Business continuity plan: what it is, an example and how to write one

In short: A business continuity plan is a written plan for keeping your business trading and protecting your revenue when something serious stops it: a fire, a flood, an IT failure or a key person off sick. It sets out who is in charge, what must restart first and what you tell your customers, so they stay with you rather than turning to a competitor. Use our free business continuity action card so your team knows who does what on the day.

Written by Mike Armstrong, a company director of over 30 years. Last reviewed: 20 October 2026.

When I was Deputy Director of Operations for a maritime security company in Sri Lanka, our office building caught fire. We had several security teams on ships in different parts of the Indian Ocean, and they still needed us. I ran out of the building with my laptop and a grab bag (go bag) I kept for just such an occasion. I looked after that bag myself, so I knew exactly what was in it: power banks to keep the laptop running, and even a spare phone. We also had a business continuity plan, and there was a written copy of it stored in the building next door, should I need it. So I grabbed a camping chair, sat outside the building opposite and watched the fire crews do their thing. It was absolutely fine. That is the whole point of a plan: when the worst happens, nobody is making it up as they go.

Let's come ashore and look at something closer to home: a small business on the morning it all goes wrong.

It's 6am on a Tuesday and a pipe has burst above the office. Water is coming through the ceiling onto the server, the phones are dead and the first customer is due at nine. Somebody needs to turn the water off. Dave knows where the stopcock (the main water shut-off valve) is. Dave always knows where everything is. Dave is on a beach in Spain with his phone switched off.

By the time anyone finds the stopcock, the morning has gone, nobody has told the customers, and two of them have already rung a competitor. None of it was bad luck. It was simply nobody having written down who does what when the normal day stops working.

That's what a business continuity plan is for. On this Learn page you'll find out what one is and what it isn't, see a short example, learn how to write your own in seven steps, and how to test it so it works on the day. You'll also find a free action card to start with.

What is a business continuity plan?

A business continuity plan is a written plan that says how a business will keep its most important work going, or get it back quickly, when something serious disrupts it.

It is not a list of every disaster that could happen. That list never ends, and somewhere near the bottom is a swarm of bees in the server room. It starts from the other end: what your customers need from you, how long you can go without delivering it before you start losing them, and what you will do to keep it going. A fire, a flood, a cyber attack and a supplier going bust all end in the same few problems: no premises, no IT, no people or no supplies. Plan for those, and you have planned for much of what could hit you.

Plenty of small businesses still haven't done it. In the UK government's Cyber Security Breaches Survey 2025, 53% of small businesses had a business continuity plan that covers cyber security, up from 44% the year before. That leaves almost half without one.

It helps to be clear early on how a continuity plan differs from two plans people often mix it up with.

Business continuity plan vs disaster recovery plan vs emergency procedures

All three matter, and they work together, but they do different jobs.

Your continuity plan doesn't replace your emergency procedures; nobody should be reading a business plan while the fire alarm is going off. It simply notes where they are kept. A disaster recovery plan, if you have one, sits inside the continuity plan as the part that deals with IT.

So what actually goes into a continuity plan? Less than you might fear.

What goes into a business continuity plan

A good small business plan answers a handful of plain questions:

• Who is in charge? A named person to lead the response, with a deputy, plus people to speak to customers, the media and staff.
• What must keep running, and how soon? Your critical activities, in priority order, with how quickly each must be running again.
• What could stop you, and what is your back-up? For loss of premises, IT, key people, a key supplier and power.
• What happens in the first hour and the first day? Short checklists, so nobody has to think under pressure.
• What do you tell customers? A holding message written in advance, and who sends it.
• Who do you call? Staff, insurer, landlord, IT support, utilities, key suppliers and emergency trades.
• Where is everything? An emergency pack kept away from the premises, with a copy of the plan in it.
• How do you know it works? A test once a year, and a review after any incident or big change.

That's the theory. Here's what it looks like for a real kind of business.

A business continuity plan example

This short example follows a kitchen fitting company with ten staff, one workshop and two vans. It planned for a fire in the workshop, and then it happened.

Notice how little of it is about the fire itself. Almost every line is about keeping customers served and money coming in. That is what makes it a continuity plan rather than an emergency procedure. The full example, with every section filled in, is inside our business continuity plan template.

Now let's build yours.

How to write a business continuity plan in seven steps

Set aside an afternoon, get the two or three people who know the business best round a table, and work through these steps in order.

1. Decide who is in charge

Name one person to lead the response: the designated person in charge. Then name a deputy who automatically takes over if that person isn't there, so nobody waits for permission. This is standard practice in emergency planning. A plan that says "the boss is in charge" while the boss is halfway up a mountain with no signal is really a plan that says nobody is in charge. Add who speaks to customers, who speaks to the media and who looks after staff. Agree how much the leader can spend without asking anyone, so nothing stalls on the day waiting for a signature.

2. Work out what must keep running, and how soon

List the work that brings the money in and keeps customers happy, then put it in order. For each one, decide how quickly it must be running again before you start losing customers or money: two hours, two days, a week. For many small businesses the top three are answering the phone, delivering what was promised this week, and getting paid. Getting paid tends to be everyone's favourite.

