Business Continuity During an Office Move: Risk Register, Fallbacks and Decision Owners

Direct answer

Protect minimum service before trying to protect a perfect reopening

An office-move business-continuity plan identifies the services that cannot be unavailable beyond an approved tolerance, the people and assets required to sustain them, the relocation events that could interrupt them, the fallback that will operate, the person authorized to activate it and the evidence needed to return to normal. It is not simply a risk list or an IT recovery document. Build it before the move sequence is fixed so continuity requirements can influence dates, locations, vendors, staffing and budget.

Start with a business impact analysis, not a list of things that might go wrong. For each service, define its customers, minimum acceptable output, maximum tolerable interruption, data or transaction tolerance, dependencies, legal or contractual constraints and recovery priority. The Canadian Centre for Cyber Security explains that continuity focuses on recovering critical operations, while incident response addresses a particular incident and disaster recovery restores broader operations. An office relocation can require all three plans, but they should not be confused.

Turn each material exposure into a decision-ready register row: cause, affected service, leading indicator, preventive control, trigger, immediate action, fallback, decision owner, communications owner, resources, review time and evidence for closure. Name a backup owner with authority. “IT to monitor” is not sufficient; “technology lead activates alternate connectivity after the agreed test fails and reports service status by 06:30 America/Toronto” can be executed under pressure.

Connect the continuity plan to the Ottawa office moving checklist, vendor statements of work, property access plan, technical runbooks and audience communications. ProMove Ottawa can coordinate the physical moving work details and report logistics exceptions. The customer retains operational priorities, data protection, employee decisions, legal obligations and authority to accept residual risk. Qualified advisers should review sector-specific, privacy, employment, safety and regulatory duties.

• Define minimum service, not an unrealistic promise of full normal operations.
• Assign a primary and backup activation owner for every critical fallback.
• State measurable triggers, review times and evidence for recovery.
• Keep continuity, incident response and disaster recovery connected but distinct.

Planning boundary

Define the relocation disruption window from preparation through stabilization

The exposure begins before the truck arrives. Packing may remove records from normal access, construction may alter routes, employee attention may shift, vendors may stage equipment and systems may enter change freezes. It continues after reopening while support demand, asset reconciliation, old-site obligations and latent technology issues remain elevated. Define start and end gates for the continuity window so temporary controls are activated and retired deliberately rather than assumed to exist only during loading.

Map both premises and every temporary operating location. Include remote-work arrangements, swing space, storage, data centres, cloud services, supplier sites, courier routes and any alternate reception point. An Ottawa organization may also depend on staff or facilities in Gatineau, other Ontario communities or national support centres. Each location can have different access, privacy, employment, weather and time-zone implications. Record which owner verifies each arrangement and which authority provides live instructions.

Set plan work details by service and consequence, not by organizational chart. A small team can provide a critical customer or safety function, while a large department may tolerate several days of reduced internal work. Include commitments made to clients, funders, patients, students, regulators, employees and suppliers as applicable. Do not claim a legal maximum outage without authoritative review; the business owner and advisers should identify the actual obligation and evidence.

Document exclusions and interfaces. The continuity plan may reference, but should not duplicate, fire safety, cyber incident response, building evacuation, occupational health and safety, emergency communications, privacy breach, crisis management and insurance procedures. The Canadian Centre for Occupational Health and Safety notes that emergency requirements vary by jurisdiction and workplace. Use the correct plan owner when a move disruption becomes a safety, cyber, privacy or broader emergency.

Business impact

Rank services by harm, time and minimum viable output

Interview service owners using concrete time bands: what happens after two hours, one business day, three days and one week? Examine safety, legal, contractual, financial, privacy, customer, employee and reputational effects without assigning every service the highest rating. Ask which deadlines cluster around the move, such as payroll, court filings, patient appointments, grant reporting, billing or month-end. The analysis should identify when a tolerable inconvenience becomes material harm.

Define the minimum viable output for each priority period. A customer-service team might require a staffed telephone queue and access to current cases, but not every analytics dashboard. A professional office may need secure access to specified records and appointment communications before its full meeting-room technology is restored. Write quantities, hours and channels where possible. Minimum service is a controlled temporary state, not an invitation to abandon quality, privacy or safety.

Identify resource ceilings and single points of failure. Record minimum trained staff by role, delegated authorities, required applications, devices, data, communications, building access, power, connectivity, suppliers and physical records. Note whether a substitute exists and how quickly it can be activated. A laptop is not an alternate workplace if identity, secure connectivity, phone routing, privacy, ergonomic needs or essential files have not been tested there.

Obtain service-owner approval and compare priorities across the organization. Individual teams may rank their own work as critical, but leadership must resolve resource conflicts before a disruption. The office move committee roles article provides a governance structure for those decisions. Preserve assumptions, review dates and evidence so a future reviewer can understand why one service receives the first network circuit, access window or recovery team.

