Most business owners insure their buildings, vehicles, equipment and other physical assets.
Far fewer adequately insure the continuity of the business itself.
That distinction matters.
A fire can destroy premises. A cyberattack can disable systems. A key supplier can fail. A major customer can disappear. A critical employee can become unavailable. A flood, storm or power failure can shut down operations. A serious accident can remove an owner from the business overnight.
Sometimes the disruption is external.
Sometimes it comes from inside the organisation.
And sometimes the event nobody considered possible becomes the event that changes everything.
The central question is therefore not:
“Could something go wrong?”
Something eventually will.
The more useful question is:
“If something serious happens tomorrow, how quickly can our business continue delivering its most critical products and services, protecting its people and cash flow, communicating with stakeholders and returning to normal operations?”
That is the purpose of business continuity planning.
For small-to-medium businesses, it is not corporate bureaucracy. It is a fundamental component of risk management, governance, strategy and business resilience.
Table of Contents
- What Is Business Continuity Planning?
- Business Continuity Is Not the Same as Disaster Recovery
- Why SMEs Are Particularly Vulnerable to Disruption
- Start by Identifying What Could Seriously Hurt the Business
- Conduct a Business Impact Analysis
- Identify Your Critical Business Functions
- Understand Your Maximum Tolerable Downtime
- Identify Single Points of Failure
- Key-Person and Owner Dependency Risk
- Technology, Cybersecurity and Data Recovery
- Supplier and Supply-Chain Continuity
- Customer Concentration and Revenue Continuity
- Premises, Equipment and Infrastructure
- Cash Flow and Financial Resilience
- Build the Business Continuity Plan
- Crisis Management and Decision-Making
- Communication During a Crisis
- Test the Plan Before You Need It
- Business Continuity as a Governance Responsibility
- A Practical SME Business Continuity Framework
- Practical Recommendations
- Key Takeaways
- FAQs
- Conclusion
What Is Business Continuity Planning? (Business Strategy Perth)
Business continuity planning is the process of preparing an organisation to continue its critical operations during and following a significant disruption.
It asks:
- What could interrupt the business?
- Which activities are essential?
- How long could each activity be unavailable?
- What resources are required to continue operating?
- Who has authority to make decisions?
- What alternatives are available?
- How will employees, customers, suppliers and other stakeholders be contacted?
- How will systems and information be recovered?
- How will the organisation return to normal operations?
Australian Government guidance describes a business continuity plan as setting out how a business will operate following an incident or crisis and how it expects to return to “business as usual”. It recommends considering risks including natural disasters, fire, power or telecommunications failures, cyberattacks, supply-chain disruptions and the loss of key staff.
A good continuity plan is therefore much broader than having a backup copy of the accounting system.
It is a whole-of-business resilience plan.
Business Continuity Is Not the Same as Disaster Recovery (Business Advisor Perth)
The terms business continuity and disaster recovery are sometimes used interchangeably.
They are related, but different.
Business continuity asks:
How do we keep the critical parts of the organisation functioning during and after disruption?
Disaster recovery generally focuses more narrowly on restoring systems, infrastructure, data or facilities following an event.
For example, after a cyberattack:
A disaster-recovery plan might explain how IT systems and data will be restored.
A business-continuity plan should also address:
- how orders will be processed while systems are unavailable,
- how employees will work,
- how customers will be contacted,
- how suppliers will be managed,
- how payroll will operate,
- who will make decisions,
- how cash flow will be protected, and
- how essential services will continue.
You need both.
Restoring a server is not the same as restoring a business.
Why SMEs Are Particularly Vulnerable to Disruption (Business Strategy Perth)
Many SMEs are extraordinarily resilient.
They are also frequently highly concentrated.
A business may depend heavily on:
- one owner,
- one managing director,
- one salesperson,
- one technical specialist,
- one major customer,
- one supplier,
- one warehouse,
- one piece of equipment,
- one software platform,
- one bank facility, or
- one distribution channel.
Large organisations often have greater redundancy.
An SME may not.
That means what appears to be a relatively minor disruption can quickly become a strategic threat.
