Unforeseen events can have a serious impact on small businesses. Fires, flooding, IT outages and cyber-attacks can severely disrupt operations. The consequences can include lost customers, reduced productivity, financial loss, and in some cases, it can lead to business closure.
Business continuity planning helps you prepare for disruption, minimise impacts, and return to normal operations as quickly as possible. This guide brings together practical templates, scenario guidance, and strategic planning approaches to help Welsh businesses build strong resilience.
1. Why Business Continuity Matters
Unexpected incidents such as natural disaster, cybercrime, civil unrest or supply interruptions can occur at any time.
A business continuity plan allows you to:
- Prepare for high risk events
- Maintain essential operations during disruption
- Protect customers, assets and your workforce
- Reduce downtime and financial losses
- Recover critical functions quickly
- Demonstrate resilience to insurers, regulators and partners
Many insurers now expect businesses to have continuity arrangements in place before offering cover.
2. Key Components of Continuity Planning
Effective continuity planning typically draws on two linked practices:
- Risk assessment which identifies:
- The types of incidents you may face
- The likelihood and severity of each scenario
- Business Impact Analysis (BIA) which identifies:
- Critical business activities
- Maximum tolerable downtime
- Recovery time objectives (RTOs)
- Resources required for recovery
Together, these form the basis of a robust continuity plan.
3. Business Continuity Plan Template
There are many business continuity planning templates available online. You can build your own plan or use structured tools such as:
- GOV.UK Business Continuity Management Toolkit
- Third party templates or online continuity software
The most effective plan is one tailored to your specific operations.
The sections below set out key areas you should include in your plan. You can expand these sections depending on your business size and needs.
Business Details
Business name:
Trading address:
Main contact name:
Role or position:
Telephone:
Email:
Date completed:
Next review date:
3.1 Essential Activities
List the activities that must continue during disruption for your business to operate.
3.2 Key People and Responsibilities
Include who will make decisions, communicate with customers, and coordinate recovery:
Name:
Role:
Telephone:
Email:
Backup contact:
3.3 Communication Arrangements
Set out how you will stay in contact if your usual systems fail:
Primary method:
Backup methods: (e.g. SMS, WhatsApp, alternative email, landline)
Customer holding message:
3.4 Essential Resources and Workarounds
- premises,
- equipment,
- IT systems,
- stock,
- vehicles,
- key documents.
Backup storage location and access details:
3.5 Suppliers and Alternatives
List critical suppliers and back up options, including digital service providers and cloud tools.
3.6 Financial Continuity
Explain how your business will maintain:
- Banking
- Payroll
- Invoicing
- Cash flow
3.7 Local Risks and Preparedness
Consider specific risks such as:
- Flooding
- Severe weather
- Rural disruption
- Transport issues
3.8 Immediate Response (first hour)
Outline the steps to stabilise the situation, such as
- Ensure staff safety
- Notify emergency services
- Assess impact
- Initiate communication plans
- Begin recovery actions
4. Crisis Management
During a serious disruption, businesses may face operational, reputational and communication challenges.
Crisis Management involves:
4.1 Emergency Response
Focus first on people’s safety. Include:
- Evacuation procedures
- Incident response checklists
- Site safety maps
- Relocation site details
- Working-from-home procedures
4.2 Crisis Communication
Plan how information will flow to:
- Staff
- Customers
- Media
- Stakeholders
- Suppliers
Include:
- Agreed communication protocols
- A designated spokesperson
- Pre approved holding statements
- Media-handling guidance
Inform employees, customers and suppliers before they learn of events through social media or the press wherever possible.
4.3 Business Recovery
Detail operational plans for:
- Restoring critical IT systems
- Recovering stock or materials
- Re-establishing contact with suppliers
- Returning to premises
- Rebuilding infrastructure
5. Disaster Recovery versus Business Continuity
- A disaster recovery plan focuses specifically on restoring IT systems, data, servers and software.
- A business continuity plan covers wider organisational resilience—including people, processes, facilities and communications.
