How to create a business continuity plan for a small company

A small company continuity plan should be short, practical and written around the interruptions you are most likely to face. Start with the activities that keep cash coming in, decide who takes charge, set out the first response for each likely disruption and make sure staff can contact the right people if the office, systems or supplier network fail.

By Lucy Mitchell · Published 17 October 2026 · Updated 17 October 2026 · 13 min read

If your key supplier stops delivering, your laptop is stolen, or the office becomes unusable for a day, the problem is rarely abstract. Customers still expect replies, invoices still need sending, staff still need direction and cash flow does not pause while you work out what to do next.

That is why a business continuity plan matters for a small company. Not as a thick policy file, but as a clear, written guide to keeping the essential parts of the business going during disruption. For most smaller firms, the aim is not to cover every possible disaster. It is to decide what matters most, who takes action and how you recover quickly enough to avoid turning a short interruption into a longer one.

Think of it as a practical operating plan for bad days. It should be simple enough to maintain and detailed enough that someone else could follow it if you were unavailable.

What a business continuity plan does for a small company

In plain English, business continuity means keeping the business trading, or at least keeping the critical parts running, when normal routines are broken. That could mean working from another location, switching to manual processes, moving customer communications onto a different channel or prioritising only the services that protect revenue and reputation.

It is not the same as a risk register. A risk register is where you list what could go wrong and how serious each risk is. A continuity plan is the response document: what you will actually do when something happens. It is also different from an incident response plan, which is often more specific and immediate, especially for cyber incidents. You may need all three documents, but they serve different purposes.

For a small company, the most likely disruptions are usually ordinary rather than dramatic:

• staff illness or an absent key person
• power loss or internet failure
• laptop theft, lost devices or broken equipment
• cyber incidents, including account compromise
• supplier failure or late deliveries
• transport disruption
• fire, flood or loss of premises
• systems outage or data access problems

The common thread is that they interrupt the work that brings in money, supports customers or keeps the business compliant. A good continuity plan should be built around those pressures rather than around a theoretical worst-case scenario that is unlikely to be used.

Start with the business activities you cannot stop for long

The first task is to identify the minimum activities that keep the business alive. Do not start by trying to protect every process equally. Start by asking what must continue, even if it is only in a reduced form, for the business to keep trading.

For many small companies, the list will include some or all of the following:

• taking orders or enquiries
• replying to customers
• issuing invoices and chasing overdue payments
• paying staff and essential suppliers
• accessing files, drawings, job notes or customer records
• fulfilling current work
• receiving stock or materials
• meeting any regulatory or contractual deadlines

A practical way to do this is to rank tasks by time sensitivity. Ask which activities can stop for an hour, a day, a week or longer before the business starts to lose money, credibility or legal compliance. This is more useful than asking what is important in the abstract, because almost everything seems important until you have to choose under pressure.

For example, a two-person design studio may decide that client communication, access to artwork files and invoice issuing are the top priorities, while non-urgent archive tidy-up can wait. A local trades business may decide that phone access, diary management, stock ordering and job allocation matter more than almost anything else in the first 24 hours.

If you want to make the exercise clearer, use a simple table such as this:

The point is not to create a perfect catalogue. It is to see where the business is most vulnerable so you can prepare the right recovery steps.

Decide who does what when normal routines break

Small companies often rely on the owner as the default decision-maker. That can be efficient in ordinary times, but it becomes a weakness if the owner is unavailable or overwhelmed. Continuity planning forces you to decide what must be delegated and to whom.

At minimum, the plan should name:

• the main person in charge during disruption
• a deputy if the main person is unavailable
• who can contact customers
• who can speak to suppliers, the landlord, insurer, accountant or IT support
• who can approve emergency spending
• who can close premises or authorise remote working

This is where a simple decision tree helps. If the office floods, who is allowed to shut it down and move staff elsewhere? If payroll software fails, who can contact the accountant and approve manual payment arrangements? If a key supplier misses a delivery, who can source an alternative?

The trade-off is straightforward. Tight central control can reduce mistakes, but it also creates delays if everything has to wait for the owner. Delegation is faster, but only if people know their limits. A small company continuity plan should set those limits clearly. For example, a manager might be allowed to spend up to a defined amount on emergency supplies without further approval, but only if the issue is logged and reported the same day.

If you run as a sole trader, that decision-making may still sit with you alone, but you should still write down who steps in to answer the phone, access records or contact customers if you are unavailable. If you run a limited company, the structure and responsibilities are different, and directors have their own duties for records and accounts. GOV.UK explains that a limited company is legally separate from its owners, while a sole trader keeps the business and the owner more closely linked. That does not change the need for continuity planning, but it may affect how you assign responsibilities and backup decision-makers. GOV.UK — Set up a business GOV.UK — Set up a limited company

Map the likely disruptions and the first response for each

A useful continuity plan is built around the disruptions you are most likely to face. You do not need a separate procedure for every imaginable event. You do need a short, practical response for the common ones.

