How to Write a Business Continuity Plan in a Weekend
Fires, floods, power cuts, a supplier going bust or a key person falling ill can stop a small business overnight. A business continuity plan tells everyone what to do so you can keep serving customers or get back up quickly. You do not need a consultant or a binder of 200 pages. This playbook helps you write a practical plan in one weekend.
Key takeaways
- A business continuity plan focuses on keeping critical activities going, not on listing every possible disaster.
- Start with a simple business impact analysis: what must keep running, and how long can you survive without it?
- Write short, practical recovery steps with named owners and contact details.
- A plan nobody has tested is a guess. Run a short tabletop exercise within a month.
Most small business owners know they should have a continuity plan, and most keep putting it off because it sounds like a large corporate project. It does not have to be. The core of a good plan fits on a few pages: what matters most, what could stop it, how you will keep going and who does what.
This playbook draws on widely used public guidance, including the business continuity planning resources on Ready.gov from the US Federal Emergency Management Agency (FEMA), and the principles behind ISO 22301, the international standard for business continuity management systems. You do not need certification to use the ideas. Rules and official guidance differ by country, so also check what your local emergency management agency or government recommends.
Before you start: what a continuity plan is and is not
A business continuity plan (BCP) explains how your business will continue its most important activities during a disruption and recover afterward. It sits alongside, but is different from:
- An emergency response plan, which keeps people safe during an event, such as evacuation and first aid.
- An IT disaster recovery plan, which restores systems and data. The site's separate cybersecurity checklist covers protecting systems in the first place.
- Insurance, which pays for some losses but does not keep customers served. The site's separate guide on small business insurance covers business interruption cover.
Saturday morning: list your critical activities
Gather your key people, or just yourself and a notebook if you are a solo owner. List everything your business does, then pick the activities that would hurt most if they stopped. Typical examples include taking orders, producing or delivering the product, serving customers, paying staff, paying suppliers and collecting payments.
For each critical activity, ask two questions:
- What happens if it stops? Think about lost revenue, customer damage, contract penalties, legal duties and safety.
- How long can we survive without it? This is your maximum tolerable downtime.
This exercise is a simplified business impact analysis, the first step recommended in FEMA's Ready.gov business continuity guidance.
Common mistake
Starting with a long list of disasters, such as earthquakes, cyberattacks and pandemics, and writing a separate plan for each. You end up with a thick document that is hard to use. Focus on the impact instead: loss of premises, loss of people, loss of systems or data, and loss of a key supplier. Most events cause one or more of those four.
Saturday afternoon: identify what each activity depends on
For each critical activity, write down what it needs to run:
- People: who does it, and who else could?
- Premises: where does it happen, and could it happen elsewhere?
- Technology and data: which systems, devices, internet access and files are needed?
- Suppliers: which outside companies must keep delivering?
- Equipment and stock: what physical items are essential?
Then set two recovery targets for each activity. The recovery time objective (RTO) is how quickly you need it working again. For data, the recovery point objective (RPO) is how much recent data you can afford to lose, which tells you how often to back up.
| Critical activity | Key dependencies | Recovery time target | Workaround |
|---|---|---|---|
| Taking customer orders | Website, phone line, order system | Same day | Divert phones to mobiles, take orders by email |
| Producing goods | Workshop, two trained staff, materials | Within 1 week | Agreement with a nearby workshop to share space |
| Paying staff | Payroll software, bank access, owner approval | Before next payday | Second authorized approver, cloud payroll access |
| Customer service | Email, customer records, laptops | Within 1 day | Cloud email and records accessible from any device |
The targets above are hypothetical examples. Set your own based on your customers and contracts.
Sunday morning: write your recovery strategies
Now decide how you would keep each critical activity going if a dependency failed. Work through the four main loss scenarios.
Loss of premises
Where could you work if you could not enter your building for a week or a month? Options include working from home, a partner business, a coworking space or a temporary unit. Note what equipment would need to move.
Loss of people
Which tasks can only one person do? Cross-train a second person, and write down how key tasks work. The site's separate guide to writing SOPs helps here. Make sure more than one person can access bank accounts, payroll and key systems, with proper controls.
Loss of systems and data
Back up important data regularly, keep at least one copy off-site or in the cloud and test that you can restore it. Keep a list of system logins in a secure password manager that a trusted deputy can access in an emergency.