Both plans support each other and should be aligned.
6. Insurance and Business Continuity
Insurance providers often require a continuity plan. Ensure:
- Your cover reflects identified risks
- Property Flood Resilience (PFR) measures are installed where relevant
- Business interruption insurance is considered
- Cyber insurance is appropriate for your systems
For more information, see Get the right insurance.
See the Flooding section below for specific advice on obtaining affordable flood insurance.
7. Preparing for Specific Scenarios
7.1 Flooding
With 1 in 7 homes and businesses in Wales at risk of flooding, and with the climate emergency bringing more extreme weather, it is more important than ever that businesses know and understand their flood risk. Flooding has the potential to cause major disruption to operations, property, and assets.
Preparing for Floods involves considering how your business would respond if your premises were suddenly inaccessible or damaged due to rising water levels.
Business should:
- Identify flood risks and sign up for flood warnings
- Develop plans for alternative premises or remote working
- Ensure your staff are aware of emergency procedures
- Safeguard essential data
- Review insurance policies
Check your Business Insurance Options:
- Engage with BIBA Commercial Scheme to obtain affordable flood insurance, locate brokers who specialise in flood risk cover for SMEs.
- If having difficulties finding suitable cover, businesses can seek advice from the British Insurance Brokers' Association.
Consider installing Property Flood Resilience (PFR) Measures. Insurers encourage businesses to take steps to reduce flood risk by using PFR measures such as:
- Flood barriers
- Raised electrical systems
- Water-resistant materials
To make sure these measures work properly, it is important to use certified products and qualified installers, these can help lower premiums and improve insurability.
Seek Financial Support:
- The Business Wales Finance Locator can check if there are any grants, loans or other finance available to improve resilience to flooding in Wales.
- The Development Bank of Wales offers loans for flood resilience improvements.
7.2 IT Recovery
Consider how quickly your business could restore:
- Servers
- Laptops
- Cloud systems
- Critical applications
- Backups
Questions to consider:
- How long would key systems be down?
- Would data be lost?
- Are backups secure and tested?
- Do you have alternative devices or cloud access?
Cyber Security: Keeping Your Business Safe Online
Cybercrime is a growing issue for businesses across Wales. Strengthen your cyber resilience by ensuring the following are in place:
- Staff awareness training
- Multi-factor authentication
- Secure, encrypted and regularly tested backups
- Strong password practices
- Incident reporting procedures
For more information, see Cyber Security Advice and Support | Business Wales
7.3 Business Crime
Includes threats such as:
- E crime
- Fraud
- Scams
- Theft or vandalism
For more information, see Business crime | Business Wales
8. Sources of Further Information
8.1 Counter-Terrorism Awareness for Businesses
The ACT Awareness eLearning course from ProtectUK is open to all businesses across the UK. It provides nationally recognised training on spotting signs of suspicious activity and reducing the risk of terrorism affecting business operations. It is suitable for all staff.
8.2 Guidance from the National Protective Security Authority (NPSA)
The NPSA offers security guidance for the people and infrastructure that keep the country going. Their advice covers:
- Physical security (buildings, entrances, etc.)
- People and personnel security (background checks, access controls)
- Cyber security (protecting your information and systems)
Visit www.npsa.gov.uk for more information.
8.3 Local Authority Guidance in Wales
Businesses should check their local authority’s website for guidance and support specific to their area.
- Blaenau Gwent
- Bridgend
- Caerphilly
- Cardiff
- Carmarthenshire
- Ceredigion
- Conwy
- Denbighshire
- Flintshire
- Gwynedd
- Merthyr
- Monmouthshire
- Ynys Mon
- Neath Port Talbot
- Newport
- Pembrokeshire
- Powys
- Rhondda Cynon Taf
- Swansea
- Torfaen
- Vale of Glamorgan
- Wrexham
Spending a small amount of time preparing now can significantly strengthen your ability to manage disruption and protect your business in the future.