What Is a Business Continuity Plan, and Does a Small Organization Need One?

The volunteer schedule is somewhere in Martha's inbox, the registration system sends login codes to her phone, and nobody knows who can approve last-minute changes. Poor Martha is supposed to be resting, but apparently she's also the organization's emergency help desk.

The thing is, someone else on the team could probably run the program if they had the information and access they needed. But small organizations have a habit of letting whoever set something up become the person responsible for it indefinitely. Before long, nobody else knows where the instructions are, how the system works, or even whether they're allowed to step in.

And when you're already short on people, hiring someone to cover every possible absence isn't exactly a realistic solution.

So, how do you make sure essential work can continue when someone or something becomes unavailable?

What Is a Business Continuity Plan?

A business continuity plan (BCP) is a document explaining how an organization will maintain or restore essential operations when something interrupts its normal activities.

Despite the name, business continuity planning also applies to nonprofits, charities, associations, and other organizations that provide services without operating as traditional businesses.

A plan might cover unexpected employee absences, prolonged internet outages, inaccessible offices, failed software, lost organizational accounts, or interruptions involving service providers. It identifies which responsibilities need immediate attention, who can take over, and what resources are available.

For a small organization, this could be as straightforward as assigning someone to cover a scheduled program, making sure another authorized person can access important records, or documenting what to do when an essential system becomes unavailable.

Does a Small Organization Really Need One?

Yes, although the plan should reflect the organization's actual size, responsibilities, and risks.

A nonprofit with two employees and several volunteers probably doesn't need the same documentation as an organization operating multiple facilities. But having fewer people means you have fewer options when someone is unavailable.

Think about how your organization operates. Is the executive director the only authorized signer on the bank account? Does your website administrator use a personal email address for important account registrations? Could anyone else process payroll if the person responsible were suddenly unavailable?

You might already have people who could help with these responsibilities, including other employees, authorized board members, or outside service providers. The question is whether you've made the arrangements necessary for them to do so.

Surely, we can arrange things so somebody can take a day off without the entire organization needing their phone.

Identify Which Operations Need to Continue

Start by listing the activities your organization cannot afford to interrupt for very long.

For a nonprofit delivering community services, that might include beneficiary assistance, scheduled program activities, payroll, access to essential records, and communications with staff or volunteers.

Other activities may be important but can reasonably wait a few days. Your team might postpone a routine newsletter without significantly affecting operations, for example, while losing access to participant contact information on the morning of a food distribution could prevent staff from coordinating the service.

This assessment is part of a business impact analysis (BIA), which helps organizations understand the consequences of interruptions and decide what needs to be restored first.

Here's what that might look like:

Your priorities will depend on the services you provide. A nonprofit delivering emergency assistance may need certain operations restored within hours, while an organization running educational workshops might be able to reschedule activities without significantly affecting participants.

How Long Can Your Organization Afford to Be Offline?

Suppose your organization relies on an online registration system. A two-hour outage might be manageable using an approved attendance list, but losing access for three days could interfere with registrations, participant communications, and upcoming events.

Two concepts help establish recovery expectations:

• Recovery Time Objective (RTO): How quickly a system or service should be restored.

• Recovery Point Objective (RPO): How much data loss, measured in time, your organization can tolerate.

For example, if your donor database has an RTO of 24 hours, your recovery arrangements should aim to restore it within that period. If its RPO is four hours, your backup strategy should aim to prevent losing more than four hours of recorded changes.

These are planning targets, not fixed requirements. Choose them based on how essential each system is, how frequently its information changes, and what your organization can realistically restore.

What Should Your Business Continuity Plan Include?

Once you've identified your essential operations, you can organize the plan into five sections. You don't need to write a manual for every possible emergency, but whoever takes over should have enough information to do the work without guessing.

1. Staff Coverage and Decision-Making Authority

Start with the responsibilities that can't sit unattended for several days, such as payroll, financial approvals, beneficiary assistance, and scheduled programs.

Create a responsibility list showing who normally handles each activity, who takes over when they're absent, and where the instructions are stored. If Martha coordinates community programs, for example, assign someone who can manage volunteer attendance, communicate with suppliers, and handle scheduling changes when she's unavailable.

But, don't just write someone's name next to Backup Coordinator and assume everything is settled. Have that person walk through the actual procedure with Martha. Can they find the volunteer roster? Do they know which supplier to contact? Are they allowed to make changes to the program schedule?

For financial decisions, document approval limits and any restrictions established in your nonprofit's bylaws or board policies. Someone may be qualified to prepare a payment without being authorized to release it, so those permissions need to be arranged in advance.

2. Access to Essential Accounts and Information

Open a spreadsheet and list every account your organization would struggle to operate without. Include email, domain registration, website hosting, financial software, file storage, fundraising systems, and program databases.

For each account, record the following:

• Account ownership: Who legally or contractually controls it?

• Access: Who is the primary administrator, and who has backup access?

• Recovery: Where are the instructions and approved recovery methods?

• Support: How can the provider be contacted if normal access fails?

Then check whether the backup person can sign in using their own authorized credentials.

Let's say, Martha manages the program registration system. The person covering for her should have their own account with the permissions required to view registrations and perform their assigned tasks. They shouldn't have to borrow Martha's password or ask her to forward a verification code.

