If you’ve just been asked to “sort out the BC plan” and you’re not entirely sure what that means, you’re not alone. It’s one of those phrases that gets thrown around in meetings as if everyone already knows what it involves. Most people don’t, and that’s fine — until something goes wrong.
A business continuity plan, or BC plan, is simply a written answer to one question: if something stopped us working tomorrow, what would we actually do?
That “something” could be almost anything. A fire in the building. A supplier going bust. A cyber attack that locks you out of your own systems. A key member of staff off sick for months. The plan doesn’t predict which of these will happen — it just makes sure that whichever one does, you’re not figuring out your response from scratch while it’s happening.
Why its not the same as insurance
Insurance pays for the damage after the fact. A BC plan is about what you do in the hours and days immediately after something happens, before any of that matters. Can staff still get paid? Can customers still be served, even in a limited way? Who’s actually in charge of making decisions when the usual chain of command is disrupted?
Take a client Cambridge Risk Solutions has worked with for over a decade — a specialist facility in a highly technical sector, first brought on board to achieve certification against ISO 22301 because their biggest customer required it. Over ten years, that one certification project turned into an ongoing partnership: annual exercising, plans that get properly tested rather than just filed, and BC embedded as something the organisation owns rather than something a consultant does to them once a year.
Over that decade, the plans have been properly tested — not in a training room, but for real. COVID forced the business to rethink how it operated almost overnight. Flooding threatened premises and equipment. IT outages knocked out systems the business depended on. None of these were hypothetical scenarios dreamed up for an exercise; they were the actual, different-shaped crises that any business faces over a long enough timeline. In each case, the business had something to fall back on rather than starting from a blank page — because the plans had been exercised regularly enough that people knew how to use them, not just where to find them.
Certification has been maintained continuously since 2014, through all of it.
What actually goes into one
A good BC plan isn’t a 40-page document nobody reads. At its core, it usually covers:
Who needs to know what’s happening, and in what order. Which parts of the business absolutely have to keep running, and which can pause for a few days without real damage. Where people work from if the usual place is out of action. How you keep talking to customers and staff while it’s all going on.
The plans that actually get used in a crisis tend to be the short, clear ones — not the ones written to look impressive in a folder.
Does a small business actually need one?
Yes, arguably more than a large one. A big company can usually absorb a bad week. A small business often can’t — and the businesses that fold after a disruption usually aren’t the ones that had a plan and used it; they’re the ones that didn’t have one at all.
Where to go from here
For more information and details why not look at our Introduction to Business Continuity course.
Related posts:
RiskReady Shortlisted for Specialist Company of the Year at the Business Continuity Awards 2026
What is a Business Impact Analysis — and why does your organisation need one?
What is business continuity — and why should small businesses care?
The Loggist: one of the most important roles nobody trains for