Business Continuity & Crisis Management

Most organizations are prepared for the crisis that damages them. Very few are prepared for the crisis that ends them.

There is a category of disruption that no insurance policy absorbs, no recovery site restores and no manual anticipates. It does not arrive as fire, flood or outage. It arrives as a decision — taken in a ministry, a sanctions office, a courtroom or a palace, by people who have never heard of your company and whose reasoning has nothing to do with you.

A counterparty is designated overnight and every contract touching it becomes unexecutable. A licence held for eleven years is not renewed, and no one will explain why. A strait closes and a fleet becomes a floating inventory problem. A minister falls and the concession negotiated with his predecessor is reopened. A supplier three tiers down is absorbed by a sanctioned holding, and the organisation discovers it only when the payment is rejected.

None of these are accidents. Each was visible before it happened, to someone who was reading the right signals. That is the whole premise of this practice: the disruptions capable of stopping an organisation are political in origin, anticipable in advance, and irreversible after the fact. Preparation has almost unlimited value before the event and exactly none after it.

Where the real exposure sits

Risk registers are built around what has already happened to someone.
The exposures that end organisations are the ones no one has written down, because they cross the internal boundaries that make an organisation governable.

• Sanctions and export controls across the full chain, not the first tier. Ownership structures shift; the counterparty screened last quarter may no longer be the counterparty. Exposure is discovered at the moment of payment, which is the worst possible moment.

• Single points of political failure. Every organisation operating abroad depends on a small number of permissions — a licence, a
  concession, an authorisation, an approval — whose withdrawal stops activity in days. Almost none has mapped them, priced them, or built an alternative.

• Institutional fragility that precedes legal change. Judicial capture, contested succession, an enforcement authority that becomes political. The legal text is unchanged; the operating reality is not.

• Corridors and chokepoints. Physical and energy flows depend on routes whose interruption is a foreign policy instrument, not a
  logistics variable.

• Personnel. Evacuation, detention, duty of care, continuity of command when leadership is unreachable or personally exposed in a
  foreign jurisdiction. This is where preparation is thinnest and where the consequences are personal.

• Cross-border propagation. A disruption in one jurisdiction reaching an operation that appeared unrelated, through a shared supplier, a shared bank, or a shared regulator.

• The governance gap. Who, by name, owns this exposure. In most organisations the honest answer is no one — and it emerges during the first crisis, not before it.

What we actually build

Four deliverables. Each defined by what it must be capable of doing under pressure, not by the document it produces.

Plans built to be used, not to be approved

A continuity plan is not a document. It is a set of decisions taken in advance, so that they do not have to be improvised by people who are frightened, under-informed and short of time.

We work backwards from the decision. Which functions must survive, in what order, and to what minimum level. Which thresholds trigger which response, defined numerically and not by judgement. Who decides when the person who normally decides is unreachable. What is pre-authorised — which payments, which evacuations, which public statements — so that authority does not have to be sought in the middle of the event. What the organisation stops doing, deliberately, in order to protect what matters.

The test of a plan is not whether it is comprehensive. It is whether a director can open it at three in the morning, in a second language, and know what to do in the next ninety minutes.

Alternative markets,

suppliers and routes, identified before they are needed

Continuity fails in procurement long before it fails in operations. An alternative supplier identified during a crisis is not an alternative; it
is a hope.

We map substitution capacity in advance: which markets can absorb displaced volume, which suppliers can be qualified in weeks rather than quarters, which routes and corridors remain available under which political scenarios, which jurisdictions offer legal and banking continuity when the primary one closes. Each alternative is assessed for its own political exposure — a second source inside the same sanctions perimeter is not a second source. Where substitution is impossible, we say so plainly, because a known dependency that is managed is safer than one that is assumed away.

Training that produces decision-makers, not attendees

Executive committees are not trained by being briefed. They are trained by deciding, badly, in a controlled environment, and seeing the
consequence.

