The Director's Guide to Business Continuity Planning

Most directors have a continuity plan that exists entirely in their head, which is another way of saying they don't have one. If you're the single point of failure for what happens when the internet goes down, a key supplier disappears, or you personally can't work for six weeks, the business isn't running on a plan. It's running on hope.

Quick Answer

Business continuity planning means identifying the events that could stop the business operating, mapping the financial and operational impact of each, and pre-building the response before it's needed. For established businesses, the highest-priority risks are usually owner incapacity, key supplier failure, cash flow shock, and system or data loss. A plan that exists only as intent, not a written, tested document, isn't a plan at all.

The 6 Things Directors Need to Know About Continuity Planning

A continuity plan is only real once it's written down and tested, not just understood informally.
Owner incapacity is the most commonly ignored risk, and often the most damaging.
The plan should cover financial runway, not just operational steps.
Cyber and data loss now belong in every established business's continuity plan.
Sole directors carry a continuity gap that multi-director businesses don't face the same way.
The businesses that recover fastest from disruption are the ones that built the plan before they needed it.

The 4 Risks Every Continuity Plan Needs to Cover

Owner or key person incapacity. What happens if you, or another person the business depends on heavily, can't work for an extended period, through illness, injury, or worse. This is the risk directors are least likely to have planned for, because it's the one they least want to think about.
Key supplier or system failure. What happens if a critical supplier goes under, a core piece of software fails, or a key piece of infrastructure becomes unavailable without warning. Dependency concentration here is often invisible until the day it matters.
Cash flow shock. What happens if revenue drops sharply for one or two quarters, a major client is lost, or receivables slow dramatically. Without a pre-identified financial runway, this risk turns into panic decision-making in real time.
Data loss or cyber incident. What happens if client data is compromised, systems go down, or the business is locked out of its own operational infrastructure. This risk has grown faster than most continuity plans have been updated to reflect.

Director Rule: A risk you haven't written down isn't a risk you've planned for, it's a risk you've just been lucky enough not to face yet.

Turning that list into an actual plan starts with knowing exactly how much time each risk gives you to react.

Step 1: Map the Financial Runway for Each Risk

Before building a response plan, know exactly how long the business survives under each scenario. If revenue stopped entirely tomorrow, how many weeks of operating expenses does the business have covered before serious decisions become forced rather than chosen.

Run the numbers on it directly. A business with $80,000 in monthly operating costs and $160,000 in accessible reserves has an eight-week runway before a cash flow shock becomes an existential one, not a comfortable planning horizon at all. That number should be known in advance, not calculated for the first time during the disruption itself.

Director Rule: Runway isn't a comfort number, it's the amount of time you have to make a good decision instead of a desperate one.

Knowing your runway is only useful once you know exactly what would trigger the countdown in the first place.

Step 2: Identify the Single Points of Failure

Go through the business function by function and ask the same question of each: if this person, system, or supplier disappeared tomorrow, what would actually happen. Most established businesses find three to five genuine single points of failure once they look honestly, usually more than expected.

For each one identified, the plan needs either a backup, a documented handover process, or a deliberate acceptance of the risk with eyes open, not an assumption that it probably won't happen.

Where This Differs by Structure

In a multi-director business, single points of failure are often assumed to be covered because there's more than one director, when in practice critical knowledge or relationships may still sit with just one of them. The Established Business Assessment is built to surface exactly which single points of failure exist, and which director is actually carrying each one.

If you're a sole director, you are by definition the largest single point of failure in the business, and building a continuity plan means explicitly answering the question of who runs the business, even partially, if you genuinely can't. The Single Director Business Assessment is designed specifically to map that gap and sequence what needs a backup first.

Once the gaps are mapped, the next job is deciding exactly how each one gets handled if it's ever triggered.

Step 3: Build the Response Plan Before the Event, Not During It

For each major risk identified, the plan should answer four questions in advance: who makes the first decision, what's the immediate priority in the first 48 hours, what resources or contacts are needed, and what does an acceptable recovery look like.

This doesn't need to be a lengthy document. It needs to be specific enough that someone other than you could follow it under pressure, which is the actual test of whether it works.

Director Rule: A continuity plan that only works if you personally execute it isn't a continuity plan, it's just another task depending on you.

A plan that's never been run against a real scenario is still just a document, not a tested capability.

Step 4: Test the Plan, Don't Just Write It

A written plan that's never been tested is a plan built on assumptions. Run a genuine scenario, a supplier outage, a short period where you're deliberately uncontactable, and see what actually breaks versus what the plan assumed would hold.

What breaks in the test is far cheaper to fix than what breaks during the real event. Most gaps in continuity planning are only discovered this way, not through the initial planning exercise itself, which is exactly why this week's actions include a real test, not just a document review.

Director Actions This Week

Calculate your current financial runway in weeks, based on accessible reserves against actual monthly operating costs.
Identify the top three single points of failure in the business, honestly, not the ones that are comfortable to name.
For each single point of failure, decide: backup, documented handover, or accepted risk.
Write down the first 48-hour response for your highest-priority risk, specific enough that someone else could follow it.
Schedule one small, real test of the plan this quarter, not a theoretical walkthrough.

Download the Director Playbook for the continuity planning framework directors use to map risk, runway, and response before a disruption forces the question.

FAQ

What's the biggest gap in most directors' continuity plans?
Owner or key person incapacity. It's the risk directors are least likely to have addressed, despite often being the most damaging if it occurs.

How much financial runway should a business have?
There's no universal number, but knowing the actual figure in weeks, calculated against real operating costs, matters more than hitting a specific target.

Does a continuity plan need to be a formal document?
It needs to be written down and specific enough that someone else could follow it under pressure. It doesn't need to be lengthy to be effective.

How often should a continuity plan be reviewed?
At least annually, and immediately after any material change to the business, a new key supplier, a new system, or a shift in revenue concentration.

Is continuity planning different for a sole director business?
Yes. The owner-incapacity risk is more acute, since there's no co-director to absorb decision-making if the sole director genuinely can't work.

What's the fastest way to test a continuity plan?
Run a small, real scenario, a short period of being deliberately uncontactable, or a supplier substitution test, and see what actually breaks versus what the plan assumed.

Should cyber risk be part of a general continuity plan or a separate one?
It belongs in the general plan. Treating it separately usually means it gets less attention than operational risks, despite carrying comparable or greater potential impact.

The businesses that recover fastest from disruption aren't the ones that got lucky. They're the ones that mapped the risk, the runway, and the response before they needed any of it. If you want your continuity gaps identified clearly, apply to become a client.

Benjamin Collins is a financial adviser and director who has held 17 directorships since 2014. He advises established Australian business owners on strategic, financial, and governance decisions.