You may also discover that your website administrator has full access while everyone else has limited permissions, or that your domain registrar sends verification codes to a former employee's personal email.

Fix those problems while the accounts are accessible. Keep passwords and recovery codes in an organization-controlled, access-restricted password manager or another secure arrangement, rather than writing them into the continuity document. Set up multifactor authentication and recovery methods that don't depend entirely on one person's phone.

3. Data Backup and Recovery

Decide which information your organization would need first if its systems became unavailable. For a nonprofit, that may include payroll files, donation records, participant schedules, financial documents, and essential program information.

Document where each set of records is stored, how frequently it's backed up, who manages the backup, and who can restore it.

A backup is only useful if you can recover the information. If your shared drive contains three years of program records, try restoring a sample file and checking that it opens correctly. If your donor database provides exports or a dedicated backup service, confirm what the backup includes and whether the recovery procedure meets your organization's needs.

The backup arrangement should also fit how the information is used. If your team needs participant information during an outage, decide beforehand whether an approved, limited-access offline copy is appropriate and how that copy will be secured, updated, and disposed of afterward.

Store backups securely, with enough separation from the original systems that accidental deletion, unauthorized access, or malware is less likely to compromise every copy. Sensitive donor, beneficiary, and employee information still needs protection during emergencies.

Record the last successful recovery test and who's responsible for the next one. If you suspect a cyberattack, contact the designated technical or incident-response person before attempting restoration.

4. Emergency Communication Procedures

Decide how your organization will contact people when its usual communication tools are unavailable.

Start with the groups you might need to reach: employees, volunteers, board members, program participants, vendors, and service partners. Keep essential contact information in a secure location that authorized staff can access even if the organization's main email or shared drive is down.

Next, decide who sends updates and which alternative channel they should use.

For Martha's program, the backup coordinator should know how to contact volunteers if the schedule changes, who can authorize a postponement, and how participants will be notified. If organizational email stops working, staff should already know which approved phone or messaging arrangement to use.

You can also prepare short message templates for common situations, such as a program postponement or temporary service interruption. That saves staff from writing everything from scratch while trying to resolve the problem.

If an incident involves confidential information or financial systems, identify who will assess whether formal notifications are required. Depending on the circumstances, that may involve the executive director, board leadership, and appropriate technical or legal advisers.

5. Returning to Normal Operations

When a system comes back online, review what your team did while it was unavailable.

Suppose Martha's backup used an approved spreadsheet to record registrations during an outage. Before everyone returns to the usual system, someone needs to compare the spreadsheet with the restored records, enter missing information, and check for duplicates.

Use the same approach for other interrupted activities. Keep a temporary log of payments awaiting approval, requests handled manually, messages that still need responses, and records that must be transferred back into their usual systems.

The person responsible for each activity should confirm that the outstanding work has been completed and that the restored information is accurate. For financial transactions, reconcile temporary records against the appropriate accounting and banking records.

Once everything is checked, record when normal operations resumed. If the team discovered that the backup instructions were outdated or an important contact was missing, update the plan while everyone still remembers what happened.

So, What Happens to Martha's Program?

Well, if the nonprofit had prepared these arrangements beforehand, the team would have a much better chance of running tomorrow's program without her.

The designated backup could access the volunteer roster, confirm attendance, contact suppliers, and retrieve the registration information through their own authorized account. They'd also know which decisions they could make independently and when to involve the executive director.

If the registration system became unavailable, the backup could follow the approved temporary procedure and document any changes for later reconciliation. If the disruption made the activity unsafe or impossible to deliver properly, the designated decision-maker could postpone it and notify participants.

Of course, the program might still need adjustments. Having a continuity plan doesn't guarantee that everything will go perfectly, particularly when several problems happen at once. But the team would have a process to follow, and Martha could stay home without becoming the organization's emergency help desk.

How Often Should You Review the Plan?

Review your continuity plan at least annually and whenever staffing, systems, or essential services change.

You can also test it through a short tabletop exercise, where employees discuss how they'd respond to a simulated interruption. For example, assume your operations coordinator is unavailable for three working days. Ask the designated backup to explain how they would find outstanding invoices, access approved records, and arrange urgent payments.

If they can't complete a step, find out what's missing. Maybe the procedure is outdated, the backup doesn't have the necessary permissions, or nobody has confirmed who can approve the payment.

Document the problem, assign someone to resolve it, and check that the new arrangement works. There's no need to deliberately shut down your systems to find out whether the instructions are usable.

Where Should a Small Organization Start?

Ask each employee to identify three responsibilities that would be difficult for someone else to take over. For each responsibility, find out what another authorized person would need, whether that's account access, written instructions, contact information, or approval authority.

You may discover that your domain is registered under a former contractor's account, important documents are stored in an employee's personal drive, or nobody except the executive director knows how payroll is processed.

Start with those gaps and the responsibilities your organization cannot afford to leave unattended. You can build a more detailed plan as the organization grows.

It would make more sense to see a small nonprofit with a usable five-page document and a backup person who knows what they're doing than a beautifully formatted 40-page manual nobody has ever opened. And if you can get through the next scheduled program without calling someone who's home sick, then that's a pretty good start.