• Evaluate harm at several outage durations rather than using one severity label.
• Write the minimum quantity, channel, hours and quality for each service.
• Map the people, authority, systems, data, premises and suppliers required.
• Resolve cross-department priority conflicts before move week.

Recovery objectives

Use tolerances that operations and technology interpret the same way

Maximum tolerable downtime is the longest interruption the organization accepts before harm becomes unacceptable. A recovery time objective is the target time for restoring a defined service level. A recovery point objective expresses the acceptable amount of data loss measured in time. The Canadian Centre for Cyber Security uses these concepts in its current IT-recovery guidance. For a relocation, pair technical measures with business-language outcomes and identify who approves each tolerance.

Avoid declaring zero downtime unless the architecture, staffing, vendors and tests support continuous service. A service can remain technically available while employees cannot authenticate, enter the building or answer customers. Conversely, a system can be offline while an approved manual process sustains minimum service. Record from pickup to placement recovery criteria from the user's perspective, then align networks, applications, phones, records and locations to that result.

Set a data reconciliation method for temporary processes. If staff record transactions offline, define the secure form, unique identifier, storage, approval, later entry order and duplicate check. Establish how errors are corrected and when the temporary record becomes the official record. Do not authorize insecure personal email, consumer file sharing or unapproved devices merely because the main system is unavailable. Privacy and security owners should approve every fallback handling method.

Connect recovery targets to supplier agreements and execution time. A telecom provider's response target may not equal restoration, and an equipment warranty may not cover weekend attendance. Confirm service windows, escalation contacts, prerequisites and exclusions in writing. If the business target is shorter than the supplier can support, fund an alternate, change the move window or obtain leadership acceptance of the gap; do not hide it in a footnote.

Risk register

Write risks as observable scenarios with executable responses

Describe a risk as a cause leading to an event and consequence: because destination access approval may be delayed, the crew could miss its booked freight-elevator window, causing critical equipment to remain at origin beyond the technical cutover. This is more useful than “elevator risk.” Add affected services, probability rationale, impact bands, control owner and evidence. Keep threats, current issues, assumptions and decisions distinct so the register does not become a mixed list that no one can prioritize.

Add leading indicators and activation triggers. Indicators might include an overdue occupancy document, failed circuit test, unconfirmed key list, severe-weather alert, construction notice, missed packing milestone or absent specialist. A trigger is the point at which the owner must act: a test failure by a stated time, an official closure affecting the route, or a staffing count below minimum. Triggers should use current authoritative information and actual site conditions rather than intuition alone.

For every high-impact row, write prevention, immediate containment, fallback, review interval and recovery evidence. Prevention might be a second circuit; containment might stop further disconnection; fallback might route staff to an alternate workspace; recovery evidence might be successful transactions by representative users. Assign separate owners when the person containing the event should not decide whether residual risk is acceptable. Record cost and affected commitments.

Review the register at milestones and when facts change. A risk can be closed only when its exposure is removed or transferred into normal control with evidence. Lowering a rating without completing an action creates reporting comfort, not resilience. Track accepted risk with the authorized approver, rationale, expiry and conditions. If a fallback has never been tested, record that uncertainty rather than treating the existence of a document as proof it will work.

• Use cause, event and consequence in each material risk statement.
• Define leading indicators and objective activation triggers.
• Pair prevention and containment with a tested fallback and closure evidence.
• Record accepted residual exposure with an owner and expiry.

Decision rights

Pre-authorize choices that cannot wait for a full meeting

Create a decision-rights table for postponement, partial move, service reduction, alternate workspace, additional spending, vendor substitution, extended outage, data handling, employee instruction and public communication. Name the primary, backup and required advisers. State financial and time thresholds where helpful. An escalation path is useful only if the decision-maker can be reached, access the evidence and act at the hour the trigger may occur.

Distinguish stop-work authority from overall relocation authority. Workplace parties may have rights and duties under applicable health-and-safety law, and qualified safety leaders should define the process. A technical lead may stop a destructive disconnect; security may deny unauthorized access; the sponsor may decide whether business operations shift to fallback. Do not force every concern through one person, and do not represent project governance as changing statutory rights or responsibilities.

Pre-approve bounded contingency use. Define how much overtime, temporary connectivity, courier service, rental equipment, alternate workspace or storage can be authorized at each level. Require the requester to identify the trigger, service protected, time gained and next decision point. This makes rapid spending accountable and prevents the sponsor from receiving an urgent request with no explanation of what the money actually preserves.

Keep a time-stamped decision log during the disruption. Record facts available, options, advice, decision, owner, conditions, communications and review time. Avoid rewriting history after the outcome is known. A concise contemporaneous record supports handoffs and lessons, while restricted legal, privacy or employee information remains in its proper file. The log should state when a temporary choice expires so it does not become an unmanaged permanent practice.

