Business continuity plan checklist for small firms

A business continuity plan is a brief written document that shows your staff how to keep the most important work running when something goes wrong. A fire, a flood, a power cut, a lost laptop or a supplier that stops delivering can all stop a small firm. A plan written now costs a few hours. Making it up in the middle of a crisis costs far more.

Use the checklist below. It works for a firm of five people or fifty. Print it, fill it in, and keep a copy away from the office.

Step 1: List the work you cannot stop

Start with a simple question. If the office closed tomorrow, which tasks would hurt customers or cash flow first? Write those down. Most small firms find the list is short: taking orders, delivering the service, sending invoices, paying staff and answering customers.

For each task, note three things. Who does it? What do they need to do it, such as a laptop, software, a phone line or a key supplier? And how long can the task stop before real harm is done: one hour, one day or one week? The answer to the last question tells you what to fix first.

This step is what standards call a business impact analysis. ISO 22301, the international standard for business continuity management systems, published in 2012, asks organisations of any size to do it. Your version can fit on one page.

Sources: ISO 22301:2012, Societal security, Business continuity management systems, Requirements (iso.org/standard/50038.html).

Step 2: Check what could stop you

Next, list the events that could interrupt those tasks. Keep the list plain and local. Think of fire, flood, a long power cut, a failed computer, a lost internet link, illness among key staff, and a supplier or landlord problem.

Then ask two quick questions for each one. How likely is it? How badly would it hurt? Spend your time on the events that score high on both. You do not need a complex chart. A simple high, medium and low rating is enough to decide where to start.

Singapore published its own business continuity standard, SS 540:2008. It set out requirements for readiness to respond to and recover from events that disrupt normal work, including risks that come from the nature of the business, the outside environment and regulation. It has since been replaced by SS ISO 22301:2012, the local version of the ISO standard. Those three sources of risk are still a good way to check that your list has no big gaps.

Source: Singapore Standards eShop, SS 540:2008, Singapore Standard for business continuity management, listed as replaced by SS ISO 22301:2012 (singaporestandardseshop.sg).

Step 3: Protect your records and equipment

Most small firms are hurt more by lost information than by lost furniture. Customer lists, contracts, bank details and accounts files must exist in more than one place.

Back up important files on a set schedule, and keep one copy away from the office.
Keep paper records that matter, such as signed contracts and licences, scanned or copied elsewhere.
Write down logins for key systems and store them in a safe place that more than one trusted person can reach.
Note which equipment is hard to replace and how long a replacement would take.
Check that your insurance covers the events on your list, and keep the policy numbers with the plan.

Test one backup each quarter. Open a file from the copy. A backup you have never opened is only a hope.

Sources: U.S. Department of Homeland Security, Ready Business planning pages, which advise keeping contact lists and important records at an off-site location (ready.gov/business).

Step 4: Write your contact list and a place to work

When trouble hits, people need to know who to call. Build one contact sheet with staff mobile numbers, a backup person for each key role, your landlord, your internet and phone providers, your bank, your insurer and your main suppliers and customers. Give each person a printed copy and keep another off site.

Decide, too, where work would happen if the office could not be used. Options include staff working from home, a shared office on short notice, or an agreement with a friendly firm nearby. The Ready Business pages suggest firms consider running the business from a different location or from home, and building relationships with other companies so they can use those firms' space if their own site becomes unusable.

Agree on how you will tell staff and customers what is happening. One person should speak for the firm. Short, honest messages sent early build more trust than long ones sent late.

Sources: U.S. Department of Homeland Security, Ready Business, planning pages on alternate locations and contact lists (ready.gov/business).

Step 5: Test it, then keep it fresh

A plan nobody has tried will fail when it is needed. Once or twice a year, sit the team down for an hour. Give them a simple story, such as "the office is closed for a week from tomorrow", and walk through the plan step by step. Note what was missing and fix it the same week.

Update the plan whenever staff, suppliers, software or premises change. Put a date on each version so everyone knows which one is current.

The Business Continuity Institute's Good Practice Guidelines, 2018 edition, set out six professional practices for the work: setting up the programme, embedding business continuity in the firm's culture, analysis, designing solutions, putting those solutions in place, and validation, which means testing. Your checklist covers the same ground in miniature, and the last step is the one most firms skip.

Source: Business Continuity Institute, Good Practice Guidelines 2018 Edition (thebci.org).

One-page summary

List the tasks that cannot stop, who does them and how long each can wait.
List the events that could stop them and rank each as high, medium or low.
Back up records, keep a copy off site and test a restore.
Write a contact sheet and name a backup place to work.
Test the plan, fix gaps and update it when things change.

This article is general information, not legal or insurance advice. Ask your insurer or adviser how these steps apply to your firm.

Sources

ISO 22301:2012, Societal security, Business continuity management systems, Requirements: iso.org/standard/50038.html
Singapore Standards eShop, SS 540:2008, Singapore Standard for business continuity management, replaced by SS ISO 22301:2012: singaporestandardseshop.sg
Business Continuity Institute, Good Practice Guidelines 2018 Edition: thebci.org
U.S. Department of Homeland Security, Ready Business: ready.gov/business