Business Continuity Plan Template

To create an effective business continuity plan, you need:

• a plan owner 
• input from key people in every operational area of the business
• deputies for BCP roles or multi-skilled staff  

If you’re a business owner, you need to think about who is going to drive the creation of the BCP. Will it be you? Can or should you assign the responsibility to someone else? Whoever you choose will be your plan owner. 

Next, you need to ensure that you involve people from every operational area of the business. 

These people can help you identify risks that might otherwise be missed. They have the knowledge of how the business operates on a day-to-day basis, and they can help you create contingency plans that work for everyone. 

Tip: If you’re a larger business, set up a working group or BCP committee with representatives from every business area. 

And finally, you need to identify deputies for key BCP roles or ensure you have multi-skilled staff. 

Why? You can’t have only one person knowing or having access to something essential. What happens if they’re absent? Your BCP might fall apart. 

The solution to this potential problem will depend on the size of your business. If you have lots of employees, think about creating a deputy for each key BCP role. 

If you have a small team, ensure that everyone is aware of each other’s responsibilities. That way, someone can pick up and perform an extra BCP role if they need to. 

Template tip: add the details of the plan owner and your BCP working group members to the tables on page one of the business continuity plan template. 

This is the easy part. Or at least it should be! Your review should identify:

• the critical functions or processes that make up your business 
• the resources that the functions need 
• timescales and constraints for business processes 
• your MTPD and RTO

Let’s look at what these are, and how to identify them. 

The critical functions or processes that make up your business  

These should be pretty self-explanatory. But if you’re not sure how to identify them, think about the products and / or activities that generate your business revenue. What do they involve? 

Most businesses have critical functions like finance and IT infrastructure. Business-specific examples might be product design, manufacturing, or delivery.

When you identify what is critical, it can be helpful to identify your minimum service level too. This is the essential service you must provide to avoid a permanent loss of custom and fulfil any contractual obligations you may have. This will help you prioritise later. 

You’ll also have other ancillary functions (e.g., marketing, sales, HR) that you might need to recover following a disruptive event before your business is back to business-as-usual. List these too. 

Tip: reviewing your business plan might help here. If you don’t have one, now might be a good time to create one! Use our business plan template to get started.

The resources that the functions need 

What do your critical functions need to operate? Do they need highly skilled staff members, equipment, connectivity, materials, and / or a minimum amount of space? Identify specifications or requirements too. 

Timescales and constraints for processes

When does your business need to complete certain critical processes or tasks to operate successfully? For example, do you have turnaround timescales for certain services? Or deliveries that you need to make on a regular basis?

By constraints, we mean any rules or regulations that might restrict your business operations (e.g., health and safety, licensing, insurance policy terms). 

Your MTPD and RTO 

MTPD = maximum tolerable period of disruption. Or in other words, at what point will a disruption have serious consequences for your business. For example, when will it start to affect your cashflow, reputation, viability etc. 

RTO = recovery time objective. This is the timescale you have to get your critical business functions back operating.

You’ll find these terms widely used in business continuity circles. Your RTO should be before your MTPD and the longer the difference the better! Identifying these figures will help you to create a useful and successful BCP.

Template tip: section 4 contains a table where you can set out all this information. Create a new table for each critical business function.

There are plenty of options to choose from.  

Recently we’ve faced a global pandemic and repeated supply chain disruptions. These events have caused all sorts of issues for many businesses, including suppliers going out of business, a recession and the unavailability of key products. 

Other potentially disruptive events include: 

• natural disasters (e.g., floods, fires, earthquakes etc.)
• utility issues, cyber-attacks, financial trading difficulties, or biological hazards
• changes to legislation (with Brexit a key example for UK / EU businesses) 
• internal challenges (e.g., losing key staff members, cash flow issues or strikes)

Tip: check out the BCI’s 2022 Horizon Scan Report for a detailed analysis of what the future might hold. Or sign up for a newsletter from insurer Aviva’s specialist business continuity planning partner.

Focus on the generic outcomes, not why it happens (the cause). Assess the short and long-term impacts. For example, the first hour, first 24 hours, first 48 hours, first week and so on. 

What could the impacts be? Your staff or key supplies might be unavailable. Or you might lose power, equipment or office space. The UK’s Federation of Small Businesses list the following: 

• loss of sales and income 
• increased expenses 
• decrease in customer satisfaction and loyalty 
• delayed service and poor product quality 
• regulatory fines

The BCI define risk as the combination of the likelihood (or probability) of an event and its impact (consequences).So, to fully assess a risk, you need to look at the likelihood of an event happening (as well as its impacts). 

You can then decide which risks your BCP will cover. Prioritise these by the amount of time you would have to solve them before the MTPD is reached. 

Template tip: update the scope of the plan (section 1) and create a new table for each of the disruptive events covered by the plan (section 5). Add the impacts you identified in step 4 to these tables too.  

Speaking of risk – we have another template that you might find useful. Especially if your business occupies a building. Check out our fire risk assessment template and discover when you might need one.

This is when you must work out how your business will respond to each disruptive event. You have several strategies open to you. For example, your business could: 

• replicate what it is doing 
• do the same thing in a different way (or ways) 
• buy in additional services or support if needed
• do nothing and wait and see 

Consider where you will deal with a BCP event from if your normal workspace(s) is inaccessible, and how you will activate the plan. 

Template tip: complete section 2 of the business continuity plan template (the activation procedure) and detail any additional meeting points at section 8.

It’s now time to outline what the business should do to respond to each event, and how it will do this. 

Give employees roles and responsibilities. Set timescales for actions (being mindful of the RTOs and MTPDs for your critical business functions). Create checklists to ensure compliance.

Think about creating policies for key procedures that will feature in your response. For example: 

• a decision-making procedure 
• communication policy (for both internal and external contacts) 
• a requirement to use an action and expense log 

The latter will help you learn from the experience and help you with any potential insurance claim (as AXA highlight).

Template tips: the tables in section 5 have prompts to help you flesh out your contingency plans. You can also find:

• an example checklist (section 3) 
• a communication policy section (section 6) 
• an action and expense log (section 10)

There will be things that you can do now which will help your business respond to an emergency (as well as writing this plan). 

For example, you can collate contact details and populate the key contacts section of the template (section 11). 

Create an emergency pack (see section 7 of the template for more details). Or investigate mitigating options (alternative suppliers, office space, service providers and more).

Your BCP will only work if everyone knows what to do! Testing will highlight gaps in the plan and increase awareness within your team(s). Check out the BCI’s knowledge, education and training resources for more guidance.

This is important! You don’t want it to become out-dated. Review the plan periodically (at a minimum annually, ideally quarterly) and following major changes to the business. 

For example, changes to operations (e.g., business relocation, new products or services, new priorities, new equipment or processes) or to people (e.g., changes to staff, responsibilities or suppliers).

Template tip: add your testing and review requirements to section 9 of the template business continuity plan. Set calendar reminders too!