THE STARTING POINT
Agree how essential work will continue, who can act and how the recovery will be tested.
Define the service the business must keep providing
A business continuity plan explains how essential work will continue during disruption and how the company will recover. For a small service business, it should be practical enough to use when normal people, systems, premises or suppliers are unavailable. A plan that depends on the disrupted resource being accessible is unlikely to help when it is needed.
Start with the customer and business commitments that matter most. Which services cannot pause for long, which can operate at a reduced level and which can wait? Consider the consequences of delay, including contractual obligations, customer needs, cash timing and specialist requirements. The priorities should come from the actual business, not a generic list of disasters.
ISO 22301 concerns business continuity management systems, but the worksheet here is an original planning aid rather than a claim of certification or compliance. Specialised safety, legal, technical and sector requirements may need professional input. The management objective is to establish clear priorities, authority, information and recovery arrangements that can be tested before a real interruption.
Identify the dependencies behind essential work
For each priority service, list the people, information, systems, equipment, premises and suppliers needed to deliver it. Include approvals and access, not just visible operational tasks. A team may have the skills to continue but be unable to act because only one person can authorise a payment or access a critical record.
Ask where the dependency is concentrated. Is knowledge held by one employee? Are backups dependent on the same account that could become inaccessible? Does every customer communication route rely on one system? The business risk register helps record these exposures and the actions intended to reduce them.
Use real process maps and recent examples to check completeness. A supplier's alternative arrangement may sound sufficient until you discover that the replacement does not meet the customer's specification or cannot deliver within the required period. Record what has been verified, what is assumed and who will confirm the remaining dependency before the plan is treated as ready.
Set recovery priorities and tolerances
Discuss how long each essential activity can be disrupted before the effect becomes unacceptable. Also consider how much information loss or backlog the business can tolerate. These decisions require input from the people responsible for customers, operations and finance, with specialist advice where relevant. They should not be selected simply because a supplier advertises a particular recovery time.
Separate the desired recovery target from the capability currently demonstrated. If the business needs a system restored within a short period but the last recovery test took much longer, the gap requires action. Recording the target alone does not create the capability. The plan should show the evidence behind expected recovery and any unresolved limitations.
Prioritise recovery in a sequence that reflects dependencies. Customer communication may need to resume before every internal report is available. A scheduling service may require access to current job information before staff can redeploy. Make these relationships explicit so the response team does not restore low-priority tools first simply because they are easier to bring back.
Agree who can activate the response
Name the person who decides that the continuity plan should activate, along with a substitute. Define the information they need and the immediate actions within each role's authority. During disruption, unclear ownership can cost valuable time while people wait for a person who may be unavailable.
Keep contact arrangements current and appropriately protected. Decide how staff will communicate if the normal system is down and where the plan can be accessed. Do not put unnecessary sensitive information into widely distributed copies. The access method should be secure and still usable under the scenarios the plan is designed to address.
Use a delegation matrix for the decisions that may be needed, such as prioritising work, approving an alternative supplier or communicating a revised service arrangement. Actual authority must remain consistent with the business's formal requirements. A continuity document should clarify those arrangements rather than invent permission for actions that require additional approval.
Design practical fallback arrangements
For each priority dependency, identify an alternative and its limits. That might involve a trained deputy, a tested backup, a manual record, remote working capability or an approved secondary supplier. State how the alternative is activated, what it can handle and what must be reconciled when normal operations resume.
An illustrative scheduling-system outage might require the team to use a controlled offline list of confirmed jobs and a single coordinator for updates. The plan should explain how changes are recorded to avoid duplicate appointments and how the records are entered back into the system afterwards. A vague instruction to “use a spreadsheet” leaves important controls unresolved.
Consider the duration for which the fallback is sustainable. A manual method may work for a few hours but create errors or excessive workload if used for several days. Identify the point at which the service must be reduced, additional support arranged or another decision escalated. The plan should reflect the capacity and quality limits of the alternative, not just its existence.
Prepare communication that is accurate and useful
Identify who needs information during the disruption: staff, customers, suppliers and other relevant parties. Decide who approves and sends updates, which channels remain available and how often information will be reviewed. Keep the message focused on what is known, the practical effect and the next update or action.
Avoid promising a recovery time that has not been established. It is more useful to explain which services are affected, what customers should do and when they will hear more. Prepare message structures in advance, but fill them with the facts of the actual event rather than sending a generic reassurance that may be inaccurate.
Coordinate internal and external communication. Customer-facing staff need enough information to answer consistently, while the recovery team needs a way to report progress and new limitations. Record important decisions and updates so the business can reconcile commitments afterwards. This also supports a more useful review of what happened and what the plan needs to improve.
Rehearse the plan with a realistic scenario
Run a discussion exercise using one plausible disruption, such as a key person being unavailable or a core system outage during a busy period. Ask participants to walk through the first decisions, information needs, communication and fallback. Introduce a complication and observe where the plan becomes unclear.
Then test the arrangements that require practical proof, such as restoring a backup or using the alternative process, within an authorised and controlled scope. A successful discussion does not establish that a technical recovery works. Record the result, limitations, owner and follow-up actions. Avoid disrupting live services merely to demonstrate preparedness without the appropriate planning and approval.
Use the exercise to improve the plan rather than score participants. Missing contacts, unclear authority and inaccessible records are valuable findings before an actual incident. The change management guide can help communicate and embed the resulting changes so that the next exercise tests an improved capability rather than the same unresolved issues.
Maintain the plan as the business changes
Assign a plan owner, review date and version. Update it when services, systems, suppliers, roles or customer commitments change. Check contact details and access arrangements at an appropriate cadence. A plan can become outdated quickly even when the company itself appears relatively stable.
After an exercise or real disruption, review what worked, what failed and which assumptions were wrong. Track corrective actions to completion and retest material weaknesses. The downloadable worksheet below provides a starting structure for essential services, dependencies, recovery priorities and fallback arrangements.
Activ-8 operations consultancy can help connect continuity planning with the way the business actually delivers work. Bring the services that matter most, known single points of failure and any existing plans. The aim is a practical response that the team can access, understand and carry out, with evidence that the important recovery arrangements work under the conditions they are intended to address.
PUT IT INTO PRACTICE
Business continuity worksheet
Select the services that must continue during disruption. Set tolerable downtime and a realistic recovery target using your own business impact assessment. Document dependencies, a workable fallback, a decision owner and a secure contact reference. Exercise the plan and record the review date. The suggested services are illustrative.
Download the worksheetCSV file · Opens in Excel or Google Sheets · No sign-up required
Sources & further reading
Primary guidance behind the methods discussed. The examples, diagrams and tools in this article are original Activ-8 material.
- ISO 22301:2019 business continuity management ↗Standard overview. The worksheet does not establish conformity or certification.