Consider an owner-managed company where only the owner:
- knows the banking passwords,
- approves payroll,
- holds key customer relationships,
- negotiates supplier contracts,
- understands pricing,
- knows the critical passwords,
- authorises significant expenditure, and
- understands how several essential processes actually work.
If that owner is suddenly unavailable for six weeks, does the business continue?
Or does decision-making effectively stop?
This is why business continuity is closely connected with business governance, succession, delegation, systems and leadership development.
Start by Identifying What Could Seriously Hurt the Business (Business Strategy Perth)
A continuity plan should begin with risk identification.
Do not start by downloading a generic template and filling in boxes.
Ask instead:
What events could materially interrupt our ability to operate?
Potential risks might include:
People
- death or serious illness of an owner,
- loss of a key executive,
- industrial action,
- widespread illness,
- inability to access the workplace,
- loss of specialist knowledge.
Technology
- cyberattack,
- ransomware,
- telecommunications failure,
- cloud-service outage,
- data corruption,
- hardware failure,
- loss of internet connectivity.
Physical assets
- fire,
- flood,
- storm,
- theft,
- equipment failure,
- vehicle loss,
- building damage.
Supply chain
- supplier insolvency,
- transport disruption,
- international shipping delays,
- geopolitical disruption,
- raw-material shortage,
- single-source dependency.
Customers
- loss of a major customer,
- customer insolvency,
- sudden demand collapse,
- reputational event.
Financial
- loss of banking facilities,
- cash-flow crisis,
- fraud,
- interest-rate shock,
- inability to access banking systems.
External environment
- natural disasters,
- utility failures,
- regulatory intervention,
- pandemic,
- civil disruption,
- extreme weather.
The objective is not to predict every conceivable disaster.
That is impossible.
The objective is to identify the events that could cause material interruption and ensure the organisation has the capability to respond.
Conduct a Business Impact Analysis (Business Improvement Perth)
Risk analysis asks:
What might happen?
A Business Impact Analysis, BIA, asks:
What happens to us if it does?
This is one of the most valuable elements of continuity planning.
For each critical activity, consider the consequences of disruption after:
- two hours,
- one day,
- three days,
- one week,
- two weeks,
- one month.
Consider the impact on:
- revenue,
- cash flow,
- customers,
- contracts,
- employees,
- suppliers,
- regulatory obligations,
- reputation,
- safety,
- data,
- operations.
A payroll system being unavailable for one hour may have little consequence.
Being unavailable on payday for several days could become a significant employee and operational problem.
A warehouse being inaccessible for an afternoon may be manageable.
Losing access for three months could threaten the viability of the business.
The BIA therefore forces management to distinguish between inconvenience and existential risk.
Identify Your Critical Business Functions (Business Strategy Perth)
Not everything needs to be restored simultaneously.
That is a fundamental principle of continuity planning.
Identify the activities without which the business cannot continue.
Depending on the organisation, these might include:
- customer enquiries,
- order processing,
- production,
- dispatch,
- transport,
- payroll,
- banking,
- invoicing,
- customer service,
- IT systems,
- inventory management,
- regulatory reporting,
- safety functions.
Then rank them.
A simple structure might be:
| Function | Criticality | Maximum Downtime | Workaround |
|---|---|---|---|
| Customer orders | Critical | 4 hours | Manual order process |
| Banking/payments | Critical | 24 hours | Alternate authorised users |
| Payroll | High | 2 days | External payroll access |
| Warehouse | Critical | 24 hours | Alternative facility |
| CRM | High | 1 day | Secure offline contact records |
| Marketing | Lower | 1 week | Temporarily suspend |
The specific numbers will differ enormously between businesses.
The value lies in forcing management to decide what must be restored first.
Understand Your Maximum Tolerable Downtime (Business Improvement Perth)
Every critical function has a point beyond which interruption becomes unacceptable.
Ask:
How long can we realistically survive without this function?
This is sometimes described as the Maximum Tolerable Period of Disruption.
Once you understand that timeframe, you can determine how quickly recovery needs to occur.
