Half past nine on a Tuesday night. A pipe bursts above the stockroom, water starts running down the back wall, and the first message you send is to the plumber — not to your staff, not to your customers, not to your insurer. That gap, those first twenty minutes of improvising, is where most small businesses lose the most money.
A crisis management plan for a small business doesn't need a fifty-page binder. It needs one page you can actually find at 9:30 at night. I've watched owners build elaborate documents they never opened once, and I've watched a two-page version save a business from folding after a flood. The difference was never the length. It was whether anyone had practiced it.
Key Takeaways
- A crisis plan is not a business continuity plan. The first keeps you alive for 48 hours. The second rebuilds you over six months.
- Name one person for each of the five P's: People, Process, Plan, Preparation, Practice. In a small team, one person can hold two of those roles — but every role needs a name, not a job title.
- Write a trigger threshold, not a mood. "We activate when we lose X" beats "we activate when things feel serious."
- Practice costs you an afternoon and reveals the holes nothing else will.
- Keep a printed copy. If the crisis involves a power cut or a cyber incident, your cloud document is gone exactly when you need it.
Why your small business needs a crisis management plan before something goes wrong
Larger companies survive crises partly because they have slack: cash reserves, a legal team, a communications department, someone whose entire job is handling the mess. You have none of that. When something breaks, the person dealing with it is usually the same person who runs payroll, answers the phone, and locks up at night.
That asymmetry cuts both ways. It makes small businesses more fragile — but it also means a short, well-aimed plan produces a bigger return than the same effort inside a large organization. I watched a five-person design studio recover from a ransomware attack in under a week because they'd agreed in advance which files mattered most and who would call the IT contractor. The owner told me afterward that the single most useful line in their plan was one sentence: "If we can't access email, use this phone number."
What actually counts as a crisis
Not everything dramatic is a crisis. A difficult customer is not a crisis. A supplier raising prices is not a crisis. A crisis is an event that threatens your ability to keep operating, or your reputation, or both, and that you cannot absorb with normal routines.
- Key person goes down — illness, accident, sudden departure
- Premises become unusable
- A data breach or a cyber incident
- Supply chain failure that stops you delivering
- A public complaint that spreads
- Legal action or regulatory trouble
Write your own list. Naming the scenario in advance is what makes the rest of the planning possible, because you can only prepare for what you've bothered to imagine.
What are the 5 P's of crisis management?
The 5 P's are People, Process, Plan, Preparation, and Practice. They aren't a rigid industry standard — different writers shuffle the fifth P between Practice, Prevention, and even "Publics" (your audiences). For a small business, Practice is the version worth keeping, because it's the one that exposes where the other four fall short.
Here's what each one means when you're the one doing the work, not the one writing the memo.
People: who does what, by name
Every plan fails the same way — "someone should call the insurer." Someone is nobody. Put a name next to every task and a backup name next to that. In a team of eight, one person might cover both communications and operations, and that's fine. What isn't fine is a role with no human attached.
Process: the order of operations
This is the sequence. Secure the situation, notify the right people, communicate outward, document everything. The order matters more than the detail. Getting it wrong in the first hour — posting on social media before you've told your staff — creates a second crisis on top of the first.
Plan: the document itself
Keep it to two or three pages. Contact lists, trigger thresholds, decision authority, and the first five actions for each scenario. Anything longer won't get read under pressure.
Preparation: the boring work that actually protects you
Backups you've tested. Insurance you've actually read. A signed agreement with a temporary supplier. A weekend phone number for your IT person. Preparation is everything you do before the crisis, which is why it's the P most often skipped — it has no visible payoff until the day it does.
Practice: the P that separates plans from wishes
Run one scenario a year, even if it takes ninety minutes. Pick the most plausible threat, walk through it out loud, and watch how fast the plan falls apart. In my experience, the first run always reveals at least one contact number that's dead and one decision nobody has authority to make.
How to build your crisis management plan, step by step
Two hours at a kitchen table gets this done. Not perfectly — done.
- List your top five scenarios. Rank them by likelihood, not by drama. A burst pipe is more likely than a lawsuit.
- Name your triggers. For each scenario, write the specific threshold that activates the plan. "Two staff out sick on the same day." "Card payments down for more than an hour." Objective conditions, not feelings.
- Assign roles. One decision-maker, one communicator, one person keeping records. Everyone else keeps working.
- Write your first five actions per scenario. Five is enough. If you need fifteen, the plan is too complicated to use.
- Consolidate your contacts. Staff, insurer, landlord, bank, IT, lawyer, key customers, key suppliers. Put them on one page, alphabetically, with backup numbers.
- Print it. Fold it. Store it somewhere physical.
Spoiler alert: step five is where most owners discover they don't have a direct number for half the people they depend on. Fixing that alone is worth the exercise.
Crisis plan or business continuity plan — which do you need?
Both, eventually. But they answer different questions, and confusing them is a common mistake.
| Crisis management plan | Business continuity plan | |
|---|---|---|
| Time horizon | First hours and days | Weeks and months |
| Main question | How do we stop this getting worse? | How do we keep trading while we recover? |
| Covers | Decisions, communication, containment | Alternative premises, supplier backups, cash flow |
| Length | Two or three pages | Longer, more detailed |
| Review cycle | Annually, plus after any incident | Every six months |
| Priority for a small team | Build this first | Build this within the first year |
If you only have bandwidth for one, build the crisis plan. It's shorter, it's cheaper, and it covers the window where mistakes cost the most.
The mistakes I see most, and what each one costs
The most expensive error isn't a missing plan. It's a plan built for a company you don't run — full of roles you'd need to hire for and procedures copied from a template written for a corporate client.
Second most expensive: no single decision-maker. When two people both think they're in charge, you get contradictory messages to customers, duplicated calls to the insurer, and a delay measured in hours.
Third: treating communication as an afterthought. In a small business, the owner's voice is the brand. A short, honest message to customers — even one that says "we're dealing with a problem and here's what it means for your order" — costs you nothing and protects the relationship. Silence does the opposite.
And there's one failure nobody talks about: the plan that exists but sits in a shared drive nobody can open. One client of mine had a genuinely good plan. It was in a folder on a server that went down with the office network. The printed version sat in a drawer in the same building. Since then I always argue for two copies in two places.
Keeping the plan alive without making it a burden
A plan that isn't reviewed becomes fiction fast. Numbers change, people leave, suppliers get replaced.
- Set a yearly review. Put it in the calendar as a recurring appointment, not a vague intention.
- Update contacts whenever someone joins or leaves. Takes two minutes.
- Run a scenario after any real incident. Fifteen minutes of "what would we do differently" is worth more than an hour of theory.
- Review after any structural change — new premises, new software, new key client.
Honestly, the maintenance is where most owners quietly give up. The trick is keeping the document short enough that updating it feels trivial. A two-page plan you revise in five minutes beats a forty-page one you dread opening.
The test isn't whether your plan looks impressive. It's whether a member of your team could find it, read it, and take the first correct action without calling you first. If the answer is no, you don't have a plan yet — you have a document. The gap between those two things is exactly where a small business lives or dies, usually on a Tuesday night, usually with water running down the back wall.
