# Where the Business Continuity Plan Hands Off to the Crisis

> Der Beitrag von Swiss GRC erklärt, warum die Übergabe vom dokumentierten Business Continuity Plan ins operative Krisenmanagement oft scheitert. Er richtet sich an Institute, die unter FINMA-Rundschreiben 2023/1 stehen, und zeigt, wie Schichtwechsel und Rollenübergaben getestet werden.

- URL: https://swissgrc.com/en/business-continuity-plan-crisis-handover/
- Publisher: SwissGRC®
- Published: 2026-09-02
- Last updated: 2026-09-17

## Key facts

- Die Übergabe zwischen Business Continuity Plan und operativem Krisenmanagement scheitert laut Beitrag meist an Schichtwechseln und Rollenübergaben im Krisenteam, die klassische Tests selten abbilden.
- Das FINMA-Rundschreiben 2023/1 verlangt von Banken einen dokumentierten Business Continuity Plan mit Disaster-Recovery-Komponente, der mindestens einmal jährlich überprüft wird.
- Das FINMA-Rundschreiben 2023/1 ist am 1. Januar 2024 in Kraft getreten und sieht gestaffelte Übergangsfristen von bis zu zwei Jahren vor.
- ISO/IEC 27031 verlangt, dass Tests und Übungen nicht nur die Wiederherstellung von ICT-Diensten abdecken, sondern auch den Schutz von Werten vor Störungen und die Minimierung von Schadenfolgen.
- Die Geschäftsleitung ist für Umsetzung und Dokumentation des Managements operationeller Risiken verantwortlich, der Verwaltungsrat genehmigt und überwacht es regelmässig.
- Als ersten Schritt legt die verantwortliche Stelle bei der nächsten jährlichen Überprüfung fest, welche Übergabepunkte im Krisenteam bestehen, und ordnet jedem Punkt einen Namen und einen Auslöser zu.

The business continuity plan is in place, approved by executive management and formally covers the regulatory requirements. Yet in many organisations operational crisis management does not fail because a plan is missing, but at the point where documented measures must turn into actual action. This handover between paper and practice is rarely tested explicitly and is often left out of classic tests. Exactly where this interface breaks usually only becomes apparent in a real crisis.

In short

The handover between a documented business continuity plan and operational crisis management usually does not fail because a plan is missing, but because of shift changes and role handovers in the crisis team that classic tests rarely simulate. Regulatory requirements such as FINMA Circular 2023/1 do require tests based on severe but plausible scenarios, but these primarily verify that a plan exists, not whether the organisation can actually act under time pressure.

## What does regulation require of the business continuity plan?

FINMA Circular 2023/1 on operational risks requires banks to maintain a documented business continuity plan including a disaster recovery component, which is reviewed at least once a year.

The circular replaces the previous ‘Recommendations for Business Continuity Management’ issued by the Swiss Bankers Association as the minimum standard and entered into force on 1 January 2024, with staggered transition periods of up to two years to ensure operational resilience.

As part of the business impact analysis, each institution identifies its critical processes together with recovery time, data loss tolerance and the resources required for them. Implementation must be assessed regularly through tests such as table-top exercises, with the test scope covering severe but plausible scenarios.

## Why is a plan on file not enough on its own?

Because in practice tests often confirm only that the plan exists and is up to date, not that the organisation is actually able to execute it under pressure.

A specialist analysis of the practical implementation of business continuity plans finds that many companies have already identified their risks but struggle to implement the strategy derived from them. The focus is usually on drafting the plan rather than on realising it, because translating theory into practice requires coordination, precision and continuous adjustment.

ISO 22301 addresses this pattern with the PDCA cycle: in the ‘check’ phase, business continuity plans must be tested and the results monitored, not documented just once. The plan thus remains a means to an end, not an end in itself.

![Business Impact Analyse in der SwissGRC Plattform](https://swissgrc.com/wp-content/uploads/sites/2/2026/08/BIA-1024x582-1.png)

Exercises and Tests on the SwissGRC Platform

## Where exactly does the handover break down in a real crisis?

At the shift changes and role handovers within the crisis team, which become unavoidable in situations that last longer.

A specialist article on exercises in business continuity management notes that longer exercises spanning two or more days reflect the realistic challenges of an emergency particularly well, because they require shift changes in crisis management and handovers within processes. It is precisely at these handovers that it becomes clear whether responsibilities, awareness of the situation and decision-making authority are actually passed on, or whether knowledge is lost with every change.

ISO/IEC 27031 therefore requires that tests and exercises not be limited to restoring ICT services, but also cover protecting assets from disruption and minimising the impact of damage. A test that only measures the technical recovery time does not examine the point where the handover actually fails in practice.

## Who is responsible for these handover points?

Executive management is responsible for implementing and documenting the management of operational risks, while the board of directors regularly approves and oversees this management.

This allocation formally clarifies who is responsible for the plan as a document. It does not, however, answer who is responsible for the handover between shifts in the crisis team in a real event, or who decides when an escalation to the next level takes place.