If customers can tolerate a two-day delay, you may have time.
If a critical production line cannot be unavailable for more than four hours without breaching major contracts, the continuity requirements are dramatically different.
This is where continuity planning becomes an economic exercise.
There is little point spending $500,000 protecting a function whose prolonged interruption would cost $20,000.
Equally, saving $20,000 by eliminating redundancy makes little sense if the resulting failure could cost $5 million.
Resilience is ultimately a capital-allocation decision.
Identify the Single Points of Failure (Business Strategy Perth)
One of the most useful questions an SME leadership team can ask is:
“What do we have only one of?”
One person?
One machine?
One supplier?
One warehouse?
One internet connection?
One customer?
One bank signatory?
One password administrator?
One server?
One source of specialist knowledge?
One transport provider?
These are single points of failure.
They do not automatically represent unacceptable risk.
But they should be visible, understood and consciously managed.
For every significant single point of failure, ask:
What happens if this disappears tomorrow?
Then determine whether to:
- eliminate the dependency,
- duplicate the resource,
- develop an alternative,
- transfer the risk through insurance,
- document a workaround, or
- consciously accept the risk.
This is exactly the type of strategic risk that should be considered within an effective strategic planning process.
Key-Person and Owner Dependency Risk (Leadership Development Perth)
For many SMEs, the greatest continuity risk walks through the front door every morning.
It is the owner.
The business may be overly dependent on one individual for:
- knowledge,
- customer relationships,
- supplier relationships,
- pricing decisions,
- technical expertise,
- approvals,
- banking,
- leadership,
- strategy.
Ask a confronting question:
If the owner could not return to work tomorrow, could the business operate effectively for the next three months?
If the answer is no, you have identified a significant business-continuity risk.
Solutions may include:
- documented delegations,
- additional bank signatories,
- documented procedures,
- password-management systems,
- customer relationship sharing,
- cross-training,
- succession plans,
- management development,
- key-person insurance,
- emergency powers of attorney and appropriate legal arrangements.
Reducing owner dependency also makes a business more scalable, more transferable and potentially more valuable.
Business continuity and succession planning are therefore closely related.
Technology, Cybersecurity and Data Recovery (Business Strategy Perth)
For many modern SMEs, losing access to technology can effectively mean losing access to the business.
Imagine arriving tomorrow morning and discovering:
- email does not work,
- customer records are inaccessible,
- accounting systems are offline,
- phones are unavailable,
- payroll information cannot be accessed,
- operational systems are encrypted,
- employees cannot log in.
How long could you operate?
The Australian Cyber Security Centre’s Essential Eight provides mitigation strategies designed to make it harder for cyber adversaries to compromise systems, including controls relating to patching, multi-factor authentication, application control and backups.
Continuity planning should consider:
- secure backups,
- offsite/cloud redundancy,
- backup testing,
- multi-factor authentication,
- cyber incident response,
- alternative communications,
- emergency access procedures,
- privileged-account management,
- third-party technology dependencies.
The most important backup question is not:
“Do we have backups?”
It is:
“When did we last prove that we can restore the business from them?”
A backup that cannot be restored is not a continuity solution.
Supplier and Supply-Chain Continuity (Business Strategy Perth)
A supplier’s problem can very quickly become your problem.
Identify:
- sole-source suppliers,
- strategically important suppliers,
- long lead-time items,
- imported components,
- difficult-to-substitute products,
- suppliers experiencing financial pressure.
Then ask:
If this supplier disappeared tomorrow, what would we do?
Possible responses include:
- secondary suppliers,
- dual sourcing,
- strategic inventory,
- substitute materials,
- local alternatives,
- framework agreements,
- contractual protections.
But resilience has a cost.
Holding additional inventory consumes working capital.
Using multiple suppliers may reduce volume discounts.
Alternative suppliers may charge more.
Continuity planning therefore involves balancing efficiency against resilience.
The cheapest supply chain is not necessarily the safest supply chain.
Customer Concentration Is Also a Continuity Risk (Business Advisor Perth)
Suppose one customer represents 45% of annual revenue.