1. Cyber incident or account compromise

If email, cloud storage or a business account is compromised, the first hour matters. Secure the account, change passwords, alert your IT support or service provider, and prevent further damage. Preserve evidence where it may be useful, but do not let that delay containment. If customer data may be involved, follow your legal and contractual obligations.

2. Loss of internet or business systems

Check whether the issue is local or wider. If work can continue manually, switch to offline procedures for bookings, orders or job tracking. If not, move essential work to a backup connection, a spare device or another location. The key is to know in advance what “manual” means for your business, because improvisation takes time and leads to mistakes.

3. Fire, flood or loss of premises

People come first. Make sure everyone is safe and accounted for before thinking about equipment, stock or documents. Then decide whether the business can operate from elsewhere, even temporarily. For some companies, that may mean a shared workspace, another branch, a home office or simply remote working for a short period.

4. Key staff absence

If one person holds too much knowledge, the business can stall the moment they are unavailable. Identify which tasks that person alone knows how to do and write down the steps. Cross-training, shared passwords stored properly, process notes and deputy cover all reduce dependence on one individual.

5. Courier, stock or supplier delays

If your business depends on incoming stock or materials, delays can quickly affect customer commitments. The plan should say when to switch to an alternative supplier, when to warn customers and who can renegotiate timescales. Do not wait until you have already missed a deadline to make that call.

6. Loss of premises access

Even if the building is undamaged, access may be blocked by utilities problems, landlord issues or local disruption. Your response should identify where staff can work instead, how they will get in touch and which files or tools they need immediately.

In every scenario, the first priorities are similar: keep people safe, protect data, preserve evidence if needed and keep customers informed. A small company does not need a complicated command structure, but it does need a clear order of action. Those first decisions usually shape how much of the business can recover quickly.

Put your communications plan in writing

When disruption hits, confusion often starts with communication. People do not know whether to come in, customers do not know whether work is delayed and suppliers do not know who to speak to. A continuity plan should make the communication chain obvious.

Start with a contact list that includes:

• staff and contractors
• key customers
• suppliers and couriers
• landlord or managing agent
• insurer
• IT support or software providers
• accountant or payroll provider
• bank or finance contact, if relevant

Keep this information offline as well as in the cloud. If your email system is down, the plan is no good if the only copy of the phone list is in that same system.

It also helps to prepare short message templates in advance. For example:

• Temporary closure: “We are currently dealing with a disruption at our premises and will update you as soon as possible. If your matter is urgent, please contact [name and number].”
• Service delay: “We are experiencing a temporary delay to normal service and expect to resume by [time/date]. We will keep you informed and contact you directly if your job is affected.”
• Alternative arrangements: “We are working from an alternative location and can still be reached on [phone/email]. Please use this contact while we restore normal operations.”

Keep internal communication and customer messaging separate, even if they are based on the same facts. Staff may need fuller detail about what happened and what they should do next. Customers need clarity, reassurance and realistic timing. Consistency matters because mixed messages waste time and create doubt.

Build practical backups for systems, files and working locations

Backups are often talked about as if they are a technical issue alone, but continuity depends on access, not just storage. It is not enough to have a backup somewhere. You need to know that people can reach it, restore it and use it when necessary.

Basic preparations usually include:

• regular data backups
• a password manager or secure method for storing essential credentials
• cloud access that does not depend on one device
• spare laptops, phones or tablets for critical users where justified
• remote working arrangements for staff who can operate away from the office
• alternative premises or a shared workspace option if the site becomes unusable

If you use technical terms in the plan, keep them simple. A recovery time objective means how quickly a system or process needs to be restored after an incident. A recovery point objective means how much recent data you can afford to lose, measured by the last usable backup. For example, if you can only tolerate losing a few hours of records, your backup routine needs to reflect that.

What matters most is testing. A backup that nobody has tried to restore is only a hope. Make sure at least one person knows how to get access, what the login process is and where the restoration instructions are kept. If an external provider manages your systems, confirm how you would reach them outside normal hours and what support is included.

A practical continuity plan also covers working from elsewhere. That may be as simple as knowing which staff can switch to home working and what they need to do it effectively. For customer-facing firms, it may mean having a second phone line, diverting calls or using a shared booking system that can be accessed from anywhere.

Protect the financial side of continuity

Disruption is not only an operational problem. It has cash-flow consequences. You may have delayed invoices, emergency purchases, overtime costs, replacement equipment expenses or several days of lost trading. Small companies often feel these effects quickly because there is less spare cash in the system.

Your continuity plan should therefore check the financial basics:

• who can access the business bank account
• what payment approvals can be made in an emergency
• what spending limits apply to temporary fixes
• which invoices might be delayed if staff are diverted
• whether there is any emergency reserve or overdraft facility

It is also sensible to review insurance alongside continuity planning. Insurance and continuity do different jobs. Insurance may help with some financial losses, but it does not keep the work moving, reassure customers or replace lost time. A continuity plan helps you reduce the scale of the interruption, while insurance helps manage some of the cost. One does not replace the other.