Our exercises give leadership incomplete information, contradictory advice, a compressed clock and a scenario drawn from their own
jurisdictions and sector. Facts change mid-exercise, as they do in reality. Regulators, journalists, employees and counterparties all
demand a position simultaneously. The board discovers, in a room where it costs nothing, which of its assumptions do not survive contact with an actual event — and which of its people perform differently under pressure than their job title predicts.

Crisis communication is trained as part of the same exercise, never separately. What the organisation says, in the first hour, to
authorities, to employees, to the market and to the press, determines the legal and political conditions under which everything that follows is judged. Saying nothing is also a decision, and it is sometimes the right one; it must be taken deliberately.

Testing and audit against a moving environment

Plans are tested against scenarios the organisation genuinely faces, not against a standard catalogue: a sanctions-driven break in the supply chain, a cross-border food-safety alert, a sudden regulatory shutdown in an export market, an industrial incident amplified by a political campaign, the loss of an operating licence in a country of concentration.

Plans are then revised when the environment moves — an election, a designation, a change of enforcement posture — not on a fixed annual cycle that has no relationship to the risk.

The compliance baseline — Alliance with Worldlex

Regulation does not move on its own. It is driven by sanctions regimes, electoral cycles and institutional instability that precede the legal text by months or years. A continuity plan built on today's legal position is built on a baseline that is already moving.

Through our alliance with Worldlex (Legal Compliance International Consulting, S.L.), a UN Global Compact participant, our continuity work sits on WorldlexNet — a legal-surveillance platform tracking obligations country by country across environmental law, occupational health and safety, quality, food safety and business continuity, backed by more than 25 years of practice.

Real-time compliance feeds forward-looking political-risk analysis; JPA's early warning feeds back into the compliance perimeter. One
intelligence chain, not two services placed side by side.

Confidential Briefing

For boards and executive committees whose continuity exposure originates in political and regulatory decisions rather than physical events, we provide confidential, decision-focused briefings tailored to jurisdiction
and sector.

→ Request a confidential discussion

Board Accountability Is No Longer Discretionary

What was until recently a matter of prudence is now a governed obligation with a named owner and a reporting standard.

• CER Directive (EU) 2022/2557 — an all-hazards resilience framework across eleven essential sectors. Member States designate critical entities from 17 July 2026; designated entities then face risk assessment and resilience obligations within defined deadlines.

• DORA — Regulation (EU) 2022/2554 — applicable since 17 January 2025 Continuity and recovery frameworks must be documented, approved by the management body and tested at least annually, across more than twenty categories of financial entity.

• NIS2 — Directive (EU) 2022/2555 — the cyber counterpart to CER, designed to be implemented jointly with it.

• ISO 22301 — the management-system architecture. Necessary, and on its own insufficient against disruption of political origin.

The regulatory direction is unambiguous and it is the direction this firm has argued for years: a formal owner, a documented methodology, and a reporting standard at board level. The obligation has now caught up with the argument.

Experience That Is Operational, Not Theoretical

Our analysts have combined field experience across more than one hundred countries, including high-risk and conflict-affected environments, applying human intelligence tradecraft alongside structured analytical methodology. Contingency planning, emergency response and crisis decision-making have been exercised under real conditions and across multiple jurisdictions simultaneously.

That distinction matters more than any credential. A plan written by someone who has only ever written plans is a hypothesis. A plan written by someone who has watched an organisation try to execute one, at speed, with the wrong information and the wrong people in the room, is an instrument.

JPA advises governments, financial institutions, energy companies and multinational organisations on decisions that cannot be
reversed.

We work with a limited number of boards per sector and region.

When Boards Call Us

Operations in jurisdictions where political change can halt activity within weeks

• Exposure to sanctions regimes, export controls or politically directed regulatory action

• Designation, or anticipated designation, as a critical entity under CER

• A continuity plan that exists and has never been executed under pressure

• Concentration in a single market, supplier, route or regulator, with no
  qualified alternative

• A board that cannot name the individual who owns geopolitical continuity risk

• The aftermath of a crisis the organisation survived without understanding why