Management may regard that customer as a major success.
From a continuity perspective, it is also a significant concentration risk.
Ask:
What happens if that customer disappears tomorrow?
Could the business:
- remain profitable,
- meet debt repayments,
- retain employees,
- meet lease commitments,
- continue paying suppliers?
Customer concentration should therefore form part of continuity planning.
The solution is not necessarily to walk away from large customers.
It is to understand the exposure and deliberately build resilience through:
- diversification,
- longer contracts,
- stronger relationships,
- broader service offerings,
- increased recurring revenue,
- appropriate cost flexibility,
- financial reserves.
Premises, Equipment and Infrastructure (Business Strategy Perth)
Many SMEs remain heavily dependent on physical assets.
Ask:
If we lost access to this building tonight, where would we operate tomorrow?
Consider:
- alternative premises,
- remote working,
- reciprocal arrangements,
- temporary warehousing,
- backup equipment,
- hire arrangements,
- alternative transport,
- generators,
- telecommunications redundancy.
For critical machinery, ask:
- What is the likely failure mode?
- How quickly can it be repaired?
- Are spare parts available?
- Is there alternative capacity?
- Can competitors or subcontractors temporarily assist?
Again, continuity planning is not about eliminating all risk.
It is about knowing the answer before the crisis.
Cash Flow Is Your Financial Continuity Plan (Business Improvement Perth)
A business can recover operationally from a disruption and still fail financially.
Suppose a crisis causes revenue to fall 30% for three months.
Wages continue.
Rent continues.
Debt repayments continue.
Insurance may take time to pay.
Customers may delay payments.
Emergency expenditure increases.
How much cash does the business have?
A robust continuity plan should therefore include financial scenarios.
Model:
- 10% revenue reduction,
- 20% reduction,
- 30% reduction,
- loss of the largest customer,
- one month without trading,
- three months of reduced activity.
Then calculate:
- cash burn,
- working-capital requirements,
- minimum liquidity,
- available banking facilities,
- debt-service requirements,
- break-even revenue,
- potential cost reductions.
This is closely connected with the principles addressed in finding the optimal debt level for your small-to-medium business.
Debt and liquidity that appear perfectly manageable during normal trading can become dangerous when cash flow suddenly contracts.
Cash reserves and undrawn borrowing capacity are not necessarily inefficient capital. They can represent strategic resilience.
Build the Business Continuity Plan (Business Strategy Perth)
Once the risks, impacts and priorities are understood, document the plan.
For an SME, the plan does not need to be 100 pages.
It needs to be usable under pressure.
A practical plan should include:
1. Activation Criteria
What events cause the plan to be activated?
2. Crisis Team
Who is responsible for managing the incident?
3. Authority
Who can make urgent financial, operational and people decisions?
4. Contact Details
Employees, customers, suppliers, insurers, banks, landlords, IT providers, emergency services and advisers.
5. Critical Functions
What must continue?
6. Recovery Priorities
What gets restored first?
7. Alternative Arrangements
Where and how will operations continue?
8. Technology Recovery
How will systems and data be restored?
9. Communications
Who communicates what, to whom and when?
10. Financial Response
How will cash and liquidity be managed?
11. Recovery
How will normal operations resume?
12. Review
What lessons will be captured afterwards?
Australian Government guidance provides a business continuity plan template covering risk management, incident response and recovery.
The template is useful.
But the thinking behind the plan is more important than the template itself.
Crisis Management, Who Is Actually in Charge? (Governance & Boards)
A crisis is a terrible time to debate authority.
Your continuity plan should clearly identify:
- crisis leader,
- deputy,
- operational lead,
- communications lead,
- IT/cyber lead,
- financial lead,
- people/safety lead.
In a small company, one person may perform several roles.
That is fine.
What matters is clarity.
The plan should also identify decision thresholds.
Who can authorise emergency expenditure?
Who can close a site?
Who speaks to the media?
Who contacts major customers?
Who can access emergency funds?
Who informs employees?
Strong business governance is particularly valuable during disruption because roles, authority and accountability have already been established before pressure escalates.
