Article reference: UK-IA-LAW17

Crisis management and business continuity planning

Health and safety crises, fire damage, illness of key staff or computer failure could make it very difficult to carry on business as usual, especially if your business is small.

With a little planning, you can minimise the potential impact of a disaster - and sometimes prevent it from happening in the first place.

Why you need to plan for possible crises

The smaller your business, the more risk planning is required – simply because small businesses often lack the resources that larger business have that allow them to bounce back.

Failure to plan could therefore be a disaster. At best you risk losing customers while you're getting your business back to normal; at worst your business may have to cease trading.

Creating a business continuity plan

Planning now can seem like a lot of work, for not much immediate gain - especially when there are so many immediate demands in your business. However, having a continuity plan in place will make coping in a crisis easier, and allow you to minimise disruption to the business and its customers.

Your planning process should include consideration of:

  • identification of potential risks
  • how you intend to minimise the risks
  • how key individuals will react if a disaster occurs
  • testing of the plan

Simply, this means if you're reliant on a particular system, identify your reliance as a risk, and think about how to minimise it. For example, if all your customer data is stored on a single IT server, there may be a risk that if the server failed, you would lose all your customer information. A solution might be to back-up the data to another server that is located in another physical location.

Identify possible risks

Depending on the location of your office, and the industry you work in, here are some types of risk for which you might want to plan:

  • natural disasters, particularly flooding
  • theft or vandalism, both by people within the business and people outside the business. Vandalism, in particular, could lead to further health and safety risks
  • fire (see how to carry out specific fire safety assessments here)
  • power cuts
  • IT system failures, such as computer viruses, attacks by hackers or other availability failures that could affect employees' ability to work effectively
  • restricted access to premises, for example, because of a gas leak in a nearby property
  • loss or prolonged illness of key staff
  • outbreak of disease or infection
  • terrorist attacks, to you immediate business, but also more widely on your industry or location
  • risks that might affect you suppliers
  • customer problems, such as non-payment
  • damage to your reputation, for example, in the event of a product recall

Determine the potential impact of a crisis

You should analyse the probability and consequences of crisis that could affect your business. You're likely to conclude that certain roles within the business - while necessary in normal circumstances - aren't absolutely critical in a disaster scenario.

To determine the possible impact of a crisis on your business, it can be helpful to think of some of the worst possible scenarios and how they might prove debilitating for the business.

For instance, how could you access data on your customers and suppliers if computer equipment was stolen, or if it was damaged by a fire? Where would the business operate from if your premises were destroyed by fire?

It's essential to look at risks from the perspective of your customers. Consider how they'd be affected by each potential crisis. Would they be likely to look for alternative suppliers? Do you risk losing them completely if they switch supplier, or would any change be temporary because of the quality of your goods or services?

Grade the risks so you can prioritise

It is a good idea to grade the probability of a particular crisis occurring, perhaps on a numerical scale or as high, medium or low. You should also assign a rating to whether the loss you would incur would be high, medium or low as well.

This will help you to decide your business' attitude towards each risk. You may decide to do nothing about a low-probability crisis whose cost is also low, but plan for a medium probability risk whose cost is high.

Minimise the potential impact of crisis

Once you've identified the key risks your business faces, you need to take steps to protect against them:


Good electrical and gas safety could help protect premises against fire. Make sure you have installed fire and burglar alarms and that you test them regularly.

Think about what you would do in an emergency if your premises couldn't be used. For example, you might suggest an arrangement with another local business to share premises temporarily if a crisis affected either of you. An alternative would be to use a business continuity supplier, which can make alternative premises available at short notice. However, this can be costly.

Equipment and machinery

If you use key pieces of equipment, you may want to cover them with maintenance plans guaranteeing a fast emergency call-out and specialised insurance.

IT and communications

Installing anti-virus software, backing up data and ensuring the right maintenance agreements are in place can all help protect your IT systems.

You might also consider paying an IT company to regularly back up your data offsite on a secure server.


Ensure you're not dependent on a few staff for key skills by having them train other people.


Insurance forms a central part of an effective risk-management strategy. Remember that insurance is not preventative, and can be costly to claim.

Plan how you'll deal with an emergency

You should draw up a business continuity plan setting out in writing how you will cope if a crisis does occur.

It should detail:

  • the key business functions you need to get operating as quickly as possible
  • the resources you'll need to do so
  • the roles of individuals in an emergency

Making the most of the first hour after an emergency occurs is essential in minimising the impact. As a result, your plan needs to explain the immediate actions to be taken.

Consider whether you'll need to give staff specific training to enable them to fulfil their responsibilities in an emergency situation. Ensure all employees are aware of what they have to do. For example, if you manufacture goods, then you have a requirement under the Management of Health and Safety of Work (MHSW) Regulations to make sure that all staff are regularly trained about the operating hazards.

Arranging the plan in the form of checklists can be a good way to make sure that key steps are followed.

Include contact details for those you're likely to have to notify in an emergency such as the emergency services, insurers, the local council, customers, suppliers, utility companies and neighbouring businesses.

It's also worth including details of service-providers such as glaziers, locksmiths, plumbers, electricians, and IT specialists.

Include maps of your premises' layout to help emergency services, showing fire escapes, sprinklers and other safety equipment.

Set out how you'll deal with possible media interest in an incident. Appoint a single company spokesperson to handle questions and try to be positive in any statements you issue. Ensure staff, customers and suppliers are informed before they find out in the media.

Finally, make sure hard copies of your business continuity plan are lodged at your home and with your bank and at the homes of other key members of staff.

Test your business continuity plan

Think about the things that would cause most disruption and that are most likely to happen to your business. Then make sure that your plan covers each of the risks. Ask yourself the following key questions:

  • Does it set out each employee's role in the event of each emergency? Have you set out the right steps to take?
  • Is the order of the plan correct so that priority actions to minimise damage will take place immediately after the incident?

Make some telephone calls to check that the key contacts and phone numbers that you have given are correct. Having to find the right number after a crisis could use up valuable time.

Keep your plan updated

Remember to make risk assessments regularly and update your plan to take into account your business' changing circumstances.

If you move into new premises, for example, you could face an entirely new set of risks. You'd need to draw up new maps for the emergency services and amend any contact numbers necessary.

Please note that the information provided on this page:

  • Does not provide a complete or authoritative statement of the law;
  • Does not constitute legal advice by Net Lawman;
  • Does not create a contractual relationship;
  • Does not form part of any other advice, whether paid or free.
Contact us about this article

We would love to hear what you think about this article and how we could improve it. Please do let us know. However, we shan't be able to reply to your specific questions. If you have a question about a document, please contact us.

Leave feedback about this page