Move architecture

Design the physical sequence around service dependencies

Choose phased, parallel or single-cutover movement based on the impact analysis. A phased move can preserve service by keeping part of a team at origin, but it may duplicate equipment, split supervision and complicate records. A concentrated weekend can shorten the transition but creates a narrow recovery window. The phased-versus-weekend decision matrix helps compare approaches; continuity owners should test each against real service and dependency maps.

Build move waves from dependency order rather than department convenience. Infrastructure, destination staging and support functions may need to move or be commissioned before user teams. Critical equipment should not leave a working site until destination prerequisites and fallback are verified. Conversely, leaving every shared asset until last can prevent destination testing. Use item, room and service identifiers so logistics status can be reconciled with operational status.

Protect rollback options explicitly. Identify the last point at which the organization can remain at or return to origin, which leases and services support that option, what assets must stay functional and who can authorize rollback. A nominal old office is not a fallback after network, security, furniture and key systems are removed. If rollback becomes impossible at a gateway, record the new exposure and strengthen the forward fallback.

Control changes after the sequence is baselined. Adding departments, moving the date, changing a vendor or transferring more records can alter capacity and recovery targets. Require an impact check across premises, technology, staffing, privacy, budget and communications. Update labels and runbooks before execution. A verbal last-minute request should never place an unassessed server, confidential archive or specialty asset onto the truck.

Premises continuity

Prepare for delayed access, building failure and route constraints

Treat possession, occupancy, landlord approval, loading access and employee entry as separate confirmations. A destination can be legally possessed while a dock, freight elevator, security system or work area remains unavailable. Facilities should define evidence for each state and the time by which it must be received. The commercial building access survey organizes measurements, bookings, restrictions and contacts for both premises.

Create fallbacks for destination denial or partial availability. Options may include keeping selected origin functions active, approved remote work, alternate premises, rescheduling a wave, secure storage or commissioning only a safe zone. Each option needs capacity, access, technology, privacy, insurance, employee and supplier review. Do not describe a coffee shop, hotel lobby or employee home as an acceptable work site merely because it has internet access.

Verify life-safety and emergency arrangements at temporary and new locations through the responsible property and employer processes. CCOHS says an emergency plan should identify possible emergencies, command roles, communications, evacuation and resources, with requirements varying by jurisdiction and workplace. The relocation continuity plan should reference the current site emergency information and keep individualized employee arrangements in the authorized confidential workflow.

Plan origin resilience until handback. Maintain appropriate power, heating or cooling, access, security, washrooms, emergency routes and technology for the people or assets that remain. Identify what stops when each service is disconnected. A staged move is unsafe and ineffective if the origin is treated as closed while employees are still working there or confidential material remains under weak control.

• Verify possession, occupancy, loading and employee access as distinct gates.
• Size temporary space for actual minimum-service people and equipment.
• Confirm emergency and accessibility arrangements at every active location.
• Maintain origin controls until people, assets and duties are formally cleared.

Technology continuity

Prove recoverability before disconnecting a working environment

Inventory services rather than only hardware. Map identity, internet, wide-area network, telephony, cloud services, local applications, printers, specialized devices, security systems, data feeds, integrations, support tools and vendor portals to business owners. The office IT relocation guide can hold the detailed sequence. Continuity reporting should show which minimum services each component supports and the fallback when it is unavailable.

Test backups for integrity and restoration, not merely successful job status. The Canadian Centre for Cyber Security recommends trusted backups, role-based training, monitoring, audit-log review, phishing-resistant multi-factor authentication where possible and limited administrator accounts as resilience measures. Apply current organizational standards and specialist advice. An office move should not relax privileged access, logging or change control simply because technicians are working overnight.

Pre-stage and test destination connectivity with representative users and workflows. Verify primary and alternate links, power, network segmentation, authentication, name resolution, remote access, voice routing, priority applications and monitoring. Record test data, person, time and environment. A speed test alone does not prove that a protected business application, inbound telephone queue or secure printing path works from the new office.

Define cutover checkpoints and abort criteria. Before each destructive action, confirm the last backup, destination prerequisite, specialist availability, rollback method and business approval. After change, test in an ordered sequence and stop if a failure threatens the recovery window. Record known defects and temporary workarounds securely. Do not announce success until business owners complete representative transactions, not only infrastructure checks.

Information custody

Protect personal and confidential information through every handoff

Classify paper records, devices, removable media, backup equipment, keys, credentials and other information-bearing assets before packing. Apply approved retention and disposal rules rather than moving obsolete records automatically. The Office of the Privacy Commissioner of Canada notes that safeguards should reflect sensitivity and may include physical, organizational and technological measures. The organization should decide which items require restricted handlers, encryption, sealed containers, secure destruction or specialist transport.

Use an itemized chain of custody that records identifiers, origin, destination, authorized handler, handoff time, control number, exception and recipient. External labels should not reveal diagnoses, employee matters, client identity or file contents. Keep the detailed inventory in a restricted system available to authorized decision-makers during the move. If a container is missing, the identifier should support a search without broadcasting the sensitive contents to the whole project team.

