About EuroQuest International Training
EuroQuest International Training was founded in 2015 by a team with more than 25 years of experience in professional development. We deliver over 1,000 courses and have trained more than 15,000 participants, from our head office in Bratislava, Slovakia, with hubs in Dubai, London, Barcelona, Istanbul, Vienna, Paris and Geneva. Courses are developed and reviewed by practitioners from the fields they teach.
Frequently asked questions
Is a continuity plan worth the effort for a mid-sized organization?
A proportionate one is. A business impact analysis, two or three realistic recovery strategies and a contact list that is actually current will deliver most of the benefit without the apparatus a large enterprise maintains.
Does the course run a full crisis exercise?
No. It uses structured tabletop discussion of documented scenarios, where participants argue the decisions and defend them. There is no staged or acted exercise.
Will the course certify our continuity management system?
No. Certification against ISO 22301 is performed by certification bodies. The course is educational and does not certify participants or organizations.
Related courses
- Crisis Management and Risk Leadership
- Operational Risk Management in Large Enterprises
- Enterprise Risk Management Strategies
- Risk-Based Decision Making for Executives
Register for this course
Choose a city and date from the schedule above to register, or contact EuroQuest about in-house delivery for a risk, continuity or leadership team.
All Course Dates & Locations
21 dates · 12 cities · Oct 2026 – May 2027