Business Continuity Plan Register & Review

The problem this kills

Your business-continuity and disaster-recovery plans are only worth anything if they're current. But the plans live in a shared drive, the review dates live in someone's head (or a spreadsheet tab nobody opens), and "we'll test it next quarter" quietly becomes two years. When an auditor - or an actual incident - shows up, you find out the recovery plan references a system you retired, names an owner who left, and was last tested before the last reorg.

The hard part isn't writing the plans. It's the upkeep: knowing which plans are due for a paper review, which are due for an actual test, who owns each one, which version is live, and chasing all of that down by hand across dozens of plans and sites. Review currency and test currency are two different clocks, and most spreadsheets track neither well.

This plan gives you a single, living register that does the chasing for you - and never lets a plan reset its own clock without a human signing off.

What you'll build

A small, private web app - just for your team - that:

• Holds every plan with its scope (process / site / system), owner, version, last-reviewed date, last-tested date, and review/test frequencies, plus the plan file itself in version-tracked Storage.
• Computes two clocks per plan: next-review-due and next-test-due, and shows a clear status (current / due soon / overdue / long-overdue) for each.
• Emails owners before a plan goes stale, and escalates the long-overdue ones to the continuity manager.
• Captures the outcome when an owner completes a review or a test - what happened, what changed, the updated plan file.
• Holds a human gate: the continuity manager reviews each outcome and approves the new next-review/next-test date before the cycle resets. Nothing resets on its own.
• Exports the full register as a CSV with review and test status, for board packs, audits, and management review.

What's inside the Implementation Plan

A complete, paste-and-go runbook written for a non-coder. You paste the whole thing into an AI coding agent (Claude Code) and answer its questions as it builds.

It opens by interviewing you about your actual continuity programme - your plan types, how you name and number them, your review and test cadences, your escalation rules, and your messy exceptions - so the tool fits your portfolio instead of a generic template. The agent reads a short tailored spec back to you and waits for your thumbs-up before building anything.

From there it walks you step by step: setting up the database, importing your plan inventory (CSV or Google Sheet) and plan files, computing the two due-date clocks, wiring the Resend reminders and escalations, building the owner outcome form and the manager approval gate, and finally the register CSV export. Every build step ends with a ready-to-copy prompt.

There's also a "No API yet?" fallback baked in: even if you can't connect to your GRC or document system today, you import a CSV / Sheet and export a clean CSV in the exact columns your system expects - so the tool is fully buildable this afternoon.

The governance it includes (this is the point)

This isn't a spreadsheet with reminders bolted on. The plan builds in the controls a risk function actually needs:

• Login so only your team can open it.
• Row-level security so each organization only ever sees its own plans.
• A complete audit trail - who reviewed, who tested, who approved, and exactly when.
• A hard human-in-the-loop approval gate - the AI and the system can flag, remind, and draft the next dates, but only the continuity manager's approval resets a plan's cycle.
• Duplicate guards keyed on plan-id + version, so the same plan version can't be imported or processed twice.
• Version history of every plan file, so you can always see what the plan said at any past review.

Who it's for

Continuity managers, business-resilience leads, and risk/compliance teams who maintain a portfolio of BC/DR plans across processes, sites, and systems - and who are tired of finding out a plan went stale only when it's too late to matter.

You've got this - paste the first prompt and let the agent interview you.