Governance, Risk & Compliance · Govern
Plans written and filed give a false sense of safety, because the first real test of an untested plan is the incident itself. We start from a business impact analysis that establishes which processes matter most and how long each can be interrupted, then set recovery time and recovery point objectives the business genuinely needs and will fund. From there we design the recovery arrangements and document plans people can follow under pressure. We then exercise them — tabletop and technical — because testing is the only thing that converts a document into a capability, and it always finds something.
In short
Business continuity and disaster recovery planning establishes how the organisation keeps operating and recovers when systems or sites fail. An untested plan is an assumption, so the work is only finished once an exercise has shown it holds.
Start a conversationWhat we do
We establish which processes matter most and how long each can be interrupted before the consequences become serious. This analysis is what keeps recovery planning proportionate, so effort goes to the processes that genuinely cannot wait. It also settles the dependencies between processes, which determine the order in which things must come back.
We set recovery time and recovery point objectives that the business genuinely needs and is willing to fund. Objectives set by aspiration rather than cost tend to be quietly ignored when the invoice for the supporting infrastructure arrives. Agreeing them explicitly aligns what the business expects with what it has actually paid for.
We design the technical and operational recovery arrangements and document plans that can be followed by people under pressure, not only by their authors. A plan that assumes calm conditions and full staffing fails in the circumstances it was written for. We keep the plans concrete about who does what, in what order, with which fallback.
We run tabletop and technical exercises and then fix what they expose. Exercises reliably reveal the gaps a document review never would — missing contacts, untested restores, dependencies nobody mapped. Treating the findings as improvements rather than failures is what steadily turns the plan into a dependable capability.
What you receive
Documented output your teams keep and can act on without us in the room.
When this work helps
How an engagement runs
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.
Where we work
Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.
Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.
Related services
Third-party risk management controls the risk your suppliers, processors and partners introduce across their lifecycle. It is organised by what each supplier can actually affect, so scrutiny lands where it matters and routine purchases are not held up.
Vendor risk assessment evaluates a specific supplier's security, privacy and resilience posture before or during engagement. It reads behind the certificates and questionnaire answers to what is actually covered, and ends in a clear recommendation.
Internal IT audits independently test whether technology controls are designed well and operating as described. They replace the assertion that controls work with evidence of whether they actually did over the period examined.
Questions
Straight answers to what buyers ask us before an engagement begins.
Enquiries
Your enquiry lands in the same inbox as every other on this site and is read by us. Tell us the requirement and we will reply with a practical next step.
Prefer email? contact@fidovaadvisory.com
Next step