Communication Can Determine Whether a Crisis Becomes a Reputational Disaster (Leadership Development Perth)
During a disruption, stakeholders want answers.
Employees want to know:
Am I safe? Do I come to work? Will I be paid?
Customers want to know:
Will you deliver? When? What should I do?
Suppliers want to know:
Are you operating? Will we be paid?
Banks and insurers may require information.
Silence creates uncertainty.
Uncertainty creates speculation.
Your continuity plan should therefore contain communication protocols and current contact information.
Communication should generally be:
- fast,
- factual,
- consistent,
- appropriately transparent,
- regularly updated.
Do not speculate.
Do not promise what cannot be delivered.
And do not allow five different managers to provide five different explanations.
Test the Plan Before You Need It (Business Strategy Perth)
An untested continuity plan is an assumption.
Testing can be surprisingly simple.
Run a tabletop exercise:
“It is 7:30 Monday morning. A fire has made our premises inaccessible for at least four weeks. What do we do?”
Or:
“Our systems have been encrypted. Email, CRM and accounting are unavailable. What happens during the next four hours?”
Or:
“Our Managing Director has been hospitalised overseas and will be unavailable indefinitely. Who assumes authority?”
Walk through the response.
You will quickly discover:
- outdated telephone numbers,
- inaccessible passwords,
- unclear authority,
- missing backups,
- supplier dependencies,
- insurance uncertainties,
- undocumented processes.
That is good.
Finding weaknesses during an exercise is infinitely better than discovering them during the real event.
Test significant elements at least annually and whenever major changes occur.
Business Continuity Is a Governance Responsibility (Non-Executive Chairman Perth)
Business continuity should not sit forgotten in an administration folder.
For a business with a Board or advisory structure, continuity and resilience should form part of normal risk oversight.
The Board should periodically ask:
- What are our most significant continuity risks?
- What has changed?
- What are our single points of failure?
- When was the plan last tested?
- What did we learn?
- Are backups tested?
- Is insurance appropriate?
- Is liquidity adequate?
- Are key-person dependencies reducing?
- Are critical suppliers financially and operationally resilient?
An experienced independent Non-Executive Chairman Perth can play an important role in ensuring these questions are actually asked rather than postponed because today’s operational issues feel more urgent.
A Practical SME Business Continuity Framework (Business Strategy Perth)
A useful continuity framework can be summarised in eight stages:
1. IDENTIFY
What could seriously disrupt us?
2. PRIORITISE
Which business functions are genuinely critical?
3. QUANTIFY
What would interruption cost and how long can we tolerate it?
4. PROTECT
What preventative controls should we implement?
5. PREPARE
What alternatives and workarounds do we need?
6. RESPOND
Who does what when an incident occurs?
7. RECOVER
How do we restore normal operations?
8. LEARN
What should change after testing or a real incident?
Think of business continuity as a cycle rather than a document:
Identify → Prioritise → Protect → Prepare → Respond → Recover → Learn → Improve
Then repeat.
Practical Recommendations for SME Owners & Leaders (Business Strategy Perth)
If your business does not have a current continuity plan, start practically:
- Identify your five biggest disruption risks.
- List your genuinely critical business functions.
- Determine how long each can be unavailable.
- Identify every major single point of failure.
- Assess owner and key-person dependency.
- Verify backups and actually test restoration.
- Review critical suppliers and alternatives.
- Model the cash impact of a serious disruption.
- Document emergency authority and contact details.
- Review insurance with appropriately qualified advisers.
- Create a concise written continuity plan.
- Run a tabletop exercise and fix what fails.
- Review the plan annually and after significant business changes.
Do not aim for perfection before starting.
A practical 10-page plan that has been tested is considerably more valuable than a 100-page document nobody understands.
Key Takeaways (Business Strategy Perth)
- Business continuity planning is about keeping critical operations functioning during and after disruption.
- SMEs can be particularly vulnerable because resources, people, customers, suppliers and infrastructure are often concentrated.
- Business continuity is broader than IT disaster recovery.
