Business Continuity Planning Guide

A business continuity plan (BCP) is a documented strategy that outlines how your business will continue operating during and after a disruption. It identifies critical functions, defines response procedures, assigns responsibilities, and establishes recovery time objectives. For UK businesses, a BCP is essential because 60% of companies without one fail within two years of a major crisis. Whether it's an IT failure, HMRC enforcement action, key staff loss, or supply chain disruption, a continuity plan ensures you can keep trading, protect your reputation, and meet your legal obligations.

A comprehensive BCP should cover both common and severe disruptions: IT system failures and cyber attacks, power outages and utility failures, loss of key personnel or directors, premises inaccessibility (flood, fire, or legal restriction), supply chain breakdowns, cash flow crises and working capital shortages, HMRC enforcement action and tax arrears, creditor pressure and winding up petitions, data loss or breaches of customer information, and economic downturns or sudden market changes. The key is tailoring your plan to the specific risks your business faces — a retail business has different vulnerabilities than a professional services firm.

A Recovery Time Objective (RTO) is the maximum acceptable time your business can be without a specific function after a disruption. Different functions have different RTOs: critical functions like payment processing and customer order fulfilment may need recovery within hours, important functions like supplier communications and payroll within 24 hours, and non-essential functions like marketing reporting within a week. To set RTOs, identify what your business cannot operate without, determine the financial and reputational cost of downtime for each function, and prioritise accordingly. A professional continuity assessment can help you map this accurately.

Yes — small businesses often need continuity planning more than large corporations. Smaller companies typically have single points of failure (one key person, one supplier, one premises), less financial buffer, and tighter margins. A disruption that a large company could absorb might permanently close a small business. The good news is that continuity planning for a small business doesn't need to be complex or expensive. A simple, practical plan that identifies your critical functions, key contacts, and basic recovery steps can be created quickly and will pay for itself many times over if disruption occurs.

Every effective continuity plan should include: an emergency contact list (staff, suppliers, emergency services, professional advisors), identification of critical business functions with assigned RTOs, detailed recovery procedures for each function, alternative arrangements (backup suppliers, remote working capability, alternative premises), data backup and IT recovery procedures, a crisis communication plan (how you'll update customers, suppliers, and stakeholders), clearly assigned roles and responsibilities, and a regular testing and review schedule. Plans that aren't tested often fail when needed — schedule quarterly tabletop reviews and annual full simulations.

Directors have statutory duties under the Companies Act 2006 to promote the success of the company and exercise reasonable care, skill, and diligence. A documented business continuity plan demonstrates that directors have taken proactive steps to protect the company from foreseeable risks. This can be critical evidence if the company later faces insolvency — showing you had systems in place to identify and respond to threats helps defend against allegations of wrongful trading or misfeasance. It also protects directors personally by ensuring you spot financial distress early, giving you more options and better outcomes.