Business continuity planning means deciding in advance how your business will keep serving customers, or get back to serving them quickly, when something goes wrong: a fire, a power outage, a key person out sick, a supplier failure or a cyberattack. A useful plan identifies your most critical activities, the risks that could stop them, and specific steps and contacts for the first 72 hours.
This guide is for small business owners who know they "should have a plan" but haven't written one because it sounds like a big-company project. You'll learn how to rank your risks, calculate what a day of downtime costs, and build a one-page plan and a 72-hour checklist you can finish in an afternoon.
What a continuity plan covers (and what it doesn't)
A continuity plan is not an insurance policy and not an emergency evacuation procedure, though it connects to both. Insurance can help pay for losses after the fact. Safety procedures protect people in the moment. Continuity planning covers what happens next: how you keep operating, communicate with customers and staff, and recover.
For a small business, a practical plan answers five questions:
- Which activities must keep running, and how quickly must each be restored?
- What are the most likely and most damaging disruptions?
- What will we do, step by step, if each one happens?
- Who does what, and how do we reach them?
- Where are the information, money and supplies we'll need?
How to identify your critical activities
List everything the business does, then mark each activity with how long you could go without it before real harm occurs. That time limit is often called the recovery time objective, or RTO.
- Hours: taking orders or payments, core service delivery, customer communication
- Days: payroll, supplier ordering, invoicing
- Weeks: marketing, bookkeeping catch-up, non-urgent projects
Then note what each critical activity depends on: people, equipment, software, data, suppliers, premises and utilities. Dependencies are where plans usually fail. The ordering system may be fine, but if only one person knows the login, it's effectively down when they are.
How to rank the risks that matter most
You can't plan for everything. Score each realistic risk from 1 to 5 for likelihood and for impact, then multiply. Plan for the highest scores first.
| Risk | Likelihood (1–5) | Impact (1–5) | Score |
|---|---|---|---|
| Key equipment failure | 4 | 4 | 16 |
| Owner or key employee suddenly unavailable | 3 | 5 | 15 |
| Ransomware or data loss | 3 | 5 | 15 |
| Extended power or internet outage | 3 | 4 | 12 |
| Main supplier can't deliver | 3 | 4 | 12 |
| Fire, flood or storm damage | 2 | 5 | 10 |
These scores are an example. Yours will depend on your location, industry and setup. The point is to rank honestly and spend your limited planning time where it matters. Two risks deserve special mention because they're common and often overlooked: cyber incidents, which our guide to cybersecurity basics covers, and reliance on a single supplier, covered in our guide on single-supplier risk.
Worked example: what downtime costs a restaurant
Suppose a hypothetical restaurant brings in about $4,500 a day. Its variable costs, meaning food, packaging, card fees and the hourly shifts it would cancel if closed, are about 38% of sales. Rent, salaries and loan payments continue whether it's open or not.
- Contribution lost per day closed: $4,500 × (1 − 0.38) = $4,500 × 0.62 = $2,790
Now suppose the walk-in cooler fails on a Friday night. Without a plan, the owner spends the weekend finding a repair technician, and the restaurant is closed for 3 days. About $3,500 of food spoils.
- Lost contribution: 3 × $2,790 = $8,370
- Spoiled inventory: $3,500
- Total cost of the event: $8,370 + $3,500 = $11,870
With a plan, the restaurant has a temperature alarm that texts the manager, a service contract with guaranteed response times, and a pre-arranged contact for renting a refrigerated trailer. Together these cost about $600 a year. The same failure now means 1 day closed and about $500 of spoiled food.
- Cost with the plan: $2,790 + $500 = $3,290
- Savings per event: $11,870 − $3,290 = $8,580
- If this happens once every five years: $8,580 ÷ 5 = $1,716 a year in expected savings, against $600 a year in cost
That's the value of continuity planning in plain numbers. The preparation is cheap because it happens before the emergency, when you have time to compare options and prices. This also shows why a cash reserve matters: even a well-handled disruption costs money. Our guide on sizing a cash reserve shows how to plan for it.
A one-page continuity plan template
Keep it short enough that people will actually read it in a crisis. Store copies in at least two places, including one that doesn't depend on your office or your main computer.
