Small businesses
This is a basic five-step guide to get you started on business continuity planning for a small organisation. Use the links below to go to each section, or you can download and print a more detailed strategy for small businesses.
- Step one: Analyse your business
- Step two: Assess the risks
- Step three: Develop your strategy
- Step four: Review your plan
- Step five: Train your staff
Step one: Analyse your business
The first step of a business continuity plan is to think about the parts of your business that are crucial in keeping it going.
You might find it helpful to approach this stage by asking two questions:
- Where is your business most vulnerable?
- What would be worst for your business?
Answer both of these questions in relation to the following:
- Staff
- Customers
- Suppliers
- IT systems and processes
- Partnerships
- Buildings
- Timescales
Once you have looked at your business in detail, you can move on to considering the major risks and the impact they could have on your organisation.
Step two: Assess your risks
Your next steps are to look at the most likely and greatest risks to your business. When running through these hazards, ask yourself the following four questions:
- What might happen?
- How likely is it to happen?
- What preventative measures do we have in place?
- How long would the negative impact last?
Try creating a similar table to the example below. You will need to describe possible incidents and list ways of how to cope with them.
| Incident | Likelihood | Preventative measure? | Impact on business |
|---|---|---|---|
| There is a fire and you are not able to use your site for weeks. | Low | e.g. fire resistant equipment/ alternative site? | e.g. forced to run at 20% of normal activities for a week. |
| You are burgled and some damage to your property has taken place. | Medium to high | e.g. insurance?/ good security?/ separate off-site computer back-up files | e.g. forced to run at 80% of normal activity for a week. |
| There is a power failure that lasts for days. | Low | e.g. a backup generator |
How long can your business last during/after an incident?
Some companies can function for a long time during a crisis; others are more at risk and can suffer from the smallest of incidents.
You need to establish how long your business could function at a reduced level and what that level is: consider how much you can afford to lose if you are unable to run your business for days/ weeks/ months. I.e. should your business be forced to run at only 50% its normal activities, 20%, 80% etc? Make sure you know your break-even point!
For more help in assessing your risks, use our quick interactive risk assessment tool and download the risk assessment checklist.
Step three: Develop your strategy
You have established what is important to the survival of your business and what the risks are. Now you can write the plan. Be sure to use non-technical language, making it accessible and easy to understand by everyone. Include:
- A description of what the plan is trying to achieve and how to make it work
- Essential check lists
- A description of your premises
- The structure of the crisis team - who needs to do what
- Emergency provision for staff
A. Description of what the plan is trying to achieve and how to make it work.
The plan should focus on the most vital aspects of your business and address the weakest links in your organisation. It should include worst-case scenarios and their likelihood, and suggest ways of minimising the risks. You can use a table format similar to the one below:
| Things to consider when developing your strategy | Answer |
|---|---|
| What are the three most vital things to your business? | |
| What is the weakest link in your business? | |
| What are the three worst-case scenarios for your business? | |
| How likely are they to happen? | |
| What effect will they have on your business? | |
| What measures can you take to prevent them from happening? | |
| What measures can you take to minimise the effect they will have on your business? | e.g. prepare an off-site location to work from etc. |
Include a definition of what a disaster is in your plan, for example: 'any significant, threatening incident towards your personnel, buildings, or the business that will require special measures to be taken to restore things to normal'.
In this part of the plan you need to include a notice of formal support from the business owner/ owners or directors and a commitment to encouraging its development. Their endorsement ensures that if an incident occurs, they and everyone involved should follow the plan.
B. Essential check lists
Any good plan should contain check lists. They ensure a quick-look reference guide to what needs to be done during an emergency. Make sure they are kept up to date, distributed to the correct people and are readily available.
We have listed some examples for you to use as a starting point. Compile your own check lists to suit your business.
- What to do immediately following an incident PDF (if evacuation is needed)
- What to do after the first hour after the incident PDF (if a move to an alternative site is taking place)
- Essential and useful contact details PDF
- Essential and useful items PDF
- Examples of software and hardware inventory lists that you should have on and off-site RTF
C. A description of your premises
This should contain clear information on:
- Location of the emergency exits
- A primary meeting point in case of evacuation
- A fall-back option if you have to evacuate in a different direction
- Details of what the premises contain.
- Information that is important and specific to your premises i.e. storage facilities
D. The structure of the crisis team
Even though your company is fairly small, you will still find it useful to include information such as when to implement the plan and who has the authority to implement it. Include both senior and junior members of staff in the plan and their respective responsibilities; make sure that there are reserves for each role to cover holidays and sickness.
E. Emergency provisions for staff
Think about how your staff will react if quickly evacuated from your building. For example, have some spare petty cash set aside for emergencies. Staff may not have wallets or keys with them if their personal belongings have been left behind and they might need money to be able to get home.
Step four: Review your plan
It is important to update your plan regularly: you do not want to be in a crisis with an out-of date-plan. Remember, it will need to be amended when key personnel change, when you move to a different location or when your clients or suppliers change.
It is worth discussing your plan with other groups and reviewing it based on their feedback. Key people/organisations to consider are:
- Find out what emergency services need to know in case of an incident. They also offer security and evacuation advice.
- Find out from your local authority’s emergency planning officer what they would do in response to a major incident or terrorist attack.
- Keep in touch with neighbouring businesses. How can you help each other?
- Find out what information utility companies will need in case of an incident.
- What information will your insurer need from you?
- Ask key customers and suppliers how they would like information communicated to them if an incident occurs.
And remember to plan for worst-case scenarios: If you plan for a fire destroying a whole building, it will also work if only one or two rooms have been seriously damaged.
Step five: Train your staff
Once the plan has been developed, it needs to be tested, to make sure your ideas will work in practice. For successful training you should:
- Make sure all your staff have a copy of the plan.
- Ensure that they have the chance to read through the plan and that they understand their own role and particular responsibilities.
- Give staff an opportunity to ask questions and clarify issues as they might highlight some aspects that need to be changed.
- Remember to incorporate any learnings from the testing into your plan.
For more details on this aspect of perfecting your strategy, read our section on practising your plan and communicating your strategy.
To see how other UK businesses have coped with real emergency situations, take a look at these case studies.
