Create a business recovery plan

A recovery plan will help you respond effectively if an incident or crisis affects your business. It aims to shorten your recovery time and minimise losses.

Definition of business recovery

Business recovery is the return to operations following an incident, crisis, disaster, or significant event.

A business recovery plan is a pre-designed plan that includes:

setting timelines to restore critical functions
strategies to trade at pre-incident levels as soon as possible

Your recovery plan is part of your business continuity plan that outlines practical strategies to help you manage and stage a recovery from a crisis.

Thumbnail of business continuity planning Word template

Download the business continuity plan template

This template includes a Recovery section.

Use this page to consider how your business can recover from a crisis, then complete the recovery section of the template.

Download the business continuity planning template.

Business recovery planning

In some cases, such as a pandemic, there may be several steps and stages of recovery. For example, a lockdown may occur several times and the business will need to recover operations as quickly as possible after each event.

Unlike an incident response plan, the business recovery plan has a longer-term view.

The business recovery plan covers:

strategies to recover from a range of incidents
objectives around time-frames to fully recover all business functions
a description of key resources, equipment, and staff required
checklists to ensure all actions have been done.

The best method to help define recovery times is to conduct a business impact analysis and identify critical business activities. Find out more about identifying and managing risk.

Analyse how long it will take to bring each activity back online or make operational again, for example, restoring backups of critical IT systems on your computers or replacing lost stock. Capture this in the recovery section of your business continuity plan.

Strategies from the small business disaster hub

Natural disasters:

Major health event:

pandemics
epidemics
localised outbreaks
food poisoning and contamination

Emergency:

biosecurity threats (pest and animal disease outbreaks)
workplace accidents or deaths
dangerous material spills, leaks, or explosions
loss of power or infrastructure
major transport disasters
terrorist or major criminal incidents
climate change risks

Information technology (IT) threat:

cyber-attack or data hacking
IT failure

Reputation incident:

highly negative media or social media coverage
rumour-driven crisis
inappropriate workplace behaviour (e.g. bullying, harassment)
organisational misdeeds and legal action (e.g. fraud, theft)

Designate a recovery team

As with the incident response plan, consider a team to manage business recovery.

Your team may be internal, such as the leader with clear objectives for all critical business functions, or external with advice and support from your accountant, legal representative, or business mentor.

As part of the planning, your team should receive training or advice on incident recovery and any designated tasks. This training could include skills to run the recovery remotely and the use of your emergency kits.

Clarification about who is needed for the recovery team, team training and practice drills are important parts of your preparation.

Past disasters and other incidents show that small businesses:

often need and look for external help to aid internal staff with full recovery (e.g. emergency services, banking and finance operators, council, and government assistance)
recover in different ways and at different speeds (e.g. external mental health services may form part of your recovery plan)
can struggle to make important decisions for many months (i.e. being without a clear recovery plan with achievable actions will slow down progress).

Your team should know about employment requirements and obligations before, during and after an incident or event.

Learn more about employment entitlements during natural disasters and emergencies from the Fair Work Ombudsman.

Communicating during the recovery

The recovery team should communicate as soon as possible with all staff and key stakeholders usually within the first 24–48 hours of the incident.

As the recovery commences and well after the event, it is important to communicate regularly with suppliers, customers, and internal staff. You should provide the current state of progress and any changes that you've implemented to restore operations (e.g. establishing contracts with alternative suppliers or changes to opening hours).

Stages of recovery

Business recovery after an incident may occur in stages.

Initial stage

Activities in the initial stage include:

returning to your business site only when safe
protecting yourself and your staff when returning to the site
staying alert to dangers if the emergency event is not yet resolved
monitoring emergency updates and broadcasts
working with insurance companies to assist in recovery
securing the business site if necessary and safe to do so.

Early stage

Activities in the early stage include:

working with professional advisers (e.g. accountant, business mentors to design financial recovery and approach banking or other financial support to maintain cash flow whilst recovering)
forecasting cash flow over a prolonged period (e.g. 3–36 months)
insurance rectifications to premises and equipment
relocation or 'building back better'.

Long-term stage

Activities in the long-term stage include:

re-negotiating loans
reviewing emergency plans and kits
new products and services
thanking customers, community and celebrating overcoming the incident with staff.