3. Find what could stop you, and plan a back-up

Think about loss of premises, IT, key people, a key supplier and power. For each, write down the back-up: working from home, a second supplier, a partner business that could help, a colleague trained to cover. If you already keep a risk register, its High risks are your starting point. If you don't, our Learn page on how to create a risk register shows you how.

4. Plan the first hour and the first day

Write two short checklists. The first hour: everyone safe and accounted for, emergency services called if needed, the leader told, the premises secured once it is safe, phones diverted and customers told. The first day: critical work restarted in order, back-ups switched on, the insurer told and every decision and cost written down.

5. Write your customer and media messages now

Customers tend to forgive a problem far more readily than silence. Silence lets them imagine the worst, and their imagination is usually worse than your burst pipe. Write a short holding message in advance: what has happened, what you are doing, when you will update them, and who to call. If your business could attract the media, write a brief holding statement too, and name the one person allowed to give it.

6. Gather the contacts and build an emergency pack

Collect every number you would need: staff, insurer, landlord, IT support, utilities, key suppliers, a locksmith and a glazier. Put a printed copy of the plan and the contacts somewhere away from your premises. If your plan lives in a binder in the office that is now on fire, it isn't a plan. It's kindling.

7. Test it, and keep it up to date

A plan nobody has tried is a guess. Test it at least once a year (the next section shows how), and review it after any incident or big change, such as a new building, a new key supplier or a key person leaving.

Writing the plan is half the job. Testing it is the half that makes it work.

How to test a business continuity plan

The UK government's guide Expecting the unexpected describes three kinds of test, and a small business can do the first two in an hour:

• A table-top exercise. Sit round a table, pick a scenario (the building is closed for a week, the main supplier has gone bust) and talk through the plan step by step. Gaps show up fast.
• A call-out test. Without warning, ring down your call-out list and time how long it takes to reach everyone. Wrong numbers show up before you need them, including the one that now belongs to a pizza takeaway.
• A full rehearsal. Actually move work to the back-up arrangement for a day. It costs more time, so many small businesses save it for their highest risk.

Write down what you tested, what you found and what you changed. That record shows a customer or insurer that the plan is live, not filed.

Does ISO 9001 require a business continuity plan?

No, not by name. ISO 9001:2026 does not ask for a business continuity plan. It does ask you to tell customers about your contingency actions when that matters to them, including when supply is disrupted (clause 8.2.1), and a note to clause 6.1.2 says the risks you plan for can include delivering during and after a disruption. A short continuity plan with ready-made customer messages is a simple way to show both. If you are working towards ISO 9001, our ISO 9001:2026 Certification-Ready System covers the whole standard.

What we've covered

A business continuity plan keeps you trading when something serious goes wrong. It names who is in charge, puts your critical work in order, sets out a back-up for each likely disruption, gives you first-hour and first-day checklists and a message for customers, and keeps a copy away from the building. Test it once a year and it will work on the day you need it.

What next

• Start free: print the business continuity action card and fill it in this week.
• Get the full plan: the Business Continuity Plan Template gives you every section in Word, with checklists, customer and media messages, contact tables and the worked example to copy.

Business continuity plan FAQ

What does a business continuity plan mean?

It means a written plan for keeping a business running, or getting it running again quickly, when something serious stops it. It covers who leads, what must restart first, the back-up for each likely disruption, and what customers are told.

Why do you need a business continuity plan?

Because when something goes wrong, the damage usually comes less from the event itself than from the confusion afterwards. A plan means people know who is in charge and what to do, customers hear from you before they go elsewhere, and you are back to normal sooner. Customers, tenders and insurers may also ask to see one.

What is RTO in a business continuity plan?

RTO stands for recovery time objective: how quickly an activity must be running again after a disruption before the damage becomes serious. In plain terms, it is the "must be running again within" time you set for each critical activity, such as two hours for answering customer calls.

How often should a business continuity plan be tested?

At least once a year, and after any incident or big change, such as moving premises or losing a key supplier. A table-top exercise and a call-out test each take about an hour.

Is a business continuity plan the same as a disaster recovery plan?

No. A disaster recovery plan gets your IT systems and data back. A business continuity plan is wider: it keeps the whole business going, including people, premises, suppliers and customers. The disaster recovery plan usually sits inside it.

Do I need a risk assessment before writing a business continuity plan?

It helps, but you don't need a formal one. Knowing your main risks tells you which disruptions to plan a back-up for. If you keep a risk register, start with its High risks.

Is there a business continuity plan PDF I can print?

Yes. The free business continuity action card prints on two pages, and the page has a print button. For a full plan you can edit, the template is a Word file, which you can save as a PDF from Word.

Is there a business continuity plan example or sample I can follow?

Yes. The example on this page follows a kitchen fitting company with ten staff whose workshop caught fire. It shows the company’s critical activities, who led, its first hour, what it told customers, and which back-up arrangements worked. Copy the pattern for your own business. The Business Continuity Plan Template includes the full example, with every section filled in.

About the author

Written by Mike Armstrong, senior ISO consultant, former company director, and founder of Plain Standards. In over 30 years running companies at director level, Mike built his own management systems to drive profit long before he adopted ISO 9001, so he comes at this from the owner's side, not the auditor's. Plain Standards helps small and medium sized businesses get ISO certified without a consultant.