Business continuity and crisis management

A business crisis is a sudden event that seriously disrupts your operations. It often requires quick decisions and can pose significant risks to your business.

Types of business crises

Businesses can face many different types of crises, including:

• natural disasters - such as flooding or storms
• technology failures - including IT outages, system failures or cyber attacks
• accidents - such as fires, gas leaks or power cuts

Additional risks that can disrupt your business include:

• theft or vandalism - causing loss or damage to equipment or property
• power cuts or fuel shortages - affecting operations or transport 
• loss of access to premises - for example, due to emergencies or safety issues
• staff shortages - caused by illness or loss of key employees
• disease outbreaks - which may lead to closures or restrictions
• security threats - such as terrorist incidents
• supply chain disruption - resulting in difficulty sourcing materials or goods
• customer issues - reduced demand or inability to deliver services
• reputational damage - for example, from product recalls or social media issues

Even unlikely risks should be considered. Planning ahead helps reduce disruption and improve recovery. You should carry out a business impact analysis to determine how a crisis may affect you.

Manage and respond to crises

Crisis management is the process of preparing for, responding to and recovering from business disruptions. It focuses on reducing damage, maintaining operations and restoring normal business activity as quickly as possible. Crisis management can be especially important in the area of public relations.

Find out how to minimise the potential impact of crises.

A business impact analysis (BIA) is a key step in business continuity planning. It helps you identify critical business functions and understand how disruption could affect them.

How to carry out a business impact analysis

To carry out a business impact analysis, you shout:

• identify all business processes and functions
• prioritise critical activities
• analyse the potential losses
• select recovery solutions
• identify dependencies, such as IT systems
• evaluate operational, financial and legal impacts
• define recovery time requirements

BIA report and outcomes

A BIA report is the written output of a business impact analysis. It shows what could happen to your business if important activities are disrupted, so you can plan for recovery. This report usually:

• looks at severe disruption scenarios, including worst-case situations
• estimates the financial cost of downtime or interruption
• explains how disruption would affect day-to-day operations, customers and service delivery

Disruption to your business can result in:

• lost sales or income
• higher costs and expenditures - eg overtime, outsourcing, etc
• regulatory fines or contractual penalties
• loss of customers and greater customer dissatisfaction
• decline in business reputation

Why is BIA important?

A business impact analysis helps you understand how your business would cope during downtime. It also helps you set recovery time objectives and identify the resources needed to keep critical functions running. This forms the basis of your disaster recovery and business continuity plan.

Business impact analysis vs risk assessment

Both BIA and risk assessment are important business continuity tools, but they have different roles. 

BIA doesn't focus directly on the likelihood of events. Instead, it assumes worst-case scenarios. A risk assessment analysis identifies potential risks, how likely they are to happen, and their possible impact. In practice, risk assessment often uses BIA findings to prioritise risks and support decision-making. See how to evaluate business risks.

Risks and uncertainty are part of everyday business, but not all crises lead to serious disruption. Taking simple steps can reduce risks, limit losses and help your business recover quickly.

Protect your business premises

Protect your premises from common risks:

• plan for flooding to reduce damage
• maintain electrical and gas safety to prevent fires
• install fire and security alarms

You should also have a contingency plan if you cannot use your premises. For example:

• agree to share space with another business if a crisis affects either of you
• use alternative premises offered by a business continuity supplier 
• enable staff to work remotely if your premises close

Weigh up the costs and benefits of each option.

Secure your IT and communications

Protect your IT systems to avoid disruption with simple steps. At the very least:

• install anti-virus software 
• back up data regularly (including offsite backups) 
• maintain IT systems and support agreements

Keep copies of key data, such as customer contact details, offline so you can continue operating if systems fail. See best practices on IT risk management.

Plan for staff disruption

Avoid relying on a small number of employees for key skills. You can:

• train staff to cover different roles
• arrange temporary cover if needed
• follow good health and safety practices to safeguard your staff

Read about managing the welfare of people.

Manage transport risks

Consider how staff travel to work and plan alternatives, such as:

• car sharing schemes
• company transport
• public transport
• remote working options

This helps maintain operations during disruption. Read about workplace travel planning.

Protect equipment and supplies

If you use vital pieces of equipment, cover them with maintenance plans guaranteeing fast repair support. Keep essential stock where possible and identify alternative suppliers to avoid supply chain disruption.

Use insurance to manage risk

Insurance is a key part of business risk management. It helps protect your business, assets and people from financial loss during unexpected events. See more on business insurance.

A business continuity plan sets out how your business will continue operating during a crisis. It is a blueprint for restoring critical business activities quickly and reduce the impact of disruption.

How to write a business continuity plan

Business continuity planning is based on two key processes:

• risk assessment - which shows you what kinds of incidents you might face
• business impact analysis (BIA) - which identifies recovery times for key activities

Together, these help you understand risks and plan how to respond effectively.

