Two meanings of one term
Continuity of operations is a term with two meanings. In financial reporting, it is the assumption that the organisation will keep operating in the foreseeable future (going concern), and the auditor checks it. In management, it is the company’s ability to keep critical processes running through disruption, which a business continuity management system (BCM) provides. Regulators, including the Bank of Russia, use the second meaning.
An auditor who writes about the “going concern principle” and a risk manager who writes about “ensuring continuity of operations” are talking about different things. The two meanings have different requirements, documents and owners, so each is covered separately below.
Meaning 1: the going concern principle in financial reporting
The going concern principle (or assumption) is the assumption that the organisation will keep operating in the foreseeable future and does not intend to liquidate. Financial reporting is built on it: assets are not valued at liquidation value. Management must assess whether the assumption applies, and the auditor must check it. A material uncertainty is disclosed in the financial statements and appears in the audit report. This is the territory of accounting, IFRS and audit.
Meaning 2: operational continuity (BCM)
Ensuring continuity of operations, in the management sense, is the company’s ability to keep critical operations going through disruption: an IT failure, an accident, loss of a supplier, a cyberattack. The tools are business impact analysis (BIA), a business continuity plan, exercises and measurable resilience indicators. For financial organisations this is a Bank of Russia supervisory requirement: operational continuity and recovery (ONiVD) and the ONiVD plan. In international practice it is ISO 22301 and national standards (a review of the standard).
How they are connected
The link is direct. A serious operational disruption (long downtime, data loss, departure of key customers) can call the going concern assumption itself into question. A company that manages its operational resilience and can show it in numbers removes the concerns of the auditor, the bank and the investor. That is why mature companies bring the two together, financial monitoring of resilience and operational BCM, on one management screen (an example is our dashboard).
Map of materials: where to start
- New to the topic: what BCM is and why owners need it.
- Need a document: a business continuity plan in 7 steps.
- You are a bank or a non-bank financial organisation: Bank of Russia requirements (ONiVD and the ONiVD plan).
- You want numbers: the cost of downtime and how to measure resilience.
- You are worried about cyberattacks: ransomware readiness.
- Quick start: a 5-minute assessment.
Frequently asked questions
Who in the company is responsible for continuity of operations? For the reporting assumption, the CFO and the chief accountant. For operational continuity, an appointed senior executive; in regulated organisations this is a supervisory requirement.
Is it the same as business continuity? In the management meaning, yes, the two are full synonyms: banks and the public sector more often say “continuity of operations”, and private companies say “business continuity”.
Where do you start if you have nothing? With a quick assessment. Then you list the critical processes and calculate the cost of their downtime. This takes about a week of work, and all further decisions rest on facts.
Where to start with business continuity
13 questions and 5 minutes will show your readiness level. Then there are two paths: work it out yourself through the programme, or build the system with us.