How to Build a Crisis Management Plan for Small Business

Three weeks before Christmas, a locksmith I know named Marc watched his entire order book vanish. His two-person workshop sat behind a rented door in a small industrial unit, and when a burst pipe flooded the unit next door, the landlord cut the power to the whole block for eleven days. No power, no CNC machine, no orders. He had no plan, no alternate workspace, and no idea who to call first. He lost roughly 40% of his quarterly revenue in a fortnight.

That story is the reason I started pestering small business owners about crisis planning. Not because I'm a consultant selling binders—I'm not. But I've watched enough of these situations up close, including one of my own that cost me a client I'd had for four years, to know that the difference between a blip and a catastrophe usually comes down to decisions you made before anything went wrong.

Building a crisis management plan for a small business is not the same job as it is for a company with a risk department and a lawyer on retainer. You don't have the staff, the budget, or the time for a 60-page document nobody will read. What you need is something shorter, sharper, and ruthlessly specific to your actual vulnerabilities.

Why a small business crisis planning template never quite fits

The generic advice floating around assumes you have layers. Layers of management, layers of insurance, layers of staff who can absorb extra work. A 12-person firm has none of that, which changes the arithmetic of a crisis completely.

When a large company loses its main supplier, a procurement team spends a week sourcing alternatives. When you lose yours, you spend the week sourcing alternatives—while also handling payroll, answering customer emails, and pretending to your team that everything is fine. The single point of failure isn't a process. It's a person. Usually the owner.

The real constraint is attention, not money

Most small business owners I've talked to assume the obstacle is budget. It rarely is. A plan costs nothing but a few focused afternoons. The genuine bottleneck is attention bandwidth: during a crisis, every decision lands on the same two or three heads, and those heads are already running on adrenaline and four hours of sleep.

So the plan's job is to remove decisions from the moment. Not to predict the future. To pre-decide.

What are the 5 P's of crisis management?

The five P's are People, Product, Process, Premises, and Profit, and they work as a quick audit grid for identifying where your business is exposed. Run each one against a simple question: if this broke tomorrow, how long before customers noticed?

• People — key-person dependency, illness, a burnout you didn't see coming, sudden resignation of the one person who knows the invoicing system.
• Product — a supplier who disappears, a quality failure, an ingredient or component you can't source for six weeks, a service that stops working after a platform update.
• Process — the undocumented steps that live only in someone's memory. This is where small firms are most fragile and least aware.
• Premises — flood, fire, power cut, lease termination, or simply being locked out of a building you don't control.
• Profit — cash flow shocks, a major client paying late, a price jump you can't pass on, insurance that turns out to cover less than you thought.

Different sources phrase the fifth P as Performance or Property. The labels matter less than the exercise. What matters is that you walk through all five with your actual business in mind, not a hypothetical one.

Running the audit in one afternoon

Block three hours. Write each P on a separate sheet or a separate note on your laptop. Under each, list every way that category could knock you offline for more than a week. Don't filter. Don't judge likelihood yet—you'll do that in the next step.

When I did this for my own one-person operation, I filled two pages. Then I crossed out everything I couldn't realistically act on and was left with nine genuine exposures. Nine. That's a list you can work with, unlike a generic 40-item risk register.

How to build a crisis management plan for a small business, step by step

The sequence below is the one I've settled on after watching plans succeed and fail. Each step produces a section of the document.

Step 1: rank your exposures and pick the top five

Score each item from your P audit on two axes: likelihood and damage. Score 1 to 5 on each and multiply. Anything scoring 15 or above gets a written response plan. Everything else goes on a watch list you review once a year.

Be honest rather than optimistic here. Most owners I've spoken with under-rate likelihood because acknowledging it feels like inviting trouble. It doesn't. It just means you've thought about it.

Step 2: name the decision-maker and the backup

One person has authority to act immediately—spend money, close operations, call customers. One person is the backup if the first is unreachable. Write both names down, along with the spending limit each can authorise without a second signature.