Loss of a key supplier
Identify suppliers you depend on most and line up an alternative for each, even if it costs more. Keep a small buffer of critical stock where practical. The site's separate guide on inventory management covers safety stock.
Sunday afternoon: assign roles and write the plan
- Name a plan owner and a deputy. They decide when to activate the plan and coordinate the response.
- Build a contact list. Include staff, key customers, suppliers, landlord, insurer, bank, IT support, utilities and local emergency services. Keep copies offline and on phones.
- Write activation steps. Who decides the plan is in effect, how staff are told and where everyone meets or logs in.
- Write a communication plan. Prepare short message templates for staff, customers and suppliers explaining what happened and what to expect.
- Add the recovery steps. For each critical activity, list the workaround, who leads it and what they need.
- Store it where you can reach it. Keep a printed copy off-site and a digital copy in the cloud, so the plan is not lost along with your office.
What to include in your one-page summary
Put a one-page summary at the front of the plan for the first hour of a crisis, when nobody has time to read details. It should list the plan owner and deputy with phone numbers, how to activate the plan, where staff should go or log in, the critical activities in priority order and where to find the full plan. Laminate a copy, keep one in each manager's car or bag and save a copy on everyone's phone.
Keep the language plain. Use short sentences, numbered steps and checklists rather than paragraphs. In a stressful moment, people skim, so the most important action should be the first thing they read.
Hypothetical example
Suppose a small accounting practice with six staff writes its plan over a weekend. It identifies client deadlines, payroll services and email as critical. It moves client files to a cloud system with daily backups, gives the office manager a second set of bank and software access and agrees with a nearby practice to share desk space in an emergency. Months later, imagine a burst pipe floods the office. Staff work from home the next morning, clients receive a prepared email and no deadlines are missed. This scenario is illustrative.
After the weekend: test and maintain the plan
Within a month, run a tabletop exercise. Gather your team for an hour, describe a realistic scenario, such as "the building is closed for two weeks after a fire next door," and walk through the plan step by step. Note what was missing, unclear or out of date, and fix it.
FEMA's Ready.gov guidance and ISO 22301 both treat testing, review and improvement as essential parts of continuity planning. Review the plan at least once a year and whenever something important changes: a new location, a key hire or departure, a new system or a new major customer.
Pro tip
Check your key contracts and insurance policies while you write the plan. Some customer contracts include service level commitments during disruptions, and business interruption cover may have conditions you need to meet. Knowing these in advance shapes your recovery targets.
What a good small business plan includes
- A short list of critical activities with recovery targets
- Named owners, deputies and up-to-date contacts
- Practical workarounds for premises, people, systems and suppliers
Signs your plan will not work
- It exists only on the office server
- Only one person knows it exists
- It has never been tested or updated
Your weekend continuity plan checklist
- Saturday morning: list critical activities and maximum tolerable downtime
- Saturday afternoon: map dependencies and set recovery time and data targets
- Sunday morning: write workarounds for loss of premises, people, systems and suppliers
- Sunday afternoon: assign roles, build contacts, write activation and communication steps
- Store printed and cloud copies where they can be reached in a crisis
- Run a tabletop exercise within 30 days
- Set an annual review date in your calendar
Frequently asked questions
Do very small businesses really need a continuity plan?
Yes, and arguably more than large ones. A small firm usually has fewer people, fewer locations and less cash to absorb a disruption. Even a two-page plan can make the difference between a short interruption and a permanent closure.
Do I need ISO 22301 certification?
Most small businesses do not. Certification can help if large customers or public sector contracts require it. Otherwise, use the standard's principles, such as impact analysis, testing and continual improvement, without the formal audit.
How long should the plan be?
As short as possible while still being useful. Many small businesses manage with a few pages plus contact lists and short procedures. The plan should be quick to read in a stressful moment.
Where can I find templates?
FEMA's Ready.gov website offers free business continuity planning resources, and many national governments, chambers of commerce and local emergency agencies publish templates for their own countries.
Related reading
The bottom line
A business continuity plan does not need to be long or expensive. Spend one weekend identifying your critical activities, what they depend on and how fast they must recover, then write simple workarounds, assign roles and store the plan where you can reach it. Test it within a month and review it every year, and your business will be far better prepared for the day something goes wrong.
