How to build a basic business continuity plan even on a limited budget
You do not need consultants or specialist software to build a credible BCP. A four-phase, one-week plan any organisation can execute with the people they already have.
Definition
Minimum viable BCP — a BIA, response strategies, a communications plan, and a documented procedure for the most likely disruption. Built in a week of leadership time, with no consultants or specialist software. Better than nothing — which, with no current plan, is the only test that matters in the first iteration.
Most organisations do not have a business continuity plan. The most common reason given is cost — the assumption that proper BC planning requires expensive consultants, specialist software, and certification fees. The assumption is wrong, and it is dangerous.
A capable owner-manager and a small leadership team can produce a usable plan inside a week of focused work, using tools they already own. The cost of not having one is measured in survival statistics — and the statistics are not kind.
"The most expensive BCP is the one you're writing after the incident has already started."
The minimum viable BCP — four components
Business Impact Analysis
Which functions are critical, what the MTPD is for each, what each depends on. The evidence base everything else rests on.
Response strategies
What you will do for each critical function if it is disrupted. Specific, named, numbered.
Communications plan
Who calls whom, in what order, with what information, using which channels. Pre-approved holding statements help.
Procedure for top scenario
A documented response for your most likely disruption — written and accessible without the primary IT systems.
Phase 1: BIA — one afternoon
Gather the people who know the business. List every function. Mark which are critical (if unavailable for 24 hours, would cause significant damage). For each critical function ask: What is the MTPD? What would we do if this were unavailable? What does it depend on? Document in a spreadsheet and get sign-off by business owners, not just IT.
Phase 2: Risk assessment — one afternoon
Identify the top five most likely disruption scenarios: key person unavailability, IT or cyber incident, office inaccessibility, supply chain failure, public health events. Score each by probability and impact on critical functions. Focus response planning on the top three.
Phase 3: Response strategies — one day
Be concrete. Who does what — name them. Using which tools — name them. In what sequence — number the steps. If the CRM is unavailable, the sales team uses the spreadsheet backup exported weekly to a named cloud drive by a named person. Vague plans fail. Specific plans reveal gaps that can be fixed. Both outcomes are progress.
Phase 4: Documentation — one day
Compile into a single document. It must be findable (accessible in five minutes from any location, without the corporate network), readable under pressure (short paragraphs, decision trees, one-page summary at front), and accessible without the primary IT systems (printed copy, cloud copy with offline access, copy with a trusted third party).
The ongoing cadence
Quarterly: review contact details, fifteen minutes. Annually: scaled-down BIA update. Every two years minimum: tabletop exercise — one hour, realistic scenario, the people who would actually respond.
Closing
The best BCP is the one you have. It does not need to be comprehensive, beautiful, or certified. It needs to reflect your actual business, cover your most likely disruption scenarios, name the people who will execute it, and be accessible when you need it most. Spend one week building it. Then test one piece of it. Then improve. That is how business continuity is built — incrementally, honestly, and practically. The businesses that survive disruption will not be the ones with the most expensive plans. They will be the ones who started.