Spoiler alert: this is the step people skip, and it's the one that causes the most delay. In the flood scenario I mentioned at the start, nobody could authorise the cost of a temporary workspace because the owner was on a flight and the office manager didn't feel entitled to make that call. They lost four days to that hesitation alone.

Step 3: write the contact list on paper

Your list needs: key staff, key customers, your insurer, your bank, your landlord, your accountant, your main supplier, and any regulator or authority you'd be legally required to notify. Include mobile numbers, not just office lines.

Print it. Keep a copy at the business, a copy at home, and a copy in your bag. Every cloud-based contact system becomes useless the moment the thing that broke is the internet connection.

Step 4: draft your holding messages in advance

Two templates: one for staff, one for customers. Short, factual, no speculation. The point is to buy yourself time without going silent, because silence is what turns an operational problem into a reputation problem.

A workable customer message runs something like: We're dealing with an incident affecting our service today. Orders placed before [time] are unaffected. We'll update you by [time]. Fill in the blanks when it happens. Don't write the whole thing from scratch at 6am with your hands shaking.

Step 5: decide your recovery threshold now

How much cash can you access within 48 hours, and from where? Overdraft, a credit card, savings, a family loan, a payment holiday from your bank? Know the number before you need it. Most small operations discover their real liquidity ceiling only during the emergency itself, which is the worst possible moment to learn it.

What a simple plan actually contains

Here's the structure I'd defend. It fits in a thin binder or a shared folder, and it's readable in fifteen minutes under pressure.

Section	What goes in it	Length
Cover page	Named decision-maker, backup, spending limits, date of last review	1 page
Top five risks	Each with a one-paragraph response and first three actions	1–2 pages
Contact sheet	Staff, customers, insurer, bank, landlord, suppliers, authorities	1 page
Message templates	Staff message, customer message, social media holding line	Half a page
Recovery notes	Available cash, insurance policy numbers, key passwords location	Half a page

That's it. Five pages maximum. The value isn't in the document's completeness—it's in the fact that you wrote it while calm, and you'll read it while not calm.

Free templates and low-cost tools that actually work

You can find decent free crisis management plan templates from business support organisations, insurance providers, and chambers of commerce. Search for a downloadable PDF or an editable document rather than an online builder that wants your email and then charges for export.

My honest recommendation: grab a free template as a checklist of topics, then write your own content into a plain document. Templates written for generic organisations carry sections you'll never use—crisis communication trees, media liaison protocols, board escalation procedures—and they'll make you feel behind rather than prepared.

What's genuinely worth having:

1. A printed contact sheet, updated quarterly
2. A shared folder with the plan, accessible offline on at least two devices
3. A single person responsible for reviewing it once a year
4. Some form of out-of-band communication—a group chat on a personal phone, or a simple phone tree

Cost: effectively zero. Time: one afternoon to build, one hour a year to maintain.

Testing the plan without staging a full drill

You don't need a simulation exercise. You need a conversation. Once a year, pick one scenario from your top five and walk through it out loud with whoever else is involved: It's Tuesday morning, we've just discovered X. What happens next?

The gaps show up fast. Last time I did this, we realised nobody knew where the insurance policy documents were stored, which took twenty minutes to resolve—twenty minutes that would have been considerably worse mid-incident.

Then update the plan. Delete the parts you no longer need, revise the contact numbers, and put the review date on the cover page. A plan that hasn't been touched in three years is a document, not a plan.

One thing most guides omit

There's a version of a crisis plan that has nothing to do with floods or cyberattacks: the personal one. If you're the business, your inability to function is the business crisis. A short note covering who takes over your key tasks, who contacts your clients, and how they access your accounts during an extended absence is worth writing. It's uncomfortable. Write it anyway, on the same afternoon, and store it with the rest.

Marc eventually rebuilt his order book, mostly because his customers were loyal and his work was good. But he told me afterwards that the eleven days without power weren't the hard part. The hard part was the four days of paralysis at the beginning, when nobody knew what they were allowed to do. That four-day gap was entirely preventable, and it cost him more than the flood did.