In the previous step you worked to reduce the vulnerability of your agency to particular risks.

Now we get to the final step in the process — preparing for the steps you will take if a risk does happen, in order to reduce the impact it has on your business.

Reducing the impact of an adverse event has two steps:

  1. Respond: being able to react effectively, as fast as possible, in order to stop the problem, or at least prevent knock on effects.
  2. Recover: being able to get back to normal running as rapidly as possible.

For example, imagine a burst pipe floods your office. Responding is turning off the water and getting your people, computers and files out of the building and set up to work from somewhere else or from home. Recovering is fixing the pipe, drying out the office and redecorating so you can get back to normal running again.

All adverse events need a similar two-phase approach. The speed and effectiveness of each stage will be substantially improved if you've prepared for it in advance.


A good response should be both rapid and effective.