Business Continuity Plan: Keep a Small Business Running During Disruption

A power outage, missing supplier, or locked account can bring ordinary work to a sudden halt. A useful business continuity plan tells your team what to protect, who makes decisions, and how to keep serving customers until normal operations return.

You don’t need a binder full of scenarios. Start with the few activities your business cannot afford to lose, then document practical workarounds and test them before an emergency. The plan should be short enough to use when people are tired, distracted, and working with incomplete information.

Start with the work that cannot wait

List the activities that keep money coming in and customers served. A retailer might need payment processing, access to stock, and a way to fulfill orders. A consulting firm might need client files, email, and the ability to meet contractual deadlines. Payroll and access to bank accounts may matter to both.

For each activity, ask how long it could stop before the consequences become unacceptable. Consider lost sales, customer commitments, safety, legal obligations, and the time needed to catch up afterward. A deadline for restoring service is a planning target, not a guarantee that a vendor or utility can meet it.

Separate urgent work from work that can wait. Sending a routine marketing email may be less urgent than responding to a client whose shipment is stuck. If everything gets marked critical, the plan won’t help anyone choose.

Record the people, systems, equipment, and outside providers each priority depends on. Look beyond the obvious: an online store may depend on internet access, a payment processor, a shipping carrier, and one employee who knows how to print labels. That last dependency can be easy to miss.

A simple worksheet needs only a few fields: activity, maximum tolerable interruption, dependencies, temporary workaround, owner, and backup owner. Give each owner enough authority to act, or state who must approve spending and customer concessions.

Choose realistic ways to keep operating

Your business continuity plan should distinguish between restoring the usual setup and working around it. Sometimes the best answer is to wait briefly. Other times, a temporary process protects enough revenue and trust to justify the effort.

Use backups for information and access

Make copies of essential records, including customer contacts, current orders, financial records, and operating instructions. A backup stored separately from the main system gives you another option if a device fails, an account is compromised, or files are accidentally deleted.

Check what your software provider actually backs up and how restoration works. File synchronization alone isn’t necessarily a usable backup: an accidental deletion or corrupted file may sync too. Set a backup schedule that reflects how much recent work you could afford to recreate, and periodically test a restore.

Protect backup access as carefully as the original records. Limit permissions, use multifactor authentication where available, and keep recovery instructions available to an authorized backup person. A shared inbox can reduce dependence on one employee’s email account, but it still needs access controls and a recovery process.

Compare temporary workarounds

A manual process can be inexpensive and quick to set up. For example, a service business might record appointment requests on a paper form during an internet outage, then enter them into its system later. The trade-off is slower work and a greater chance of missed or duplicated entries.

A second provider or alternate location may offer more capacity, but it takes money and preparation. A backup supplier is useful only if it can deliver what you need and has agreed to work with you. Likewise, a spare workspace won’t help if staff can’t access the files or equipment required there.

Pick the least complicated option that meets your restoration target. Write down its limits. If a manual payment process would expose card information or violate your payment provider’s rules, don’t improvise it during an outage. Ask the provider about approved alternatives beforehand.

Build a business continuity plan people can actually use

Put the action page first. It should tell the person discovering a problem how to report it, who decides whether to activate the business continuity plan, and where the latest contact list lives. Keep a protected copy available outside your primary system, as well as a version that can be reached without internet access when appropriate.

Assign roles rather than assuming the owner will handle everything. In a very small company, one person may hold several roles, but each still needs a backup. Useful assignments include:

For each role, include a name, an alternate, and contact methods that don’t all rely on the same system. Don’t put passwords in an unprotected plan. Store credentials in an appropriate secure system and document how authorized people can recover access.

Set a few activation triggers. A store might activate its plan when its payment system is unavailable and the provider cannot give a useful restoration estimate. A firm facing a security incident may need to isolate affected systems rather than immediately restore normal access. Include the contact details for your IT provider and insurer, if applicable.

Finally, define who can spend money during the disruption and up to what amount. An employee sent to arrange temporary equipment shouldn’t have to guess whether the purchase is authorized. Keep receipts and record decisions so the business can reconcile costs later.

