Business continuity planning for small businesses: preparing for fires, floods, cyber attacks and supplier failures

Small businesses are vulnerable to disruption. A fire in the workshop, a flood, a cyber attack that locks up the accounting system, the failure of a key supplier, the sudden illness of the owner or a pandemic that closes premises can stop a business overnight. Businesses built over decades have collapsed within months when crises struck and they were unprepared.

The pandemic years taught many owners that adaptability is success in a time of crisis. Businesses that had thought about continuity, with backups, flexible working arrangements, cash buffers and alternative suppliers, adjusted faster. Those that had not scrambled, and some did not survive.

A business continuity plan sets out how your business will keep operating, or recover quickly, when something goes wrong. It need not be long or complicated. This article explains how small businesses can build a practical plan: identifying risks, determining critical functions, setting recovery targets, preparing people, cash, systems and suppliers, communicating during a crisis and testing the plan. Business.gov.au also publishes free guidance and templates.

Step 1: Identify the risks

List the events that could seriously disrupt your business. Common ones include:

• Fire, which can destroy premises, equipment, stock and records.
• Flood, storm and bushfire, depending on your location.
• Power and internet outages.
• Cyber attacks: ransomware, email compromise and data breaches.
• Equipment failure, especially of a critical machine with long repair lead times.
• Supplier failure or supply chain disruption.
• Loss of a key customer.
• Loss of key people, including the owner, through illness, injury or departure.
• Pandemics and public health restrictions.
• Theft and vandalism.

For each risk, consider:

• Likelihood: how probable is it?
• Impact: how badly would it affect the business?

A simple matrix helps prioritise. Risks that are both likely and severe deserve the most attention.

Step 2: Identify your critical functions

A business impact analysis asks which activities the business cannot do without, and for how long.

For each key function, such as taking orders, production, delivery, invoicing, payroll, customer support and supplier payments, ask:

• What happens if it stops for a day, a week or a month?
• What does it depend on: people, equipment, systems, premises, suppliers or information?
• What is the maximum tolerable downtime before the damage becomes severe?

Then set a recovery time objective: the target time to restore each critical function. Payroll may need to run within days. A non-critical internal project could wait for weeks.

Step 3: Develop continuity strategies

For each critical function and major risk, decide how you will reduce the risk or respond if it happens.

Premises

• Could staff work from home or another location temporarily?
• Is there a nearby business that could provide temporary space or machine time?
• Is insurance adequate, including business interruption cover that pays for lost profit and continuing expenses while you recover?

Equipment

• Which machines are critical, and what would happen if they failed?
• Keep critical spare parts on hand where lead times are long.
• Arrange service agreements with response time commitments.
• Identify subcontractors who could do critical work if your equipment is down.

Information and systems

• Back up data regularly, keeping at least one copy offline or in a separate location so ransomware or a fire cannot destroy all copies.
• Test restoring backups. A backup that cannot be restored is useless.
• Use cloud-based systems where appropriate, so access does not depend on one office.
• Protect systems with multi-factor authentication, updates and staff training. The article on cyber security basics for small businesses explains the essentials.
• Keep copies of critical documents, such as insurance policies, key contracts, supplier and customer contacts, and drawings, accessible offsite.

Suppliers

• Identify single-source suppliers of critical items.
• Develop alternative suppliers, even if you use them only occasionally.
• Hold extra stock of critical items where supply is risky.
• Ask key suppliers about their own continuity plans.

People

• Cross-train staff so that critical tasks do not depend on one person.
• Document key processes, so others can follow them.
• Plan for the owner’s absence: who can make decisions, sign payments and talk to customers? Keep powers of attorney, bank authorities and succession arrangements current.
• Keep emergency contact details for all staff.

Cash

A crisis often hits cash hardest. Revenue stops while costs continue.

• Build a cash reserve covering several months of essential costs where possible.
• Know your cash runway: how long could you survive with reduced revenue?
• Keep open lines of credit arranged before you need them.
• Match outflows to inflows as closely as possible. In a crisis, ask suppliers, landlords and lenders for concessions early. If you don’t ask, you won’t get them.
• Focus on collecting debts promptly.

The article on steering a small business through a downturn covers cash management in difficult periods in detail.

Step 4: Plan the emergency response

When an incident happens, the first hours matter. Document:

• Immediate safety actions: evacuation, first aid and emergency services contacts.
• Who is in charge, and who deputises.
• How to assess the damage and decide which continuity strategies to activate.
• Key contacts: insurers, landlord, utilities, IT support, bank, accountant, key suppliers and customers.

Work health and safety obligations require emergency plans for workplaces, so your emergency response should align with your existing safety procedures.

Step 5: Plan communication

In a crisis, people need clear, timely information:

• Staff: what has happened, whether and where to work, and how they will be paid.
• Customers: the impact on their orders, expected timelines and alternatives.
• Suppliers: changes to orders and payments.
• Lenders and insurers: notify them early.
• The public, if relevant: website and social media updates.

Prepare template messages in advance. Honest, early communication preserves trust, even when the news is bad.

