Every organization, regardless of its size or sector, depends on people to keep it running. When a crisis strikes, whether it arrives as a power outage lasting several days, a cyberattack encrypting critical systems, or a natural disaster forcing an evacuation, the difference between recovery and prolonged disruption often comes down to one essential factor: knowing who does what. A business continuity plan without clearly defined roles and responsibilities is little more than a theoretical document, an aspirational set of procedures that cannot be executed when the pressure mounts and decisions must be made in minutes rather than hours. This lesson examines why the human element of business continuity planning deserves as much attention as the technical and procedural elements, how Canadian organizations structure their continuity teams, and what practical steps leaders can take to ensure their people are ready to respond when circumstances demand it.
The foundation of continuity team planning rests on a straightforward premise: crises create confusion, and confusion paralyzes action. When multiple people believe they hold decision-making authority, or worse, when no one believes they do, precious time evaporates while the organization waits for clarity that may never arrive. The International Organization for Standardization addresses this directly in ISO 22301, the international standard for business continuity management systems, which requires organizations to establish competence requirements for personnel involved in business continuity and to ensure that appropriate responsibilities and authorities are assigned and communicated. As of the date of authorship, this standard remains the primary international benchmark that Canadian organizations reference when building or auditing their continuity programs. The standard does not prescribe a single organizational structure, recognizing that a construction company with two hundred employees operating across multiple provinces will need a different team configuration than a six-person accounting firm or a community health non-profit. What the standard does require is clarity: everyone involved must understand their role, the scope of their authority, and the escalation pathways available when situations exceed their capacity to manage independently.
Canadian organizations operating under federal jurisdiction, including banks, telecommunications companies, interprovincial transportation firms, and broadcasting operations, face additional requirements that reinforce the importance of defined responsibilities. The Personal Information Protection and Electronic Documents Act establishes expectations around the protection of personal information that become acutely relevant during a business continuity event, particularly when alternative systems or manual processes must be deployed. Similarly, organizations in federally regulated industries must consider how the Canada Labour Code and associated regulations affect their continuity planning, particularly regarding the safety of employees who may be called upon to perform duties outside their normal scope during an emergency. Provincial occupational health and safety legislation across British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic provinces creates parallel obligations, requiring that organizations consider worker safety as a core element of any emergency response. As of the date of authorship, these provincial regimes share a common expectation that employers must take reasonable precautions to protect workers, an expectation that extends to situations where normal operations have been disrupted and alternative procedures are in effect.
The practical work of building a continuity team begins with understanding the functions that must be performed during and after a disruption, then identifying the people best positioned to perform them. Most organizations benefit from thinking in terms of three distinct but interconnected groups. The first group holds strategic authority and typically includes senior executives or, in smaller organizations, the owner or executive director. This group makes decisions about resource allocation, communications with external stakeholders such as investors, regulators, and major clients, and the fundamental question of whether to invoke the business continuity plan at all. The second group holds operational authority and consists of managers or senior staff who understand how specific functions work and can make tactical decisions about how to maintain or restore them. A retail operation might assign a store manager to this role, while a professional services firm might designate the managing partner of each practice area. The third group consists of the individuals who will actually perform continuity tasks, from IT staff restoring systems from backups to administrative personnel contacting clients to explain service disruptions to facilities staff assessing physical damage and coordinating repairs.
The distinction between these groups matters because confusion about authority levels creates some of the most damaging delays during a crisis. Consider the difference between a decision to switch to a backup server, which an IT manager should be empowered to make independently, and a decision to publicly acknowledge a data breach, which carries legal, regulatory, and reputational implications requiring executive involvement. When these authority boundaries are unclear, one of two problems emerges. Either operational staff hesitate to take necessary action because they fear overstepping, or they take action that creates unintended consequences because they did not recognize the need for escalation. Neither outcome serves the organization well, and both can be prevented through careful role definition during the planning phase rather than improvisation during the crisis itself.
Canadian organizations across sectors have learned through experience that continuity teams must account for the reality of modern work arrangements. The traditional assumption that key personnel will be physically present and available no longer holds in an era of remote work, distributed teams, and travel schedules that place decision-makers in different time zones. A continuity plan that assigns a critical role to the chief operating officer becomes problematic when that individual is unreachable on a flight to Halifax or attending a conference in Vancouver without reliable cellular coverage. For this reason, every designated role should have at least one clearly identified alternate, someone who holds sufficient knowledge and authority to act if the primary designee is unavailable. The alternates should be selected not merely for convenience but for genuine capability, and they should participate in training and exercises alongside the primary designees so they can step in without hesitation when circumstances require.
