Project Right Consulting helps organizations find what actually breaks, set recovery objectives they can meet, and exercise their plans until they work, including the processes that now run on AI. Led by Hiram Seraphin, CBCP, PMP.
In business continuity and operational resilience, after an earlier career in operations management
Standards certified in: 22301 continuity, 27001 security, 31000 risk and 42001 AI
Employee audience for the continuity training and disaster preparedness content I authored
Sectors: financial services, Big 4 advisory, supply chain, utilities, higher education, public sector
Practical continuity work, sized for organizations that need a program that holds up in a real event and stands up in an audit. Each engagement ends with artifacts your team owns and can run without us.
BIA design and facilitation that tests the numbers instead of collecting them. We challenge recovery objectives against what the business can actually tolerate and what IT can actually deliver.
Recovery strategies and plans written for the people who will run them at 3 a.m. New builds, refreshes of plans that have drifted from how the operation works today, and subject-matter review of public-sector Continuity of Operations (COOP) plans.
Scenario-driven exercises with objectives set in advance, an observer whose only job is to watch, and findings captured while they are still accurate. Then the corrective actions get tracked to closure.
Most dependency maps stop at the vendor you pay. We follow the chain past it, to the data center, the platform and the shared provider underneath, where concentration risk tends to hide.
Policy, standards and the operating rhythm behind them, aligned to ISO 22301. Dashboards that show leadership RTO/RPO attainment and testing status, and evidence that keeps the program audit-ready.
When an AI service or agent sits inside a critical process, it is a dependency like any other. We find where AI is already in the workflow, define the fallback if it goes down or gets switched off, and connect that work to ISO/IEC 42001 controls.
Also available: project and program delivery for resilience initiatives, run by a PMP in Microsoft Project or Monday.com, from charter and RACI through closeout and lessons learned.
Over the past year I have used AI to build working continuity toolkits and small automations. Every one of them is designed the way a continuity plan is: a named decision owner, a deadline, and a safe default if the human goes quiet.
ISO/IEC 42001 sets out how an organization governs AI. Continuity asks what happens when that AI fails, changes or has to be switched off. These are the questions where the two meet.
Which AI systems sit inside critical processes, including the ones nobody approved? Then the BIA question: what is the impact if this one stops?
42001 ▸ AI system inventory & impact assessmentA model changes when the vendor changes it. Updates, deprecations and outages get treated as third-party events, with notice, testing and an exit path.
42001 ▸ Third-party & supplier relationshipsCan the process keep running if the agent is switched off today? A fallback only counts once it has been exercised like any other recovery step.
42001 ▸ Operation & AI system life cycleWho can pause the system, how quickly they hear about a problem, and what runs if they do not answer. Human oversight needs a name and a deadline.
42001 ▸ Roles, responsibilities & human oversightPerspective and approach, informed by ISO/IEC 42001 Lead Implementer and Lead Auditor certification.
A six-tab BIA workbook with a residual-risk scoring engine and summary dashboard, a 17-slide kickoff deck, and a facilitation manual, so every BIA follows the same structure.
A complete package generated from modular build scripts: exercise plan, master scenario events list, injects, facilitator guide, participant handouts and after-action templates.
A scheduled workflow that proposes eight researched topics every week for the Field Notes series. I make the call; if I don't by the deadline, a default goes ahead.
Ten live course sessions captured, transcribed locally and formatted into a 162-page reference. The audio never left the laptop: match the tool to the sensitivity of the data.
Scheduled check-ins, a hard cutoff, provisional entries when an input is missing, and override by exception, so pay still goes out when something upstream fails. Read and write access kept separate.
An AI-drafted after-action readout looked finished, but carried a placeholder company name on five slides and downtime stated as 14, 47 and 72 hours. Reconciled, rebuilt, and turned into a seven-check review before anything is distributed.
AI does the heavy lifting on synthesis, drafting and cross-referencing. Recovery objectives, remediation priorities and anything that reaches executives stay with a person who can defend them. Certified ISO/IEC 42001 Lead Implementer and Lead Auditor.
Documentation is where most programs stop. Ours is built to be run, measured and corrected, so the next real event goes better than the last exercise.
Interview the business, map processes and dependencies, and set impact tolerances leaders will sign.
Choose recovery strategies that match the objectives, then write plans the responders can actually follow.
Run tabletops against realistic scenarios, including the step that fails, and measure against the targets.
Turn findings into owned, dated corrective actions and report progress to leadership until they close.
A weekly series on LinkedIn, anchored to real incidents and sourced data. Every post separates verified fact from opinion and puts its sources in plain view.
99% of the surveyed companies had a disruption last year. 51% have never tested their plan. Same 500 companies. Living through an event feels like evidence, and that is the most expensive thing to mistake it for.
| Real disruption | Exercise | |
|---|---|---|
| Objectives | Set by the event | Set in advance |
| Observation | After the fact | A dedicated observer |
| Success | "It ended" | Measured against a target |
| Findings | From memory, later | Captured while accurate |
A hosting outage took my business email down. Tracing why led four layers past the provider I actually pay. Most dependency maps stop at layer one.
The fastest Formula 1 pit stop on record took 1.80 seconds. At Monaco in 2021, a wheel nut failed during a routine change and the wheel came off two days later at the factory. Plan for the wheel that won't come off, and decide in advance who calls it.
"Everybody has a plan until they get punched in the mouth."Mike Tyson
A plan is a starting position. What has to hold when the punch lands is who decides, how fast they hear about it, and what they are allowed to change.
Programs often score close to 100% complete on documentation and far lower on what actually recovers. The plans are on file and the audits pass. Then a real scenario runs and the recovery time slips.
The 9/11 Commission named a failure of imagination. As AI moves into critical processes, the same failure is available again: scenarios nobody wrote because nobody pictured them.
AI services have outages like any other provider. The question for continuity teams is which processes now stop when one does, and whether anyone wrote that down.
A scenario post where readers make the calls, inject by inject. It is the fastest way to find out whether a team agrees on who decides before the event forces the question.
New post every Wednesday · 8:30 a.m. ET
Follow the series on LinkedInI founded Project Right Consulting in 2018 to bring project discipline to the work of keeping organizations running. I trained as a mechanical engineer, which is where the habit started: find the load path, find the weak member, test it before it matters.
I have spent about eight years in business continuity and operational resilience. That work has included leading full-lifecycle continuity planning for mission-critical business units at a global financial market operator, supporting an executive-level pandemic response, serving on call for major incidents, and helping operationalize an enterprise continuity program for a Big 4 firm. Through Project Right, I served as the subject-matter expert reviewing Continuity of Operations (COOP) plans and drafted a new business continuity plan for a government agency. Before that came five years in operations management, leading a small team.
I mentor project managers through the PMI Atlanta Chapter and write a weekly series on how things actually break. I work from Atlanta with clients anywhere.
Start with a 30-minute conversation about your program: where it stands, what an exercise would expose, and what to fix first. Hiring teams are welcome too; a résumé is available on request.