Prepare an incident playbook for lost records, misplaced devices, broken seals, misdirected deliveries and unauthorized access. Preserve facts, contain further exposure where safe, notify the privacy or security owner and follow the organization's breach-assessment procedure. Do not promise that an event is harmless, contact affected individuals independently or wipe equipment without authorization. The confidential records moving guide should contain the detailed custody controls.

Reconcile assets at destination and old-site closeout. Confirm received identifiers, inspect controls, document exceptions and transfer custody to the business owner. Retain or dispose of move records according to approved schedules. A complete carton count does not prove that all files belong in the correct restricted room or that access permissions were updated; perform both physical and logical acceptance.

Workforce continuity

Staff the fallback without creating a second unmanaged workplace

Identify the minimum people by capability, not name alone. Record required qualifications, system access, delegated authority, language, schedule and backup coverage for each priority service. Consider fatigue, overnight work, travel, caregiving, accessibility and normal absences. Avoid relying on one employee to supervise movers, test systems, approve spending and answer clients. Split operational and recovery roles so minimum service can continue while specialists resolve the disruption.

Define temporary work arrangements through HR, technology, safety, privacy and management processes. Confirm approved location, equipment, secure connectivity, records access, hours, supervision, communication, ergonomics and reimbursement questions as applicable. Employees should not be expected to improvise with personal devices, unsafe furniture or public networks. If a temporary arrangement cannot support a role safely or securely, design another fallback rather than shifting the risk to the employee.

Review individualized workplace emergency response information and accommodation needs for the new or temporary location through the authorized confidential channel. Ontario guidance addresses providing and reviewing individualized information when an employee moves to another location in the organization. Do not place names or details in the general continuity plan. Instead, record that HR or the accessibility owner has confirmed the required arrangement and escalation path.

Prepare staffing call trees and status methods that do not depend on one failed system. Maintain current business contact methods under privacy controls and test the notification process. Messages should state whether the person reports, works remotely, waits for an update or contacts a manager. Avoid asking employees to travel into uncertain conditions merely to discover whether the building is open. Publish a next-update time and authoritative sender.

• Identify minimum capabilities, authority and backup coverage for each service.
• Approve temporary workplaces across HR, safety, privacy and technology controls.
• Keep individual accommodation details outside the shared continuity plan.
• Test a staff status method that survives ordinary email or phone disruption.

Supplier continuity

Treat building and vendor promises as dependencies that need proof

List suppliers whose failure can stop minimum service: property management, movers, telecom, cloud and software providers, security, records storage, couriers, furniture installers, utilities, cleaners, waste services and specialized technicians. For each, record legal name, contracted output, prerequisites, service window, escalation contacts, subcontractors, evidence, fallback and internal owner. A salesperson's reassurance is not an operational acceptance test.

Confirm availability for the actual cutover period, including evenings, weekends and holidays. Identify whether response means acknowledgement, remote investigation or on-site restoration. Verify building contacts at both sites and obtain after-hours procedures. If one specialist supports several simultaneous tasks, sequence them or contract backup. Add lead times for replacement equipment and approvals rather than assuming local stock will exist during an incident.

Review contracts for change control, cancellation, delay, limits, security, privacy, insurance, custody and notification as appropriate with qualified advisers. Procurement should understand which fallback costs are pre-authorized and what evidence supports a claim. Do not let a vendor's limitation become a hidden operational risk; show the gap to the service owner and sponsor before the move date is locked.

Exercise vendor communications before execution. Call the operational number, confirm that the named contract or site can be found and test escalation without creating a false emergency. Share only the minimum information each vendor needs. Maintain an offline or independently accessible contact copy for critical suppliers, protected against unauthorized access. Update the list after personnel or schedule changes.

External communications

Pre-write status messages without pre-writing unverified facts

Prepare separate message shells for normal reopening, delayed opening, partial service, alternate location, channel outage and recovery. Each shell should prompt the owner to fill the confirmed status, audience action, available service, unavailable service, contact and next update. It should not contain a guessed cause, blame or recovery promise. The relocation announcement templates provide the broader audience sequence and address-change controls.

Define who detects, who confirms and who publishes. A technician may identify a failed link, the technology lead may assess work details, the continuity owner may select a fallback and communications may issue the approved message. Combining those steps in an unverified chat post can create inconsistent customer promises. Set expedited approval for urgent notices and identify a backup sender with access to channels outside the affected system.

Protect privacy and security while explaining service. Do not publish employee locations, door codes, network details, lost-record contents or an unconfirmed breach. State operational facts and direct affected individuals through authorized channels. The OPC's safeguards guidance supports sensitivity-based protection; sector-specific notification decisions belong to privacy, legal and regulatory owners. The general status page should not become an incident evidence repository.