Quebec-based organizations and those with operations in Quebec must also consider how the Civil Code of Quebec influences employment relationships and the expectations that employees may hold regarding their duties during emergency situations. Unlike the common law provinces, where employment relationships are primarily contractual and modified by statute, Quebec's civil law framework treats employment as a distinct juridical relationship with obligations flowing in both directions between employer and employee. This distinction becomes relevant when organizations ask employees to take on continuity responsibilities that differ substantially from their normal duties, work from unfamiliar locations, or remain available during hours they would not typically work. Prudent organizations address these expectations explicitly in their continuity planning, ensuring that employees understand what may be asked of them and that their consent to these arrangements is obtained in advance rather than demanded in the moment of crisis.
The process of identifying and preparing a continuity team often reveals gaps that organizations did not previously recognize. A manufacturing firm in Calgary discovered during a tabletop exercise that its production manager, the individual best positioned to coordinate a recovery of manufacturing operations, had never been briefed on the company's insurance coverage and did not know what documentation would be required to support a business interruption claim. A non-profit organization in Ottawa realized that its executive director, the only person with signing authority for expenditures above five thousand dollars, had no designated alternate, meaning that emergency spending would be paralyzed if she were incapacitated or unreachable. A financial services firm in Toronto found that its cybersecurity incident response plan named individuals by position rather than by name, but that three of those positions had been restructured in the previous year without corresponding updates to the plan. Each of these situations represents a category of risk that role definition and team structure are designed to address, and each illustrates why regular review and testing of continuity arrangements matters as much as their initial creation.
A detailed scenario helps illustrate how these principles operate in practice. Consider a mid-sized environmental consulting firm headquartered in Edmonton with satellite offices in Saskatoon and Winnipeg. The firm employs approximately eighty people across the three locations and provides services to clients in the resource extraction, municipal government, and private development sectors. Its work depends on access to specialized software for geographic information systems analysis, field data collected over many years and stored in a combination of cloud and local systems, and ongoing communication with clients who often face regulatory deadlines that cannot be easily extended.
On a Tuesday in late January, the firm's Edmonton office experiences a significant fire in an adjacent building. Although the consulting firm's premises are not directly damaged, the building is evacuated and authorities indicate it may remain inaccessible for several days while structural assessments are completed. The fire occurs at approximately two o'clock in the afternoon, catching the organization at a point when most staff are present and working on active projects with near-term deliverables. The firm's senior leadership includes a chief executive officer who happens to be visiting the Winnipeg office that day, a chief operating officer who is in Edmonton but was offsite at a client meeting when the evacuation occurred, and three practice directors who lead different service lines.
In the immediate aftermath, confusion emerges quickly. Staff evacuate safely but find themselves standing in a parking lot in winter conditions without clear direction. Some begin checking their phones for guidance from leadership, while others simply leave for home, assuming the workday is over. The IT manager, who was in the building when the evacuation began, realizes that the backup generators supporting the firm's local servers will only maintain operation for approximately six hours, after which data accumulated since the previous night's backup may be lost. He attempts to reach the chief operating officer to authorize remote access to the server room, but she is driving and does not answer. He then calls the chief executive officer in Winnipeg, who authorizes the access but later learns that the building's security protocols require written authorization from the property management company, which cannot be obtained until the following morning. Meanwhile, three different staff members independently begin sending messages to clients explaining the situation, each with slightly different information about when services will resume.
The scenario reveals several implications for organizations thinking about their own continuity team structures. The first involves the challenge of distributed authority during a developing situation. The consulting firm had not established clear protocols for who speaks on behalf of the organization during an emergency, resulting in inconsistent client communications that later required correction and explanation. A designated communications role, with authority to approve or coordinate external messaging, would have prevented this problem. The second implication involves the relationship between authority and access. The IT manager held technical capability to address the server situation but lacked the organizational authority to obtain physical access from the property management company, and the individual with that authority was not readily available. Continuity planning should anticipate these access dependencies and establish protocols for emergency authorization. The third implication involves the welfare of staff who may find themselves in difficult circumstances without guidance. Employees standing outside in a January Edmonton afternoon need to know whether they should wait, go home, proceed to an alternate location, or take other action. A continuity team structure should include someone responsible for staff communication and welfare, distinct from the individuals managing technical recovery and external communications.