GOV.UK notes that businesses may need insurance depending on what they do, and limited companies may have other responsibilities around records, accounts and tax returns. Those details sit alongside continuity planning rather than inside it, but they matter because disruption often exposes weak processes. GOV.UK — Set up a limited company

Create a short recovery checklist for the first 24 hours and the first week

A continuity plan becomes much more useful when it turns into a checklist. The checklist should not be long. It should cover the actions people are most likely to forget when they are under pressure.

First 24 hours

1. Check everyone is safe.
2. Confirm what has happened and what is affected.
3. Activate the continuity plan and tell the named decision-maker.
4. Contact staff, customers and suppliers with the agreed message.
5. Restore the minimum working setup: systems, phones, files or temporary workspace.
6. Protect evidence if the incident needs investigation.
7. Record immediate costs, delays and decisions.

First week

1. Stabilise critical operations.
2. Review whether work can continue from the normal location or needs an alternative.
3. Check outstanding supplier and staff issues.
4. Follow up customers with revised timing where needed.
5. Review financial impact and insurance steps.
6. Note what failed in the plan and what needs changing.

Here is a simple example. A two-person design agency loses office access after a burst pipe. The first hour is about safety and confirming the closure. The next step is to move to remote working, contact clients with revised timing and use cloud files to continue urgent jobs. By day two, the owner may need to arrange a temporary desk space, confirm equipment recovery and make sure invoices still go out. That is a lean plan in action: no drama, just a sequence that keeps work moving.

A local trades firm would handle the same type of disruption differently. If vehicles, tools or stock are affected, the early focus is on job rescheduling, customer calls and replacement access to essential equipment. The shape of the plan changes, but the logic does not: protect people, preserve revenue and make the next decision quickly.

Test the plan and keep it updated

A continuity plan does not stay useful by being filed away. It needs occasional testing and regular review, especially after changes in the business. New software, new premises, a new supplier, a changed phone system or a new employee can all make an existing plan incomplete.

Simple tests work best for small companies. You do not need an elaborate exercise. Try one of these:

• a tabletop discussion, where the team talks through a disruption scenario step by step
• a staff walkthrough of how to contact key people and access essential files
• a short test of remote access, backups or call forwarding
• a review after any actual incident, even a minor one

Use the test to ask practical questions. Did the right person receive the alert? Could the deputy find the contact list? Was the backup actually restorable? Did the customer message sound clear? If the answer is no, fix the weakness before it matters.

As a rule, a continuity plan becomes outdated when it lives in a folder no one opens. Keep it short enough that people can find and use it. Review it after major business changes and at least whenever your working arrangements, systems or suppliers change in a meaningful way.

Keep the plan lean enough to use

The biggest mistake small companies make is overcomplicating continuity planning. A thick document may look reassuring, but if it is too detailed for staff to follow, it will not help when something goes wrong. A lean plan, by contrast, is easier to update, easier to share and more likely to be used.

A good small-company continuity plan usually contains just a few core elements:

• the critical activities you cannot stop for long
• the people responsible for decisions and cover
• the first response for the most likely disruptions
• the key contact list
• backup arrangements for systems, files and working space
• a short recovery checklist
• a review date

If you need to make one choice this week, make it the choice to write the plan down. A continuity plan that exists only in your head disappears the moment you are not available. A one-page summary, supported by a few short procedures and contact details, is usually enough to start.

Next step: write a one-page continuity summary, list your critical processes, name the people responsible for each response and test one disruption scenario this month so you know the plan works before you need it.

Related articles

Why Business Directories Still Matter for UK Businesses

For UK businesses, being easy to find online can make a real difference. A well-maintained business directory listing can improve visibility, help customers verify company information and create another route to a business website. This article looks at why business directories still matter and how they can support local discovery, trust and long-term online presence.

25 October 2026 · 8 min read

How to manage business expenses more effectively

Business expenses become harder to control when spending is spread across cards, bank accounts, subscriptions and ad hoc purchases. A better system starts with clear rules, immediate record-keeping and regular category reviews, so you can see what is allowed, what is drifting and what needs action.

23 October 2026 · 11 min read

What financial reports should a small business owner review monthly?

A monthly review should do more than confirm the bank balance. The right report pack shows whether you are profitable, collecting cash, meeting what you owe and spotting problems early enough to act.

22 October 2026 · 13 min read

How to create a monthly management report for a small business

A monthly management report should help you make decisions, not just file numbers away. This guide shows how to build a short, repeatable report with the figures, commentary and actions that matter for a small business.

21 October 2026 · 11 min read

How to calculate profit margin for a service business

Service businesses can look busy and still fail to earn enough once subcontractors, software, travel, admin time and overheads are counted. This guide shows how to calculate gross and net profit margin properly so you can price work, plan staffing and judge whether growth is actually improving profit.

19 October 2026 · 11 min read

How to Price Services for a Small Business in the UK

A service price should do more than beat a competitor’s quote. It needs to cover your real costs, reflect the value you provide and leave enough margin to run the business properly. Here is a practical way to build prices that make sense and are easier to explain to customers.

18 October 2026 · 13 min read