Business Continuity Plan: Could Your Business Survive 7 Days Without Its Systems?

We had a plan on the gas-well fire. The trucks were spaced along the road, every crew knew its job and the fire was contained, with the radio quiet enough that you could hear the engines idling. Then the wind changed. Within minutes the fire we had under control turned into a crown fire running through the treetops and the plan we’d been working all day stopped matching what was in front of us. One minute everything can be calm and normal, next minute you have an uncontrollable wildfire on your hands!

That day taught me something I’ve carried into every business I’ve worked with. A plan describes the conditions you expected, not the conditions you get, so the real question is whether your people can still make good decisions once the wind changes.

What a business continuity plan is supposed to do

A business continuity plan sets out how your business keeps its critical work going when something goes wrong and how you get back to normal afterwards. It covers who’s in charge, what has to keep running, where your people and data go and who you need to call. If you’re starting from nothing, the free template on business.gov.au is a perfectly good place to begin.

A template gets you a document. Trouble is, a document isn’t continuity. A 2022 inquiry by the Australian Small Business and Family Enterprise Ombudsman found only one in four Australian small businesses had a current business continuity or disaster plan. That means three out of four have nothing ready for when the fire comes. Of the ones that do have a plan, very few have ever tested it under pressure.

08:40 Monday: the test your plan never had

It’s 08:40 on a Monday and every screen in the office shows the same message. Email is gone, along with the accounting system, the CRM and the shared drives. The phones still work, payroll is due tomorrow and your IT provider is saying three days, maybe more. Then your biggest customer rings wanting an order out today. Meanwhile your business continuity plan is a PDF sitting on the shared drive you can’t open.

This isn’t a far-fetched scenario. The Australian Signals Directorate’s latest Annual Cyber Threat Report (2024–25) puts the average self-reported cost of cybercrime for a small business at about $56,600 per report, up 14% on the year before. Here’s the thing though. It doesn’t matter whether it was ransomware, a flood in the server room or a fire next door. The cause is for the investigation, while the consequence is your Monday.

Four places plans quietly lie

When I sit down with a business owner and walk through their plan, it usually looks fine on paper. Then we ask a few awkward questions and the cracks show up in the same four places.

Authority. The plan says “the owner will coordinate the response.” What happens if the owner is on a plane or in hospital? On the fireground nobody waits around for permission once a crew is in danger. Somebody is named and everyone knows who it is. In most small businesses nobody has ever been told they’re allowed to make the call.

Access. If the plan lives on the system that’s down, you don’t have a plan. You have a file you can’t read.

Backups nobody has restored. Most owners tell me they’ve got backups and I believe them. Having a backup and being able to restore from it are two different things. A 2021 global Veeam survey of more than 3,000 IT decision-makers found 58% of backups or recoveries fail. A backup you’ve never restored is a hope, not a plan.

Contact lists full of ex-staff. Pull out the emergency contact list and count how many of those people still work for you, then count how many of the phone numbers still work. That list was right the day it was written and it’s been quietly going stale ever since.

Fight It, Flank It or Let It Burn

When the fire’s bigger than your resources, you can’t attack everything at once. You decide what to fight head on, what to flank and what to let burn. It’s exactly the same in business when the systems go down.

Fight it: payroll. Your people need to be paid tomorrow and that’s not negotiable, so this is where your best resources go first. Can you get a payroll file from your bank, your accountant or last fortnight’s records and push it through manually? That’s the fight.

Flank it: the urgent order. You can’t fix the CRM by lunchtime but you can work around it. Pick up the phone, take the order on paper, confirm it by text and process it properly once the systems come back. You’re not putting the fire out, you’re stopping it from spreading into a lost customer.

Let it burn: the internal report due Friday. It matters, just not this week. Tell the people waiting on it that it’s moving and take it off the list. Small fires left alone to burn quickly turn into large fires, so be clear about which ones you’re choosing to ignore and why. Letting something burn is a decision, while forgetting about it isn’t.

Fear makes people do irrational things. The owners who handle a bad Monday well aren’t braver than anyone else, they’ve just made these decisions before the panic sets in.

The 15-minute Business Fire Drill

On the fireground we train for this stuff constantly so that when it happens it feels familiar. You can do the same with your team in 15 minutes. Book a meeting room, set a timer and work through these five questions out loud.

1. Who’s in charge if the owner can’t be reached? Does everyone in the room know it?
2. Where is the offline copy of the plan? Can someone put their hands on it right now?
3. When did we last actually restore something from a backup, not just check that it ran?
4. Can we pay staff tomorrow without the accounting system? Walk through how.
5. Which three things must keep running on day one? Who owns each of them?

If any question gets a long pause or a “we’d figure it out,” you’ve found your gap. Write it down and give someone a date to fix it. That’s the Document and Adapt part of DADA. It’s where a plan starts turning into something you can actually rely on.

Train for consequences, not disasters

You’ll never write a plan for every disaster. Cyber attack, flood, fire, a key supplier going broke: the list is endless. The consequences are a much shorter list. No systems, no premises, no key person, no cash flow. Train for those four and you’re ready for most of what can go wrong.

The wind will change at some point. Your job is to make sure your team has already practised what to do when it does.

Run this drill with your team this week. Want someone to run it for you? Book a Business Fire Drill.

FAQs

What should a business continuity plan include? A business continuity plan should name who’s in charge during an incident, list the critical activities that must keep running, set out workarounds when systems or premises are unavailable, include current contact details for staff, suppliers and customers. It should also explain how you’ll recover. Keep an offline copy so you can reach it when everything else is down.

How often should you test a business continuity plan? Test it at least once a year and whenever something big changes, like new systems, a new office or key staff leaving. A short drill every quarter is even better. Fifteen minutes with your team working through a realistic scenario will expose more gaps than rereading the document ever will.

Is there a free business continuity plan template in Australia? Yes. business.gov.au offers a free emergency management and business continuity template for small businesses. It’s a solid starting point that covers the sections most plans need. Once you’ve filled it in, test it with your team so you know it holds up under pressure and not just on paper.