Work through one disruption before it happens

The following example uses illustrative numbers, not market prices or a prediction. Its purpose is to show how a business can turn a general concern into a decision.

Assumptions: A small print shop receives 20 orders on a typical business day. Its order system and production equipment need internet access for the normal workflow. The owner estimates that losing a full day would delay 12 orders that cannot be completed from information already on hand. Four of those orders have customer deadlines within two days.

The shop sets a target of contacting affected customers within two hours of discovering a prolonged outage. It also decides to preserve the day’s order details in a protected offline copy that is refreshed each morning. A designated employee can use that copy to identify urgent jobs and call customers, even if the order system is unavailable.

For production, the owner arranges an informal discussion with another local printer about handling urgent jobs. Before relying on that option, the shops need to agree on capacity, file transfer, confidentiality, turnaround, and payment. Until then, the plan treats outside production as a possibility, not a promise.

During a test, the team discovers that the offline order copy doesn’t include customer phone numbers. That is a useful finding. The owner changes the export and assigns someone to check it regularly. The test doesn’t prove every order will be saved, but it removes a specific obstacle before an actual outage.

Prepare messages and protect cash

Customers usually need a clear update more than a polished explanation. Prepare a short message that identifies the affected service, says what customers should do, and gives a time for the next update. Avoid promising a restoration time you can’t control.

For example: “Our ordering system is temporarily unavailable. If you have an urgent order, call the number on your receipt. We’ll post another update by 3 p.m.” If that time arrives and the problem remains unresolved, post the update anyway. Silence makes customers invent their own explanations.

Choose communication channels in advance. Your website, social accounts, email, and phone message may reach different people, and one channel may be part of the outage. Decide who can publish updates and who handles individual complaints or refund requests.

Cash needs attention too. Estimate which bills must still be paid if sales pause, and identify funds or credit that may be available for a disruption. A 13-week cash flow forecast can show when a delay in customer payments would create pressure. Don’t assume insurance will cover every loss; review your policy’s terms, exclusions, and claim requirements with your insurer or broker.

If customer or employee information may have been exposed, preserve relevant records and get appropriate help promptly. Notification duties vary by situation and jurisdiction. Check official guidance and consult qualified legal or security professionals rather than relying on a generic template.

Test the plan and keep it current

A business continuity plan that nobody has practiced is a set of guesses. Start with a tabletop exercise: gather the people with assigned roles, describe a plausible disruption, and talk through the first few hours. Ask each person to explain what they would do and where they would find the information.

Make the exercise specific. Instead of “the internet is down,” say that the office has lost connectivity, the owner is unavailable, and three customers are waiting for updates. Can the backup lead find their numbers? Can anyone authorize an alternate connection? Write down gaps without turning the exercise into a search for someone to blame.

Test technical steps separately, especially restoring files and recovering account access. Do that in a controlled way that won’t overwrite live data or expose sensitive information. Your provider may need to assist. A successful restore of one file doesn’t prove every application can be rebuilt, so record exactly what the test covered.

Review the plan after a major change, such as moving premises, changing software, adding a key supplier, or losing a person with specialized knowledge. Also review it on a regular schedule. Update contact details and retire old copies so employees aren’t following conflicting instructions.

Look at the operational weak points revealed by the exercise. A supplier failure may call for a second source or a different stock policy; the guide to setting inventory reorder points can help with the stock decision. If one customer represents a large share of revenue, address that exposure separately using the customer concentration risk guide.

After a real incident, record what happened, which workaround was used, and what it cost. Check the backlog before declaring the response finished. Restoring the system is only part of recovery; orders, messages, and accounting entries still need to be reconciled.

Bottom Line

Build a short business continuity plan around your most time-sensitive work, with named backups, tested access to essential records, and workarounds your team can actually carry out. Treat alternate suppliers, insurance, and technology recovery as arrangements to verify, not assumptions. Today, list your five most important activities and name the person who would take charge of each if you were unavailable.

Frequently Asked Questions

Insurance coverage and legal notification duties depend on policy terms, circumstances, and jurisdiction, so consult your insurer or qualified professionals.