When the firm's leadership reconvened the following week to assess their response, they identified several concrete improvements to implement. They established a three-person emergency management team consisting of the chief executive officer as primary decision-maker, the chief operating officer as alternate with full authority to act in the chief executive officer's absence, and one of the practice directors as a third alternate. They designated the firm's human resources manager as the point of contact for staff communication during any emergency, with authority to send messages through the firm's communication platforms without requiring approval from senior leadership. They documented relationships with the building's property management company and obtained advance authorization for emergency access by three named individuals. They also established an agreement with a commercial coworking space in Edmonton that could serve as a temporary office location if needed, and they briefed staff on the existence and location of this fallback option.
The steps this organization took illustrate a broader set of practices that any Canadian organization can adapt to its own circumstances. Building a continuity team begins with identifying the decisions that must be made during a disruption and working backward to determine who should make them. Some decisions are purely operational and can be delegated to front-line managers or technical specialists. Others carry significant organizational implications and require executive involvement. Still others, particularly those involving external communications, legal obligations, or major financial commitments, may require input from board members, legal counsel, or other advisors who are not part of the organization's regular staff. Mapping these decision types to specific individuals creates the foundation of a continuity team structure.
Once roles are identified, organizations should document them in a format that remains accessible during a crisis. This documentation should include not only names and titles but also contact information, noting that personal mobile numbers and email addresses may be more reliable than office lines and corporate email systems during a disruption. The documentation should specify alternates for each role and clarify the circumstances under which an alternate may act. Some organizations adopt a simple time-based rule, providing that if the primary designee cannot be reached within thirty minutes, the alternate assumes authority. Others use more contextual approaches, empowering alternates to act whenever they reasonably believe the primary is unavailable or incapacitated.
Training and exercises transform documentation into genuine capability. A person who has never practiced making decisions under pressure will perform differently than someone who has worked through tabletop scenarios and encountered simulated challenges. Organizations should conduct exercises at least annually, and more frequently after significant organizational changes or following any real disruption that reveals gaps in the existing plan. Exercises need not be elaborate or time-consuming. A two-hour tabletop session in which leadership works through a scenario similar to the one described earlier can surface assumptions that need examination, dependencies that need documentation, and capabilities that need development. The investment in this preparation pays returns not only during actual emergencies but also in the clarity and confidence that staff carry into their daily work.
Documentation, training, and testing also create records that may become relevant in other contexts. Insurance claims for business interruption losses often require demonstration that the organization took reasonable steps to prepare for and respond to disruptions. Regulatory inquiries following a significant incident may examine whether the organization had adequate continuity arrangements in place. In litigation arising from contractual disputes or allegations of negligence, the existence of a well-documented and regularly tested continuity program can demonstrate the standard of care the organization applied. While these considerations should not drive continuity planning, they reinforce the value of maintaining current records of team assignments, training completion, and exercise outcomes.
Organizations should also consider how their continuity team arrangements intersect with any collective agreements or employment contracts that may be in effect. Unionized workplaces may have provisions addressing the assignment of duties outside normal job descriptions, call-back pay for employees summoned during off-hours, or consultation requirements before implementing significant changes to working conditions. These provisions do not prevent effective continuity planning, but they may influence how roles are defined and how employees are compensated for continuity-related activities. Proactive discussion with union representatives during the planning phase typically produces better outcomes than attempting to navigate these issues during an actual emergency.
The work of building a continuity team ultimately reflects a commitment to organizational resilience that extends beyond any single plan or procedure. When people throughout an organization understand their potential roles during a disruption, when they have been trained and exercised in those roles, and when they trust that leadership has thought carefully about how to protect both the organization and its people during difficult circumstances, the organization becomes genuinely more capable of weathering challenges that would otherwise threaten its survival. This human infrastructure, the network of relationships, authorities, and capabilities that enables coordinated action under pressure, represents one of the most valuable investments any organization can make. Unlike technology that becomes obsolete or facilities that can be damaged, the knowledge and commitment of a well-prepared continuity team travels with the people who compose it, ready to be deployed whenever circumstances demand.