Business continuity

Why it matters

Small businesses are more exposed to disruption than large ones because they have less slack: fewer people, thinner cash reserves, single suppliers and systems. Australian conditions add bushfire, flood, cyclone and storm to the universal threats of illness, cyber incidents and supplier failure. A business that keeps serving customers through a disruption often wins them permanently from competitors who could not. The planning costs a few days; the lack of it can cost everything.

Identify what the business cannot do without

Start by listing your critical activities: the handful of things that, if they stopped, would stop revenue or break promises to customers within days. Taking orders, delivering the core service, paying staff, communicating with customers. For each one, list what it depends on: specific people and their knowledge, systems and data, equipment and premises, suppliers, and cash.

Then ask how long each activity could be down before the damage becomes serious. A café can lose its booking system for a week; it cannot lose its coffee machine for a day. This maximum tolerable downtime tells you where recovery must be fastest and where you can afford a slower, cheaper response.

• Critical activities: usually four to eight in a small business.
• Dependencies for each: people, systems, equipment, suppliers, premises, cash.
• Maximum tolerable downtime for each activity, in hours or days.
• Single points of failure: anything on the list with no alternative.

Assess the likely disruptions, not just the dramatic ones

List the events that could take out your dependencies and rate each on how likely it is and how badly it would hurt. Be honest about the ordinary ones. Key person unavailability, a ransomware infection, a long power or internet outage, a supplier failure and a premises problem (fire, flood, lease termination) are on almost every small business list. Regional businesses add the natural hazards of their area.

High-likelihood, high-impact items need detailed plans and preparation now. High-impact but rare events need a simpler plan and often insurance. Low-impact events can be handled as they arise. This keeps the effort proportionate and stops the plan becoming a catalogue of every imaginable disaster.

Plan the first hours and the first week

For each priority scenario, write down what happens in the first hours and the first days. Who makes the call that the plan is active? How do you contact staff, customers and suppliers if the office and its systems are unavailable? Where will you work from? How will you take orders and payments? Who covers each critical role if its usual holder is unavailable? What do you tell customers, and when?

Keep each scenario plan to a page or two with named people, phone numbers and the location of anything needed. Store a copy off-site and in the cloud, and give key people a copy at home. A plan that lives only on the server that just failed is not a plan.

Prepare the practical fallbacks

Preparation is what makes the plan executable, and most of it is inexpensive. Cloud-based systems and tested backups mean a destroyed office does not destroy your records. Cross-training and written procedures mean one person’s absence does not stop a critical activity. A qualified second supplier for strategic inputs turns a failure into an inconvenience. A contact list kept outside the office means you can reach people. A cash buffer or arranged facility covers weeks of reduced revenue; business interruption insurance, where appropriate, covers longer periods. Review the cover and its conditions with your broker.

Key person risk deserves particular attention in owner-led businesses. If the owner is unavailable for a month, who can sign, pay, quote and decide? Documenting authorities securely and ensuring at least one other person can run payroll and banking is among the highest-value preparation a small business can do.

How to write and test a continuity plan

1. List critical activities and dependencies Four to eight activities; the people, systems, equipment, suppliers and cash each relies on.
2. Set maximum tolerable downtime For each activity, how long before the damage becomes serious.
3. Rate scenarios by likelihood and impact Include the mundane: key person absence, cyber incident, outage, supplier failure.
4. Write a one-page response per priority scenario Who activates, who does what, how you communicate, where you work, how you take payment.
5. Put the fallbacks in place Tested backups, cross-training, second suppliers, off-site contact list, cash buffer, insurance review.
6. Store the plan off-site Cloud copy and a printed copy with two key people at home.
7. Walk through a scenario annually Two hours with the team, talking through a disruption step by step. Fix what the walk-through reveals.
8. Update when the business changes New systems, people, premises or suppliers mean the plan needs a review.

Real-world example

A Townsville wholesaler plans for the wet season

Coral Coast Distributors supplies dry goods to about 90 cafés and restaurants from a single warehouse with 14 staff. After a near miss during a cyclone warning, the owner lists four critical activities: taking orders, picking and delivering, paying staff and paying suppliers. Dependencies include the warehouse, two delivery trucks, the order and accounting system on a server in the office, the owner (sole signatory on the bank account) and the warehouse manager, who alone knows the system properly.

He rates a cyclone or flood closing the warehouse for a fortnight, and a ransomware attack, as likely and severe, and his own absence as moderate and severe. Over three months the business moves its order and accounting system to a cloud service with daily backups and tests a restore, adds the warehouse manager and the bookkeeper as bank signatories with agreed limits, arranges a standing agreement with a Cairns wholesaler to supply key customers directly for up to two weeks, and documents how to take orders by phone from the owner’s home. The October walk-through reveals the staff contact list is a year out of date and nobody knew where the generator fuel was stored. Both are fixed before the wet season.

Common mistakes

• Planning only for disasters Floods and fires are rare; key person absence, outages and cyber incidents are common. Plan for the likely first.
• The plan lives on the server If the only copy is on the system or in the building that failed, you have no plan. Keep cloud and printed copies off-site.
• Untested backups A backup that has never been restored is a hope, not a safeguard. Test a restore annually and time it.
• Owner as the single point of failure Sole signatory, sole password holder, sole decision-maker. Delegate authorities before you need to.
• Write once, never revisit Businesses change; a three-year-old plan names people who have left and systems you no longer use. Review annually and after major changes.

KPIs to track

• Critical activities with a documented fallback Share of your critical activities that have a written alternative for each major dependency. Aim for all of them.
• Single points of failure Count of critical dependencies with no alternative. Each one removed is a real reduction in risk.
• Backup restore time Hours to restore critical data to a usable state, measured in a test, not estimated. Compare with your maximum tolerable downtime.
• Months since last plan test Keep it under twelve. The date of the last walk-through is a simple health check.
• Cash buffer in weeks Weeks of fixed costs covered by available cash or facilities. Match it to the downtime you are planning for.

Frequently asked questions

How is business continuity different from disaster recovery?

Disaster recovery usually refers to restoring IT systems and data after a failure. Business continuity is broader: keeping the whole business operating or recovering, including people, suppliers, premises, cash and customer communication. Disaster recovery is one part of a continuity plan.

How long should a small business continuity plan be?

Short enough to use under pressure: a summary page of critical activities and contacts, plus one or two pages per priority scenario. Length is not the measure of a good plan; clarity about who does what is.

Does insurance replace the need for a plan?

No. Insurance replaces money after the event; it does not keep your customers while you are closed or tell your staff what to do on the morning of the disruption. The two work together. Review your cover and its conditions with a broker so you know what is and is not included.

What is the single most useful first step?

Make sure at least one other person can run the business for a month if you cannot: banking authority, system access, key supplier and customer contacts, and a written note of what to do. It covers the most common serious disruption and costs almost nothing.

Key takeaways

• Continuity planning is about the likely disruptions, such as key person absence, cyber incidents and outages, as much as the dramatic ones.
• Identify your critical activities, their dependencies and how long each can be down.
• Write a one-page response for each priority scenario with named people and contact details, stored off-site.
• Put practical fallbacks in place: tested backups, cross-training, second suppliers, delegated authorities and a cash buffer.
• Walk through a scenario with the team every year and update the plan when the business changes.