- A Business Impact Analysis identifies which activities matter most and how quickly they must be restored.
- Single points of failure should be identified deliberately.
- Owner and key-person dependency can represent significant continuity risk.
- Cybersecurity, backups and tested recovery capability are essential.
- Supplier and customer concentration are strategic continuity risks.
- Cash reserves, insurance and access to liquidity are important components of resilience.
- Roles and decision-making authority should be established before a crisis.
- Communication can materially affect customer, employee and stakeholder confidence.
- A continuity plan should be tested, not merely written.
Frequently Asked Questions About Business Continuity Planning
What is a business continuity plan?
A business continuity plan documents how an organisation will maintain or restore critical operations during and following a significant disruption.
Does every small business need a business continuity plan?
The complexity will vary, but virtually every business should understand its major disruption risks, critical functions, key dependencies and emergency response arrangements.
What is the difference between business continuity and disaster recovery?
Business continuity addresses how the organisation continues operating. Disaster recovery typically focuses more specifically on restoring systems, data, infrastructure or facilities.
What should a business continuity plan contain?
It should normally address critical functions, risks, crisis roles, authority, contact details, alternative operating arrangements, technology recovery, communications, financial response and recovery procedures.
What is a Business Impact Analysis?
A BIA assesses the operational, financial, customer, legal and reputational consequences of losing important business functions for different periods.
How often should a business continuity plan be reviewed?
At least annually is a sensible starting point for many SMEs, as well as after significant organisational, technological, operational or supplier changes.
How often should a continuity plan be tested?
Critical components should be tested periodically. Annual tabletop testing can be a practical minimum for many SMEs, with more frequent testing where risks justify it.
Are data backups enough?
No. Backups are important, but continuity also involves people, customers, suppliers, premises, communications, cash flow, authority and alternative operating arrangements.
What is a single point of failure?
It is a person, system, supplier, asset or other resource whose failure could significantly disrupt operations because no adequate alternative exists.
How can an SME reduce key-person risk?
Document processes, delegate authority, cross-train employees, share customer relationships, establish succession arrangements and ensure essential information can be accessed appropriately by authorised people.
Should business continuity include cash-flow planning?
Absolutely. A business may recover operationally but fail financially if it cannot fund wages, suppliers, debt and other commitments during disruption.
Does insurance replace a continuity plan?
No. Insurance may transfer certain financial risks, but it does not tell employees how to operate tomorrow morning when a critical facility, system, person or supplier disappears.
Who should own the business continuity plan?
Ultimate accountability normally sits with senior management and, where applicable, the Board. Specific elements can be delegated, but continuity should not become nobody’s responsibility.
What is the biggest mistake businesses make with continuity planning?
Treating the written plan as the objective.
The objective is organisational capability to respond and recover.
Conclusion, Business Continuity Is About Protecting Everything You Have Built (Business Strategy Perth)
SME owners spend years, sometimes decades, building their businesses.
They develop customers.
Recruit employees.
Create intellectual property.
Build brands.
Purchase assets.
Develop supplier relationships.
Accumulate knowledge.
Take financial risks.
Create value.
Yet sometimes the continuity of everything they have built depends on assumptions that have never been tested.
That the owner will always be available.
That the server will always work.
That the supplier will always deliver.
That the customer will always remain.
That the bank will always provide liquidity.
That the building will always be accessible.
That the backup will restore.
That somebody else knows what to do.
Business continuity planning challenges those assumptions before reality does.
The objective is not to predict the next crisis.
You probably cannot.
The objective is to build a business sufficiently prepared, financially resilient, operationally capable and well governed that when disruption occurs, management can respond deliberately rather than panic.
The strongest businesses are not those in which nothing ever goes wrong.
They are the businesses capable of absorbing shocks, protecting what matters, adapting quickly and continuing forward.
That is what genuine business resilience looks like.
For SME owners and leadership teams wanting to identify strategic vulnerabilities, strengthen governance, reduce key-person dependencies and build a practical continuity and resilience framework, Contact Doug Verley to discuss your business and its priorities.