Step 6: Lead people through the crisis

A crisis tests leadership. Lessons from business owners who led teams through pandemic lockdowns include:

• Understand people’s situations, motivations and expectations. Some staff may be caring for family, worried about their jobs or struggling with isolation.
• Treat team members as if they were volunteers, who stay because they choose to.
• Listen to understand, not just to reply.
• Be clear on direction and outcomes, and give clear milestones.
• Recognise effort, and catch people doing things right.
• Recognise the emotional bond. People remember how they were treated in hard times.
• Make yourself dispensable by building succession at every level.
• End meetings on a positive, constructive note.

Staffing options

When revenue falls, consider options before redundancies, such as pausing hiring, realigning people to more relevant roles, deferring discretionary spending and, by agreement, temporarily changing hours. In Australia, changes to employees’ hours, pay, duties or location generally must comply with the Fair Work Act, applicable awards and employment contracts, and may require consultation and agreement. Get advice before making changes.

Working remotely in a crisis

If staff must work remotely:

• Expect accountability rather than constant availability.
• Set clear expectations, ownership and timelines.
• Use a daily rhythm: what was planned, completed, delayed and carried forward.
• Send pre-reading for meetings, record decisions and actions, and include quieter voices.
• Give feedback individually rather than expressing frustration in group channels.

The article on managing remote and hybrid teams expands on this.

Step 7: Test, review and update

A plan that has never been tested will have gaps. Test it:

• Tabletop exercises: walk through a scenario, such as “the factory is flooded overnight” or “ransomware has encrypted our server”, with your team, and see what is missing.
• Restore tests of backups.
• Call trees: check contact details work.

Review the plan at least annually and after any significant change, such as new premises, systems, key staff or major customers.

Recovering after the event

Continuity planning does not end once operations resume. After any significant disruption:

• Document what happened: timeline, decisions, costs and impact on customers.
• Review what worked and what did not. Which parts of the plan helped? Where were the gaps?
• Thank the people involved, internally and externally. Customers, suppliers and staff who helped through a crisis deserve recognition.
• Lodge insurance claims promptly, keeping records of costs and losses.
• Update the plan with the lessons learned.
• Look for opportunities. Crises often reveal better ways of working, such as more flexible arrangements, better systems or stronger supplier relationships, worth keeping.

Many businesses emerge from a well-managed crisis with stronger customer loyalty, because customers remember who kept their promises when times were hard.

A one-page plan for very small businesses

Even a sole trader or small team benefits from a one-page summary:

A worked example

A precision engineering business in Newcastle with 22 staff depends on two five-axis CNC machines and a single server holding its CAD files and job records. The owner works through a continuity plan.

The risk assessment identifies flooding (the industrial estate flooded a decade ago), machine failure, ransomware and the owner’s absence as top risks. The business impact analysis shows that losing the CNC machines would halt most production, and losing CAD files would be catastrophic.

The business:

• moves CAD files and job records to a cloud system with automatic offsite backups, and tests a full restore;
• signs a service agreement with a 48-hour response time for the CNC machines and keeps critical spare parts on hand;
• arranges subcontracting with two other machine shops for emergencies;
• relocates its server room and critical spares above historic flood levels;
• cross-trains a second programmer and documents key processes;
• appoints the production manager as deputy with authority to approve payments up to a limit;
• reviews insurance and adds business interruption cover;
• builds a cash reserve of three months’ fixed costs over two years.

Eighteen months later, a spindle failure stops one CNC machine for three weeks. Critical work goes to a subcontractor, other jobs are resequenced and customers are informed promptly. No major customer is lost.

Common mistakes

• Thinking “it won’t happen to us”.
• Planning only for property damage, ignoring cyber attacks, supplier failure and key people.
• Never testing backups.
• Underinsuring, or lacking business interruption cover.
• Keeping the plan only in the owner’s head.
• Writing a plan and never updating it.

Frequently asked questions

How long should a continuity plan be? As long as it needs to be, and no longer. For many small businesses, a few pages plus contact lists and procedures are enough.

Is business interruption insurance worth it? For many businesses, yes, because it can cover lost profit and ongoing expenses while you recover. Read the policy carefully, including waiting periods, indemnity periods and exclusions, and discuss it with your insurance broker.

Who should be involved? The owner and key staff from each critical function. People who do the work often know the vulnerabilities best.

Do customers care whether we have a plan? Increasingly, yes. Larger customers, particularly in mining, defence, health and government supply chains, often ask suppliers about business continuity, cyber security and alternative supply arrangements during tenders and supplier audits. A documented, tested plan can be a competitive advantage as well as a safeguard.

Where should the plan be kept? Somewhere accessible when your premises or systems are not: a printed copy at home for key people, and a copy in a secure cloud location. A plan stored only on the server that has just failed will not help.

Summary

Disruption can strike any business. Identify likely and severe risks, determine your critical functions and how long each can be down, and set recovery targets. Prepare continuity strategies for premises, equipment, data, suppliers, people and cash, including tested backups, alternative suppliers, cross-training, adequate insurance and a cash reserve. Plan the emergency response and communication with staff, customers, suppliers and lenders. Lead people with care during a crisis and stay within employment law. Test the plan with realistic scenarios and review it regularly.

---

Sources: small-business training notes on business methods during the pandemic, covering business continuity, people strategy, remote work and cost management, together with general Australian business continuity practice. Examples are illustrations. This article is general information, not legal or insurance advice.