Use accessibility and language planning appropriate to the organization and audience. Provide essential information in text, keep links meaningful and offer supports or alternate formats where required. Test website banners, phone messages, appointment systems and social channels before the move. If the main website cannot be updated during an outage, identify a controlled alternate channel and teach customers where the authoritative update will appear.

Scenario one

If destination access fails, preserve control of people and freight

Set access triggers before dispatch: required occupancy or property confirmation missing, dock or elevator booking revoked, security credentials failing, route unsafe or essential area not released. The facilities lead validates the event with the property contact and informs the relocation lead. Do not send employees or loaded vehicles to wait indefinitely. The decision owner compares delay, partial access, alternate storage, retained origin service and rescheduling against the service tolerance.

If freight is already moving, maintain custody and legal parking. The mover identifies safe logistics options within its contract and operating rules; the customer decides where authorized assets may go. Sensitive records and technology may have stricter destinations than furniture. Record vehicle or container status, responsible contact, expected decision time and security controls. Never direct a truck to occupy an Ottawa curb illegally while the committee debates access.

Keep employee instructions separate from vehicle instructions. Staff should receive a clear report, remote-work or standby message from the authorized sender. Only required recovery staff should approach the destination, and their access must be confirmed. Update clients or visitors if service or appointments change. Avoid inviting a large team into a lobby that cannot support safe, private or productive work.

Review at defined intervals. If access becomes available, rerun prerequisites rather than resuming at the interrupted step automatically. Check elevators, security, routes, work areas and downstream vendor availability. If the delay exceeds the approved threshold, activate the longer-duration fallback and update the budget and risk acceptance. Preserve evidence for property, vendor and insurance discussions without making public accusations.

Scenario two

If technology recovery fails, sustain priority transactions securely

Use a technical trigger based on an from pickup to placement service test, not equipment lights. If representative users cannot authenticate, reach the priority application, process the required transaction or receive customer communications by the step, the technology lead declares the service unavailable and starts the approved recovery path. Stop unrelated changes that could obscure cause. Preserve logs, configuration evidence and the last known good state under the technical runbook.

Activate the minimum-service method for affected work. That may route phones, use a tested alternate connection, move authorized staff to another site or use a controlled manual record. The business owner determines which transactions can proceed and which must pause. Privacy, security and reconciliation controls remain active. Do not encourage employees to send sensitive information through personal accounts or copy it to unapproved devices to meet a reopening promise.

Follow the organization's incident response when a cyber event is suspected. The Canadian Centre for Cyber Security distinguishes incident response from continuity and recovery; an unexplained outage should not be treated automatically as routine relocation trouble. Notify the security owner, limit access and communications, and preserve evidence. The continuity team manages business service while specialists investigate the event and decide technical containment.

Restore in priority order and require business acceptance. Infrastructure checks can show that a circuit or server is active, but service owners must complete representative workflows and confirm data currency. Reconcile manual transactions, monitor errors and retain enhanced support until stable. Close the fallback only after the authorized owner records recovery evidence, remaining defects and the next monitoring review.

• Trigger fallback from an from pickup to placement service test with a stated deadline.
• Use only pre-approved secure channels and temporary transaction records.
• Escalate suspected cyber events through incident response immediately.
• Require business-user acceptance and data reconciliation before closure.

Scenario three

If information custody breaks, contain before continuing the move

A missing device, unaccounted file container, broken seal or delivery to the wrong zone is an incident until reconciled. Stop the affected custody stream, preserve the last verified handoff and notify the security or privacy owner. Search in a controlled sequence using asset identifiers, authorized handlers, origin staging, vehicle, destination staging and exception logs. Avoid broadcasting sensitive descriptions over open radio or group chat.

Protect remaining material. Isolate related containers if instructed, restrict access, retain video or access records through authorized channels and prevent disposal of packaging or labels. Do not alter a device, reset credentials or contact external individuals without the incident owner's direction. The organization should assess whether personal information, confidential business data, regulated records or security assets are involved and activate the correct response process.

Continuity and incident management then run together. The business owner decides whether minimum service can continue without the item and activates an approved alternate record or system if available. Communications prepares internal or external notices only after the authorized assessment. A public claim that nothing sensitive was involved can create further risk when the contents or access status are still being verified.

After reconciliation, document where the control failed and whether information may have been accessed, copied or altered. Replace compromised seals or credentials, validate data and update the chain-of-custody design. Do not close the risk merely because the item was found. Privacy, legal, security and records owners determine follow-up, retention and notification under the applicable plan.

Scenario four

If weather or transport conditions deteriorate, separate safety from schedule pressure

Assign one owner to review official weather alerts and local conditions, and another to confirm route and site readiness with the mover and properties. Environment, road, curb, ramp, dock and pedestrian conditions can differ across Ottawa. The City traffic map and roadwork pages provide current reported information but do not guarantee completeness, travel time, parking or vehicle suitability. Dispatch should validate the actual route and assigned commercial vehicle.

