Bound the Service and Continuity Decision Authority

In business continuity design, the decision unit is a service or product delivered to an identifiable beneficiary, not a list of departments owned by the program manager. An appointment service starts when an eligible request is received and ends with a confirmed slot that both the customer and the operating team can act upon. A website, call center, identity service, scheduling staff and messaging supplier may support that outcome. Mapping those dependencies does not transfer operational ownership of all resources to the continuity team. It does mean that a plan cannot claim to restore booking while a resource essential to valid confirmation remains unavailable. A scope charter therefore names the indispensable output, users, channels and operating period before defining what the organization can actually decide. It records what lies outside its authority, such as commanding public emergency response, without erasing the service's dependence on events outside that authority.

Draw the boundary in three layers. First is the service commitment for which the organization is accountable: an accurate appointment, an authorized field dispatch, or a documented settlement. Second are activities that make that commitment possible: verifying identity, allocating a worker, keeping a transaction record and informing the beneficiary. Third are resources on which the activities depend: people, data, premises, connectivity, platforms and suppliers. Writing 'the network is out of scope because a supplier operates it' would hide an essential condition. A more accurate statement is that network operations belong to the supplier while the dependency, escalation route, evidence and fallback belong in the organization's continuity design. This does not invent a supplier commitment: establish service levels from the actual agreement, or record them as unknown pending verification.

A decision register distinguishes four roles, although one person may hold more than one. The service owner determines what temporary output is acceptable to beneficiaries and approves service priority. The resource owner supplies evidence of capability and limits. The response lead coordinates actions after activation. A designated risk authority accepts or rejects residual risk within a defined mandate. Authorship of the plan does not automatically give someone authority to shut a service down. For each consequential decision, record the trigger, evidence required, approving role, deadline and substitute escalation path. If an appointment portal can no longer issue valid confirmations, for example, the response lead may propose a telephone route only after its staff capacity is checked. The booking service owner approves the temporary service level, and the data owner verifies how offline records will later be reconciled. Merely having a telephone number does not establish an operable fallback.

Apply an exclusion test before freezing scope. Is an element outside the service commitment, or is it an external dependency indispensable to the commitment? Does another party own a decision while still owing the team evidence or a signal? Would excluding the element create an untestable recovery promise? The continuity program can properly exclude the management of a national network or a public emergency command decision from its authority. It cannot ignore how losing connectivity affects booking. Avoid the opposite error of declaring every organizational activity simultaneously critical: that prevents a bounded and testable service commitment. Connect each scoped service to its priority, critical inputs, decision authority, supplier assumptions, missing evidence and change review date. Later impact analysis and recovery strategies can then build on one shared service boundary instead of incompatible departmental plans.

Test the charter by tracing one request rather than merely reading its list of components. Identify what makes intake valid, where staff availability comes from, when a slot becomes a commitment, and how dispatch receives it. At each handoff ask which fallback has been demonstrated, who measured it and who may activate it. If the register is lost while phones still ring, the proven minimum may be only request intake followed by later confirmation. Name that temporary output honestly; it is different from an assured appointment. If the register returns but dispatch notices fail, booking may be valid while fulfillment remains constrained. State assumptions in falsifiable terms, such as four staff verifying 140 valid appointments over a full operating day with the register available. A short trial alone does not establish a daily rate. Include a stop rule for duplicate confirmations and an owner who records the decision and its time. The charter then becomes an exercise input, not a general organizational slogan.