Business continuity plan steps start with one question: what must keep running if something goes wrong? A fire, a flood, a cyber attack, a supplier failure or a sick team can all stop a small firm. A written plan lets you restart fast. This guide gives six plain steps you can finish in a few weeks.
1. Name a team and an owner
Pick one person to own the plan. Enterprise Singapore calls this role a Business Continuity Manager. This person keeps staff familiar with the plan and makes sure they follow it. In a small firm, the owner can also run the business. Name a backup too, in case the owner is the one who is away.
Plan for the loss of key decision makers as well. Write down who takes charge if the director or founder cannot be reached. Share that list with the whole team.
2. Find your critical work
List everything your firm does. Then mark the tasks that must continue first. Standards call these prioritised activities. For a shop this may be taking orders and paying staff. For a trading firm it may be shipping and invoicing. Also list the people, tools, data and suppliers each task needs.
This is called a business impact analysis. The ISO 22301 standard, second edition, October 2019, treats it as its own step. It sits in the same section as risk assessment. The two work together. First ask what hurts most if a task stops. Then ask what could make it stop.
3. Set recovery targets
For each critical task, decide how long it can stay down. One day may be fine for your newsletter. One hour may be too long for payments. Write a clear target next to each task. Then check that your plan can meet it.
Also decide how much recent work you can afford to lose. If your orders are saved once a day, you could lose a full day of orders. If that is too much, save more often. These two numbers shape every choice after this, from your tools to your budget.
4. Plan for people, suppliers and data
Write short actions for the three things most small firms depend on.
- People. Decide who can work from home and who covers each key task. Cross-train at least two people on every critical job.
- Suppliers. Know your essential suppliers and ask about their own plans. Enterprise Singapore advises firms to spread their sources of supply. That can mean pre-qualifying a second supplier, in another market if needed.
- Data. Back up files, accounting records and customer lists. Keep one copy away from the office, such as in the cloud. Try restoring a file. A backup you have never restored is only a guess.
Keep a printed list of key phone numbers. Power and internet can fail at the worst time.
5. Decide who says what
During a crisis, people want facts fast. Staff need to know where to go and what to do. Customers need to know about delays. Suppliers need to know what you need from them. List these groups and how you will reach each one. A shared messaging group, an email list and a phone tree are enough for a small firm.
Write two or three short message drafts ahead of time. For example, one for an office closure and one for a late delivery. Fill in the details when needed. Pick one person to speak for the firm so the message stays the same everywhere.
6. Test, then review
A plan that was never tested often fails. Practice comes in three simple forms. A call-out test checks that you can reach everyone. A tabletop test walks the team through a made-up event on paper. A drill acts it out for real.
Start with a one-hour tabletop test. Pick a simple event, such as the office being closed for three days. Ask each person what they would do. Write down every gap you find and fix it. ISO 22301 also expects an exercise programme, so testing is part of the standard, not an extra.
Then review the plan on a set schedule, for example once a year. Review it again after any big change, such as a move, a new system or a new key supplier. Update names and numbers each time.
Where to start this week
You do not need a big budget. Start with a one-page list of critical tasks, the people who do them and the backup for each. Add recovery targets next to each one. Then book your first tabletop test. That one page already covers the core business continuity plan steps. You can add detail as you go.