Business Continuity Checklist for Australian Small Business

Use this checklist to identify the minimum your business needs to keep operating through disruption and recover in a controlled way. Adapt it to your industry, legal obligations, location and risk profile.

Critical functions

• List the products, services and obligations that must continue.
• Set a maximum tolerable interruption for each.
• Define the minimum acceptable service during disruption.
• Record the people, systems, data, suppliers and locations each function needs.

People and decision-making

• Name an incident lead and backup.
• Set emergency decision and spending authorities.
• Keep current staff and contractor contacts.
• Cross-train critical work and test the backup.
• Record welfare and safety procedures.

Customers, suppliers and advisers

• List priority customer and supplier contacts.
• Identify single-source and long-lead-time supplies.
• Agree alternatives where practical.
• Keep insurer, accountant, bank, legal and technology contacts accessible.
• Prepare customer and supplier communication templates.

Systems, cyber and data

• Inventory critical systems and account owners.
• Use secure, role-based access and multi-factor authentication.
• Back up essential data and test restoration.
• Keep an offline or separately accessible contact list.
• Define the minimum communications and applications required.

Cyber.gov.au’s Business Continuity in a Box provides an interim approach to critical communications and applications after a cyber incident. It does not replace a business-specific continuity plan.

Finance and insurance

• Maintain a rolling cash forecast.
• Record upcoming payroll, supplier, tax and debt obligations.
• Review insurance coverage, exclusions and claim contacts.
• Define emergency spending limits.
• Identify which costs can be paused and which cannot.

Locations, equipment and records

• Record alternatives if the usual workplace is unavailable.
• List critical equipment and replacement options.
• Protect licences, registrations, contracts and financial records.
• Confirm emergency procedures and safe assembly arrangements.

Response and recovery

• Define the first actions for your main scenarios.
• Record who communicates, to whom and when.
• Prioritise services to restore.
• Keep an incident log of decisions and costs.
• Set a recovery review and assign actions.

The Australian Government’s emergency management planning guidance covers continuity, immediate action and recovery, with a downloadable template.

Test and maintain

• Run at least one realistic scenario.
• Update the plan after staff, system, supplier or location changes.
• Review contact details and backups regularly.
• Record lessons after every disruption or test.

For the method behind the checklist, read how to create a business resilience plan and how to reduce key-person risk. Connect continuity to the full sustainable small business guide.

General information only. Every business is different; use your own figures and seek professional advice where appropriate.