Define decision triggers based on conditions and qualified safety judgment, not a generic snowfall amount. Examples include unsafe access surfaces, official road closure affecting the route, unavailable plowing, high winds affecting handling, lightning, extreme temperature or visibility that prevents safe work. CCOHS emergency guidance emphasizes preplanning because time pressure and scarce resources can impair judgment. The authorized workplace and carrier leaders decide whether work proceeds, pauses or changes.

Fallbacks can shift the start time, change waves, protect exposed equipment, add safe staffing, use secure storage or extend origin operations. Each option affects building bookings, employee travel, technology support, customer commitments and cost. Update all workstreams through the relocation lead. Do not move critical technology or confidential records into an uncontrolled holding area simply to keep the truck schedule intact.

Communicate the decision before people travel when possible. State whether staff report, work remotely, await another update or contact a manager, and give the next review time. Vendors receive revised access and sequence details. After conditions improve, reassess surfaces, routes, bookings and specialist availability; do not assume the original plan resumes unchanged after a multi-hour pause.

• Use official alerts plus site- and route-specific inspection evidence.
• Give qualified safety and carrier leaders clear pause authority.
• Recalculate building, technology, staffing and customer dependencies after delay.
• Issue employee instructions before travel and name the next review time.

Exercises

Test decisions, communications and manual work before testing boxes

Run a tabletop exercise with the sponsor, relocation lead and workstream owners. Present a timed scenario such as destination access denied six hours before loading, primary connectivity unavailable at the recovery step or a sensitive container missing. Ask participants to identify the trigger, decision-maker, evidence, fallback, communications and next review. Capture gaps without helping participants find every answer; difficulty during the exercise reveals where the real plan depends on memory.

Test technical restoration and alternate operations separately. Restore representative data, route communications, authenticate users, process sample transactions and reconcile temporary records. Use safe test data and controlled environments. The Cyber Centre's recovery guidance recommends scenario-based assessment of threats, vulnerabilities, participants and recovery effort. Record actual times and failures, then compare them with the approved service tolerances.

Exercise staff notification and supplier escalation. Send a clearly labelled test through primary and alternate channels, confirm receipt sampling and verify that managers know how to report status. Call vendor operational contacts and confirm the site and contract can be located. Do not create a false emergency or expose personal contact lists. Update unavailable contacts and delegated authority before the next test.

Inspect physical fallbacks. Visit alternate space, confirm capacity, connectivity, privacy, accessibility, power, security and entry. Open the continuity kit and verify that instructions, contact lists, equipment and supplies are current. A fallback that exists only in a document may fail because the room has been repurposed, a pass expired or an application no longer supports the device. Retest after material change.

Readiness gate

Make the go decision from exceptions, not percentage complete

Define mandatory continuity evidence for the move gate: approved service priorities, current owner and backup list, tested contact channels, accepted premises conditions, verified backups, destination technical tests, controlled records inventory, staffing coverage, vendor confirmation, fallback capacity, audience message shells and funded contingency. Completion percentages conceal which item is missing. One failed critical prerequisite can matter more than fifty completed low-impact tasks.

Present exceptions in a common format: condition, affected service, time to harm, current control, fallback, test result, cost, decision required and recommendation. The correct authority chooses go, conditional go, phased go, delay or cancel. Conditional approval must state the owner, trigger, review time and expiry. Avoid converting every amber item to green during the meeting merely to support the desired date.

Reconfirm the gate after a material change. New construction delay, staff absence, inventory expansion, vendor substitution, cyber incident, severe weather or building restriction can invalidate earlier evidence. The relocation lead identifies affected prerequisites and obtains renewed acceptance. Do not assume a signed decision remains valid when its factual basis changes.

Record the decision and communicate only the implications each audience needs. Technical teams receive the runbook and constraints; employees receive reporting instructions; clients receive service status; vendors receive schedule and access. Keep restricted risk details with authorized participants. If the outcome is delay, issue the next decision time and preserve fallbacks rather than allowing the program to drift without a new gate.

• Require named evidence for every critical continuity prerequisite.
• Present exceptions by service effect, fallback and decision deadline.
• Renew approval after any material assumption or dependency changes.
• Communicate audience-specific implications from the recorded decision.

Move control

Operate one time-stamped picture of logistics and service status

Establish a control function with one relocation lead per shift and clear workstream contacts. Use an integrated event log showing planned milestones, actual times, asset or wave status, premises conditions, technical checkpoints, incidents, decisions and next actions. The control team coordinates; it does not bypass specialist authority. Keep sensitive incident details in restricted systems and reference only the status required for coordination.

Define check-in points for vendor arrival, site opening, staging completion, critical asset loading, destination receipt, technical start, business acceptance and shift handover. Missing a check-in triggers investigation, not an automatic assumption of delay. Verify through the responsible contact and record the result. Avoid flooding the main channel with routine photographs or conversation that makes an urgent decision hard to find.