Even for third parties whose resources feed into the business impact analysis, a designated party is needed to coordinate the handover in a real event. Without this allocation, responsibility remains where it is written in the document, not where it is needed in the event itself.

## How can the handover be tested and closed in concrete terms?

By having the next test exercise specifically simulate a shift change or role handover and document who takes over responsibility and at what point.

A first step: during the next annual review of the business continuity plan, the responsible party defines which handover points exist within the crisis team and assigns a name and a trigger to each point. This assignment is documented as an explicit part of the plan, not merely noted as an observation from the last test exercise. A similar gap between what a document prescribes and what must already be operationally in place also appears in other regulatory deadlines, such as the ISMS obligation under Switzerland’s Information Security Act (ISG).

Related

### From plan to rehearsed handover

Business Continuity documents critical processes, resources and exercise results in one place, and records who is responsible for each handover point in the crisis team.

[Business Continuity](https://swissgrc.com/en/bcm-software/)

For practice

## Key points

- Institutions check whether their business continuity plan explicitly names handover points in the crisis team, not just critical processes and resources.
- Test exercises specifically simulate shift changes over several days, because that is exactly where knowledge and decision-making authority can be lost.
- Under ISO/IEC 27031, tests cover more than ICT recovery and include the protection of assets and the minimisation of damage.
- For each handover point, a named responsible person with a clear trigger is documented, not just executive management as the overall responsible party.
- The annual review of the plan under FINMA Circular 2023/1 is used to add handover points, not only to update RTO and RPO.

FAQ

## Frequently asked questions

What deadline applies to implementing FINMA Circular 2023/1?

FINMA Circular 2023/1 entered into force on 1 January 2024 and replaces the previous BCM recommendations of the Swiss Bankers Association as the minimum standard. Staggered transition periods of up to two years apply to implementation, within which institutions must align their business impact analysis, business continuity plan and associated tests with the new requirements.

Why does a tested business continuity plan not automatically suffice?

In practice, tests often confirm only that a business continuity plan exists and is up to date, not that the organisation can actually execute it under time pressure. The focus is frequently on drafting the plan rather than on realising it, because translating it into practice requires coordination and continuous adjustment.

What role do shift changes in the crisis team play in crisis management?

In exercises lasting two or more days, shift changes in the crisis team become unavoidable. It is precisely at these handovers that it becomes clear whether responsibilities, awareness of the situation and decision-making authority are actually passed on, or whether knowledge is lost with every change, which reveals the actual resilience of crisis management.

Who is responsible for managing operational risks according to FINMA?

Executive management is responsible for implementing and documenting the management of operational risks, including the business continuity plan. The board of directors regularly approves and oversees this management. Who specifically coordinates the handover between shifts in the crisis team in a real event is, however, not yet formally clarified by this.

What does ISO/IEC 27031 require in addition to recovery tests?

ISO/IEC 27031 requires that tests and exercises not be limited to restoring ICT services. They should also cover protecting assets from disruption and minimising the impact of damage, so that not only the technical recovery time is tested but also the organisation's actual ability to act.

Sources

1. [FINMA Circular 2023/1 on operational risks and resilience](https://www.finma.ch/en/news/2022/12/20221213-mm-anh-rs-op-risks/)FINMA
2. [Principles for Operational Resilience](https://www.bis.org/press/p210331a.htm)Bank for International Settlements (BIS)

## Frequently asked questions

### Seit wann gilt das FINMA-Rundschreiben 2023/1 und welche Fristen gelten?

Das FINMA-Rundschreiben 2023/1 ist am 1. Januar 2024 in Kraft getreten. Für die Umsetzung gelten gestaffelte Übergangsfristen von bis zu zwei Jahren.

### Warum reicht ein getesteter Business Continuity Plan nicht aus?

Tests bestätigen in der Praxis oft nur, dass der Plan vorhanden und aktuell ist, nicht dass die Organisation ihn unter Druck umsetzen kann. Der Fokus liegt häufig auf der Erstellung des Plans statt auf seiner Umsetzung.

### Welche Rolle spielen Schichtwechsel im Krisenteam?

Bei Übungen über zwei oder mehr Tage werden Schichtwechsel unvermeidlich. An diesen Übergaben zeigt sich, ob Zuständigkeiten, Lagebewusstsein und Entscheidungskompetenz weitergegeben werden oder ob mit jedem Wechsel Wissen verloren geht.

### Wer ist laut FINMA für das Management operationeller Risiken verantwortlich?

Die Geschäftsleitung ist für Umsetzung und Dokumentation verantwortlich, der Verwaltungsrat genehmigt und überwacht das Management regelmässig. Wer im Ereignisfall die Übergabe zwischen den Schichten koordiniert, regelt diese Zuordnung nicht.

### Was verlangt ISO/IEC 27031 zusätzlich zu Wiederherstellungstests?

Tests und Übungen sollen sich nicht auf die Wiederherstellung von ICT-Diensten beschränken. Sie umfassen auch den Schutz von Werten vor Störungen und die Minimierung von Schadenfolgen.