Services · Disaster management and business continuity
Disaster management, business continuity and risk consulting
ARETION is a consulting firm specialising in disaster management, business continuity and risk management. We help hospitals, government agencies and companies prepare for emergencies, respond to them, recover from them and reduce their impact. Every solution is built from our advisers' experience of real events, as practising disaster managers, disaster-response leaders, business continuity consultants and risk managers, rather than from generic templates. We work in Saudi Arabia, the GCC and the UK, in Arabic and English.
What we do
Preparedness, response, recovery and mitigation
Preparedness
We assess hazards and vulnerabilities, set continuity requirements, write emergency and business continuity plans, and train the people who will carry them out. Each plan states who decides, who acts and which resources they use, so it holds up under pressure.
Response
We set up incident command structures, activation criteria, notification cascades and surge procedures, so that when an event begins, roles, decisions and lines of communication are already agreed and rehearsed.
Recovery
We plan how critical services and operations return, in the order the business impact analysis sets, with recovery teams, alternate sites and supplier arrangements defined in advance.
Mitigation
We find the risks that can be reduced before an event, such as single points of failure, dependence on one supplier and weaknesses in facilities or utilities, and keep them in a risk register with owners and treatment plans.
How an engagement runs
From impact analysis to after-action review
01
Business impact analysis
We work with the owner of each activity to map what it depends on: people, sites, technology and suppliers.
Business impact analysis (BIA)
A structured assessment of how the disruption of each activity would affect the organisation over time, used to decide the order in which activities are restored.
02
Recovery objectives
From the analysis, we agree four measures for each critical activity with its owner.
Recovery time objective (RTO)
The target time within which an activity or system must be resumed after a disruption.
Recovery point objective (RPO)
The point in time to which data must be restored, which sets how much data loss can be tolerated.
Maximum tolerable period of disruption (MTPD)
The time after which the impact of not resuming an activity becomes unacceptable to the organisation.
Minimum business continuity objective (MBCO)
The minimum level of service or output that must be maintained throughout a disruption.
03
Continuity and emergency plans
We write or revise the plans, aligned with ISO 22301 and with the requirements that apply to your sector.
Business continuity plan (BCP)
Documented procedures that guide an organisation to respond to a disruption, recover from it and resume its critical activities.
Emergency plan
The plan that sets how an organisation responds to an emergency: when it is activated, who leads, what each team does, and how communication and resources are handled.
04
Tabletop and full-scale exercises
We test the plans, moving from discussion to deployment as the team gains confidence.
Tabletop exercise
A discussion-based session in which leaders work through a scenario to test decisions, roles and plans without deploying any resources.
Full-scale exercise
A field exercise in which staff, equipment and partner agencies deploy as they would in a real event, under realistic time pressure.
05
After-action review
We close every exercise, and every real activation of a plan, with a structured review.
After-action review (AAR)
A structured review that compares what was planned with what actually happened and assigns each improvement to an owner and a deadline.
Experience
The experience behind the work
Our advisers bring practical experience of real events to every engagement, rather than plans that have never been tested. Their experience covers these types of event:
Mass gatherings
Epidemics and outbreaks
Earthquakes
Floods
Hospital surge and evacuation
Business interruption
CBRNE incidents (chemical, biological, radiological, nuclear and explosive)
They work as practising disaster managers, disaster-response leaders, business continuity consultants and risk managers, alongside emergency and disaster medicine physicians and CBRNE preparedness specialists.
We do not name specific events, deployments or clients on this page. Each adviser's own profile sets out their record.
Each adviser below is filed under Disaster Management Consulting on ARETION's advisers page. Open a profile to read their record, or book a private session online.
What does a business continuity consultation include?
A consultation starts with your context: critical services, current plans and known risks. The adviser then reviews or leads a business impact analysis, agrees recovery objectives (RTO, RPO, MTPD and MBCO), drafts or revises continuity and emergency plans, and designs exercises to test them. You receive written findings and a prioritised list of actions.
Is your business continuity work aligned with ISO 22301?
Yes. Our business continuity work is aligned with ISO 22301, the international standard for business continuity management systems. We follow its cycle of context, impact analysis, strategy, plans, exercising and review, and use its terms. ARETION does not issue certificates; an audit by an accredited body is a separate, optional step for the organisation.
How is a hospital disaster plan tested?
In stages. A tabletop exercise walks leaders through a scenario to test decisions and roles. Functional and full-scale exercises then move real staff, beds, equipment and partner agencies, for example in a simulated patient surge or evacuation. Each exercise ends with an after-action review, and the plan is updated before the next one.
What is the difference between crisis management and disaster management?
Disaster management deals with events that cause physical harm or overwhelm normal capacity, such as floods, earthquakes or mass-casualty incidents, across preparedness, response, recovery and mitigation. Crisis management deals with threats to an organisation's reputation, strategy or the trust of its stakeholders, and centres on leadership decisions and communication. Many events need both, under one command structure.
Can you plan medical cover for mass gatherings?
Yes. Advisers with mass-gathering experience assess attendance, duration, venue, climate and expected health risks, then plan medical posts, staffing, ambulance access, patient distribution to hospitals, communication and surge arrangements. The plan is tested in a tabletop exercise before the event and reviewed afterwards, so its lessons carry into the next gathering.
Where do you operate?
We work in Saudi Arabia, across the Gulf Cooperation Council states and in the United Kingdom, from offices in Riyadh and London. Work can be delivered on site, remotely or as a combination of both, in Arabic or English, depending on what the engagement needs and on the advisers involved.
How do I book a consultation?
Individuals and organisations can book a private session directly with an adviser in this discipline on the advisers page, choosing a date and time online. For a larger engagement, such as a full continuity programme or a series of exercises, request a proposal and we will reply within 48 hours.
One session, or a whole programme.
Start with a private session with an adviser in this discipline, or ask for a proposal for a business continuity programme, a plan review or a series of exercises. We reply to proposal requests within 48 hours.