When things don't go to plan

Estimated reading time: 6 minutes

When you’re running a small business, things don’t always go to plan. Preparing your business for these events will help you recover as soon as possible if an incident or crisis does happen.

This is generally known as business continuity planning, risk management, disaster planning, or emergency management.

Why do I need a business continuity plan?

A business continuity plan involves making a plan for how your business can prepare for and continue to operate after an incident or crisis.

A business continuity plan will help you to:

  • identify and reduce risks where possible
  • prepare your business for risks that you can't control
  • respond and recover if an incident or crisis occurs.

You may not be able to predict every kind of incident that could threaten your business, but you can develop a plan that covers a range of incidents.

Examples of different types of incidents or crises that could occur include:

  • natural disasters - floods, storms, bushfires or drought
  • technology - computer network failures, hardware failure or problems associated with using outdated equipment
  • work health and safety - accidents caused by the materials, equipment, or location of your work
  • economic and financial - global financial events, interest rate increases, cash flow shortages, customers not paying, rapid growth or rising costs
  • staffing - industrial relations issues, human error, conflict management or difficulty filling vacancies
  • suppliers - failure or interruptions to your supply chain for products or raw materials.

Find out more

What’s in a business continuity plan?

Your business continuity plan is usually a part of your business plan and should contain all of the information you need to get your business running again after an incident or crisis.

The size and complexity of your business continuity plan will depend on your business. It will typically include:

  • a risk management plan with a business impact analysis
  • an incident response plan, with details of when to use the plan, the incident response team, communication during and after an incident and a contact list
  • a recovery plan.
Type of plan Purpose of plan
Risk management plan Identifies your critical business activities. It assesses the risks to your business and strategies to minimise the impacts they could have.
Business impact analysis Identifies the activities of your business that are key to its survival, also known as critical business activities.
Incident response plan Contains all the information you will need to respond immediately before and after an incident or crisis.
Recovery plan Outlines the steps you will need to take to get your business running again after an incident or crisis.

The PPRR risk management model

The prevention, preparedness, response and recovery (PPRR) model is an example of how you can approach risk management in your business.

This model is used by Australian emergency management agencies and can save your business time and money when responding to a setback, incident or disaster.

The PPRR model helps you to:

  • put plans in place to minimise losses in the event of an incident
  • anticipate possible direct impacts to your business from an incident
  • anticipate impacts on your suppliers and customers from an incident, which may flow on to your business.

The PPRR model consists of four parts:

  • Prevention - take actions to reduce or eliminate the likelihood or effects of an incident.
  • Preparedness - take steps before an incident to ensure effective response and recovery.
  • Response - contain, control or minimise the impacts of an incident.
  • Recovery - take steps to minimise disruption and recovery times after an incident.

You can use the PPRR risk management model to help you build your business continuity plan.

Find out more

Backup and secure your data

Protecting your data and systems is an important part of business continuity planning.

Your business data is one of the most valuable assets of your business. Therefore it’s important to make sure you store your data (including financial, registration and customer records) and other important business documents in a safe location.

Regardless of what format your records are kept in (digital or hard copy), you should ensure that you:

  • have more than one copy
  • store the copies in separate locations.

Protecting digital records

If you have digital records, it's important to perform regular backups and store the backup in a secure off site location.

When considering which data protection devices to use, make sure that they are suitable for the type of data you need to store. For example, some fire proof safes should not be used for digital data as disc drives, CDs or USBs will melt in high temperatures.

An alternative for storing digital data is to store it in a “cloud”. Cloud computing means storing your data in a server that is located in a protected and secure location off site. The site of where your information is stored can be physically very far from you, including overseas. You can then access your information from anywhere, as long as you have access to the internet or other digital network depending on how you have set it up.

Aside from storage of your digital information, it’s also important to make sure you have proper data protection measure in place to protect your data from hackers and other malicious data attacks. If you're connected to a network, try to have:

  • proper up-to-date virus protection
  • secure networks and firewalls
  • secure password protection procedures.

If you're unsure how to protect your digital data, talk to a security service provider.

Find out more

Business insurance

Taking out comprehensive insurance for your business is essential to your business continuity planning. It’s important to make sure you take out the right insurance to protect your business.

The types of insurance required for running your business will vary depending on:

  • the type of business you’re running
  • the structure of your business
  • its size
  • the industry you belong to.

Some of the types of insurance are compulsory, including:

Even if insurance is not compulsory, it’s still a good idea to take out the right insurance to protect your business.

Public Liability

Public liability insurance protects you and your business against the financial risk of being found liable for negligence. Negligence is when you haven’t taken actions to prevent reasonably foreseeable harm, including:

  • injury or death, such as due to an unmarked hazard causing injury to a customer
  • negligent advice, such as saying a company or employee is performing well when they’re not
  • nervous shock, such as emotional distress or a recognised psychiatric illnesses
  • property damage, such as not having safety measures in place for an activity which causes a fire.

Workers’ compensation (if you have employees)

If you’re an employer, you must take out workers' compensation insurance to protect your employees against financial hardship as a result of a workplace accident.

In most cases, you will need to provide workers’ compensation insurance for accidents and sickness through an approved insurer. Workers’ compensation is covered by separate state and territory legislation.

Find further information regarding each state’s workers’ compensation requirements:

Find out more

  • Check out the list of insurance that you can consider for your business on the Business Queensland website.
  • For more information on different insurance needs for business, visit business insurance.
  • Talk to a number of insurance companies, brokers or your industry association to find the best insurance to take out for your business and situation.
  • Read more about product liability on the Product Safety website.
  • Read Selling products and services for information on product safety, product recalls and trade measurement and labelling.

Thanks for your feedback. If you have any ideas on how we can improve, we'd love to hear them.

Please provide your comments in the feedback form.