Use a concise incident format: time, reporter, location, affected service or asset, immediate safety or security action, owner, decision deadline and next update. Assign severity based on consequences, not frustration. A missing decorative item and a missing encrypted backup device require different routes even if both are inventory exceptions. Teach every participant how to report and whom to call if the digital channel fails.

At shift change, conduct an affirmative handover. Review open risks, active fallbacks, restricted issues by appropriate route, next irreversible step, supplier status and decision authority. The incoming lead confirms access to records and contacts. A long overnight cutover should not rely on the outgoing coordinator remaining awake to answer questions; fatigue is itself a continuity risk.

Reopening

Commission priority services before inviting normal demand

Reopen in layers. Facilities accepts safe access and essential building services; security accepts credentials and controlled areas; technology accepts infrastructure; business owners execute representative workflows; HR confirms workforce instructions and support; communications issues status after the authorized continuity owner reviews the combined evidence. A visually finished reception is not proof that payroll, customer calls or confidential records are available.

Use a test script for each priority service with user, time, input, expected output, actual result, data currency and exception. Include inbound and outbound communication, not only internal access. If a fallback remains active, tell users which process applies and how temporary transactions will be reconciled. Mark known limitations prominently enough to prevent ordinary staff from unknowingly using an incomplete process.

Control demand during partial reopening. Reschedule non-essential appointments, stagger teams, limit visitors or route work to alternate channels when capacity is below normal. State what is available rather than advertising full reopening prematurely. Monitor queue, error, response-time, security and employee-support indicators, and define when the next service level can be released.

Maintain enhanced support and incident logging for a defined stabilization period. Ordinary-seeming issues can reveal a systemic dependency, such as badges failing for one employee group or calls reaching an old queue. Triage safety and security first, then service-critical issues, then workstream blockers and routine defects. Publish update times so employees do not create parallel troubleshooting channels.

• Accept premises, security, technology and business workflows in sequence.
• Test real user outcomes and data currency for each priority service.
• Limit demand to the service capacity actually available.
• Keep enhanced support and issue classification through stabilization.

Recovery

Reconcile temporary operations before declaring normal service

Every fallback creates closure work. Enter and validate manual transactions, reconcile duplicate or missing records, recover temporary equipment, remove exceptional access, update callers and customers, restore normal approvals and confirm data retention. Assign each reconciliation to a business owner with a count and deadline. Do not shut a temporary process merely because the main application returns; ensure every transaction reaches the authoritative record.

Review outstanding inventory and custody exceptions. Confirm sensitive material, serial-numbered assets, keys, passes, seals and disposal records. Route damage or loss through contractual, insurance, privacy or security processes as applicable. Keep origin and destination evidence, but restrict personal or confidential information. A closed moving work order does not automatically close an information incident or property claim.

Deactivate temporary arrangements deliberately. Revoke alternate accounts and access, remove forwarding or routing rules at the correct time, return rented equipment, close temporary space and notify affected people. Verify that no customer channel still directs work into an unmonitored queue. Record the final normal-service acceptance by each priority owner and the remaining limitations transferred into operational management.

Compare actual outage, recovery and data-loss results with objectives. Explain variance and whether the target, architecture, staffing or test was unrealistic. Use measured evidence rather than judging success solely by the public opening time. A relocation can meet its schedule while creating days of hidden reconciliation, or miss an opening target while protecting critical service through an effective fallback.

Ottawa controls

Use live local information without mistaking it for authorization

Check the City of Ottawa traffic map, roadwork and street-closure information near execution. The City's map can show reported construction, incidents, events and closures, while its own information explains limits and changing conditions. Use it as one dated input. The mover remains responsible for validating the route and vehicle requirements, and building representatives confirm private loading access. A map screen does not reserve a street space or guarantee arrival time.

Review current on-street parking restrictions, posted signs and the Traffic and Parking By-law for the actual locations. A temporary consideration permit or other City program should not be described as automatic moving-truck eligibility. Obtain municipal confirmation for unusual arrangements and document it. The continuity register should include the fallback if legal loading space becomes unavailable, such as a different booked zone, time or asset sequence.

Plan for federal, downtown and security-sensitive environments without assuming all Ottawa offices follow the same process. Property screening, escort, loading, photography and contractor requirements can differ. Confirm both origin and destination rules in writing and brief vendors only on what they need. If a required clearance or escort is unavailable, the access scenario should activate before freight arrives.

Use exact America/Toronto timestamps for cutovers, supplier support, message releases and decision reviews. National vendors may operate in other zones, and daylight-saving transitions can create ambiguity in overnight work. Record date, zone and 24-hour time in critical instructions. Reconfirm statutory holidays, building schedules and municipal conditions rather than copying last year's move calendar.