What to include in your business continuity plan

A business continuity plan should cover the following areas:

Emergency response

Protect people first. Create clear procedures for different scenarios, such as incident response flowcharts/checklists, evacuation plans, emergency contacts, relocation sites, and remote working arrangements. Once people are safe, you can focus on limiting damage to your business.

Crisis management

Set out how you will communicate during a crisis. Define roles, responsibilities, communication channels and processes for updating staff, customers, stakeholders and the media. If necessary, appoint a company spokesperson to handle questions and provide media updates.

Business recovery

Set out clear recovery plans for critical functions and assets. Identify key people, resources and immediate actions needed to restore operations, including systems recovery, stock and supplier recovery, resources and equipment recovery, etc. The early stages of an emergency are critical to reducing impact, so make sure staff know what to do through training and clear instructions.

Key contacts

Create a list of the people and organisations you may need in an emergency, with their roles and contact details. Include key staff, suppliers, emergency services, utility providers, landlords, insurers and local contractors such as locksmiths, plumbers, electricians and IT specialists. Include site maps showing fire escapes, sprinklers and other safety equipment.

Stay flexible

Different incidents require different responses. Your plan should be flexible enough to cover a range of scenarios, from minor disruptions to major emergencies.

Business continuity plan templates and tools

You can build your business continuity plan from scratch or use one of the many templates or software tools available online to help you get started. Keep in mind that the best plan will be the one that is tailored specifically to your business. GOV.UK's business continuity management toolkit (PDF, 569K) can help you create a plan and adapt it to your business.

Disaster recovery vs business continuity

A disaster recovery plan focuses on technological incidents and restoring IT systems and data. It works alongside your business continuity plan, which covers the wider business response. See more on IT incident response and recovery.

Business continuity and insurance

Business continuity planning supports your insurance cover. Many insurers expect you to have a plan in place to manage risk and minimise losses. For more information, see business insurance: the basics.

A business continuity plan should be a working document. Keep it up to date and test it regularly against different scenarios to make sure it works in an emergency.

Prepare for testing

Before testing your plan, make sure you:

• agree clear testing criteria and procedures
• decide how you will document the findings
• plan how to fix any problems identified during the test

Use realistic but challenging scenarios to make testing effective. Although by their nature crises are hard to simulate, there are many ways you can assess your business continuity plan against different crisis scenarios.

How to test business continuity plans

You can test your plan in different ways, including:

• checklist tests - review key steps and processes
• table-top exercises - discuss responses to a scenario
• structured walk-throughs - go through the plan step by step
• scheduled simulations - test how your business would respond
• full interruption tests - test recovery in real conditions

You should also check key details, such as contact lists, to avoid delays during a real crisis.

How often to test your business continuity plan

Many businesses test their plans two to four times a year. The frequency depends on your business type, staff changes and updates to systems or processes.

Why is business continuity plan testing important?

Rigorous testing should show that your plan works and does what it is meant to do. It will also help you to 

• train staff involved in recovery 
• identify gaps or weaknesses in your plan
• demonstrate the ability of your company to recover

See also the advantages of business continuity planning.

If you outsource key services, check that your suppliers’ plans align with your own.

Maintain your business continuity plan

Business continuity planning is an ongoing process. Review and update your plan regularly to reflect changes in your business, such as new premises, staff or systems. An annual review, combined with regular testing, helps keep your plan effective.

Follow business continuity standards

You can assess your plan against recognised international standards, such as ISO 22301. This standard sets out requirements for a management system that helps protect your business from disruption, reduces the risk of incidents and supports recovery.

Unpredictable events, such as natural disasters or accidents, can disrupt your business. Without preparation, these disruptions can lead to lost income, customers and long-term damage. Business continuity planning helps you prepare for these risks and respond effectively.

Key benefits of business continuity planning

Business continuity planning can help you:

• keep your business trading during and after an incident
• recover operations more quickly after interruptions
• reduce costs and duration of any disruption
• mitigate risks and financial exposure
• build customer confidence and trust
• safeguard company reputation
• develop confidence within the business
• comply with regulatory or legal requirements
• insure against otherwise unacceptable risks
• save lives, if dangerous events (such as a fire) occur

If you don't have a business continuity plan yet, start by carrying out a business impact analysis. This helps you identify critical business activities, assess risks and understand the potential impact of disruption.

Importance of having a business continuity plan

A well-designed plan makes it easier to respond to a crisis and minimise disruption. It also shows customers, insurers and investors that your business is prepared and resilient. See how to create a business continuity plan.

Without a plan, even small disruptions can cause serious problems. You may lose customers, face delays in recovery, or struggle to continue trading.
A clear and tested business continuity plan gives your business the best chance of recovering from disruption and continuing to operate successfully. 

Find out how to test your business continuity plan rigorously.