- Critical activities and RTOs: the short list from your analysis.
- Emergency contacts: staff, landlord, utilities, key suppliers, IT help, insurance agent, bank, accountant.
- Decision authority: who's in charge if the owner is unreachable, and what they can approve.
- Backup arrangements: alternate suppliers, equipment rental contacts, a temporary location or remote work setup.
- Data and access: where backups are, how often they run, and how to restore them. Where account credentials are kept, using a secure password manager, and who can access them.
- Customer communication: who updates your website, voicemail, social profiles and email list, with pre-written messages.
- Money: how much cash reserve is available, credit lines, and how to reach your insurer to start a claim.
- Risk-specific steps: a short numbered list for each of your top three to five risks.
The first 72 hours checklist
- Make sure everyone is safe and accounted for.
- Assess the damage or disruption and estimate how long it will last.
- Contact staff with clear instructions about whether and where to work.
- Notify customers with affected orders or appointments, and update your website and voicemail.
- Contact your insurer or agent, and photograph damage before cleanup.
- Activate backup suppliers, equipment or locations.
- Track every related expense and lost sale in one place for claims and records.
- Hold a short daily check-in until operations return to normal.
Talk with a licensed insurance agent about whether business interruption or equipment breakdown coverage makes sense for your situation, and what records you'd need to file a claim.
How to test and maintain the plan
An untested plan often fails in small, avoidable ways: an outdated phone number, a backup that won't restore, a manager who doesn't know where the plan is. Once or twice a year, run a 30-minute tabletop exercise. Pick one scenario, walk through the plan step by step with your team and note every gap.
Also test your data backups by restoring a real file. Update the contact list whenever staff or suppliers change. A good trigger is to review the plan whenever you do your annual insurance renewal.
Common continuity planning mistakes
- Writing a plan nobody can find. A plan stored only on the office computer is useless if the office is inaccessible. Keep copies offsite and in the cloud, and make sure key staff know where.
- Planning only for disasters. Fires are rare, while equipment failures, outages and absences are common. Plan for the likely events first.
- Relying on one person's knowledge. If only the owner knows the passwords, suppliers or procedures, the business stops when they do. Document and share access.
- Never testing backups. Many owners discover their backups don't work during the emergency. Restore something at least twice a year.
- Assuming insurance covers everything. Policies have exclusions, waiting periods and limits. Review coverage with your agent before you need it.
- Forgetting customers. Silence during a disruption loses customers. Prepare messages in advance.
Where AI can help
AI tools can speed up the writing. An assistant can turn a rough list of your activities and dependencies into a structured plan, suggest risks you may have missed for your type of business, and draft customer and staff messages for different scenarios. It can also help you run a tabletop exercise by playing out a scenario and asking what you'd do at each stage.
Review every suggestion against your actual setup. AI tools don't know your building, contracts, insurance terms or local conditions. Don't paste passwords, account numbers or sensitive details into general-purpose tools, and verify contact information yourself.
Frequently asked questions
How long should a small business continuity plan be?
Short enough to use under stress. A one- or two-page core plan with a few pages of risk-specific steps and contacts works for most small businesses. Length matters less than accuracy and accessibility.
How often should I update my continuity plan?
Review it at least once a year and whenever something important changes, such as a new location, key hire or departure, major supplier or new software system.
Is a continuity plan the same as a disaster recovery plan?
They overlap. Disaster recovery often refers specifically to restoring technology and data. Continuity planning is broader and covers people, premises, suppliers, customers and money as well.
Where should I start if I only have an hour?
Write down your emergency contacts, confirm your data backups work, and name who's in charge if you're unavailable. Those three steps cover a surprising share of real-world disruptions.
Key takeaways
- Continuity planning decides in advance how you'll keep operating or recover quickly after a disruption.
- Identify critical activities, how long each can be down, and what they depend on.
- Rank risks by likelihood and impact, and plan for the top few first.
- Calculate what a day of downtime costs you, since it usually makes preparation look cheap.
- Keep a one-page plan and a 72-hour checklist in several accessible places, and test them yearly.
Comments
Post a Comment