Financial continuity

Keep payment, payroll and emergency purchasing available under control

Map financial processes that cannot wait for full office recovery: payroll, client receipts, supplier payments, purchasing approvals, banking, expense authorization, cash handling where applicable and access to supporting records. Define the minimum roles, signing authority, secure systems, deadlines and alternate procedure for each. A continuity plan should not weaken segregation of duties because one approver is supervising the move. Arrange delegated authority and independent review before the normal workplace becomes unavailable.

Create a controlled emergency-purchase method tied to the risk register. Identify who may approve temporary connectivity, alternate premises, equipment rental, secure courier work, overtime or storage, the amount allowed, evidence required and when the decision is reviewed. Keep payment credentials and banking information out of the move control log. The operational record can show authorization status and purchase reference while financial detail stays in the restricted finance system.

Protect invoices and remittances from address confusion. Confirm when receiving, billing, remittance and books-and-records addresses change, and tell vendors through an authenticated channel. Be alert to fraudulent change-of-banking instructions during a period when counterparties expect unusual messages. Verify sensitive payment changes using the organization's independent callback or approval procedure rather than replying to an email that appears to come from the project team.

Track the financial effect of every fallback: direct spend, lost or deferred revenue, employee time, penalties, customer remedies and later reconciliation. Do not double-count a forecast and final invoice, and distinguish avoided harm from speculative savings. Finance reports the evidence to the sponsor at each decision review. This helps leadership compare the cost of continuing a fallback with the exposure of waiting for normal service and improves future contingency budgeting.

• List time-critical finance processes, authorities and secure alternate methods.
• Pre-authorize bounded continuity spending with independent evidence.
• Authenticate address and payment changes through a second trusted channel.
• Measure fallback cost and business impact separately at each review.

Insurance and claims

Preserve evidence without treating insurance as the continuity strategy

Review relevant property, cyber, crime, business-interruption, equipment, liability and cargo arrangements with the organization's broker, insurer and advisers before the move. Ask what events, property, locations, transit, temporary storage, deductibles, limits, conditions and notice requirements apply. A policy or mover certificate does not guarantee payment for every interruption. Continuity planning must still reduce harm and restore service rather than waiting for an insurance decision.

Identify who gives notice and where policy information can be reached if the office systems are unavailable. Calendar the shortest plausible reporting requirement and preserve current policy, contract and contact copies securely outside the moving shipment. Do not admit liability, promise compensation, discard damaged material or arrange repairs that could affect inspection without authorized review. Emergency action should protect people and prevent further loss first while documenting what was reasonably possible.

Build an evidence package as events occur: time, location, weather or site conditions, custody, photographs, access logs, affected assets, service interruption, mitigation decisions, costs, vendor communications and recovery tests. Separate factual observation from opinion about cause. Restrict employee, client and security information and share it only through authorized channels. One evidence index can point to controlled records without copying every sensitive document into a general claim folder.

Keep claim administration from delaying recovery. The continuity owner proceeds with approved safe mitigation, finance tracks cost and the insurance or legal owner manages notice and evidence. Record when damaged equipment, cartons or records may be moved, inspected or disposed. After the event, reconcile any recovery with actual loss and contract rights. The goal is a coordinated response in which service restoration, evidence preservation and external claims support one another without being confused.

• Confirm policies, locations, transit conditions and notice channels before execution.
• Store essential insurance contacts outside the affected office environment.
• Record facts, mitigation, cost and custody while protecting sensitive details.
• Run service recovery and claim administration as coordinated workstreams.

Closeout

Convert relocation lessons into durable organizational resilience

Hold a structured review after service has stabilized and facts can be measured. Include business owners, facilities, IT, HR, privacy or security, communications, procurement and relevant suppliers. Compare triggers, decisions, recovery times, fallback capacity, costs, incidents, employee support and customer impact. Invite candid evidence, not a celebration-only narrative. Separate execution performance from assumptions that were already weak before move weekend.

For each lesson, assign an improvement to a permanent process: continuity plan, backup architecture, supplier contract, asset inventory, workplace access, privacy controls, employee communication, training or emergency procedure. Give it an owner and due date beyond the temporary committee. A lesson without a funded action is an observation. Track high-impact improvements through normal governance until evidence confirms completion.

Archive approved plans, logs, tests, decisions, contracts, acceptance evidence and incident references under the organization's retention and access rules. Remove duplicates and drafts containing outdated contact information. Restrict security, employee and personal information. The OPC emphasizes limiting retention and secure disposal; consult the organization's records schedule and legal requirements rather than keeping every move-weekend message indefinitely.

Update the enterprise continuity plan with changed premises, contacts, technology, suppliers, alternate work capacity and emergency arrangements. Schedule the next exercise and review date. A relocation is a rare opportunity to test resilience under controlled pressure. Preserve what worked, repair what failed and ensure the new office becomes part of an active continuity system rather than a one-time project binder.

• Measure actual interruption, recovery, errors, costs and fallback use.
• Assign each lesson to a permanent control owner and completion date.
• Archive evidence under privacy, security and retention requirements.
• Exercise the updated continuity plan after the new environment stabilizes.