Business Continuity Management for charities

Business Continuity Management is about identifying risks to your charity and then taking steps to minimise those risks. 

Doctors prepare to treat patients with Ebola

Doctors prepare to treat patients with Ebola. A large-scale outbreak of a highly infectious illness could happen at any time. (Photo: CDC Global via Flickr, CC BY 2.0)

By Annette McGill

Business Continuity Management (BCM) is an important  component of good charity governance: charities should have a process in place to identify risks and plan how to respond.

BCM: a definition 

This is a commonly accepted definition of BCM:

BCM is an holistic management process that
a)  identifies potential impacts that threaten your organisation
b)  provides a framework for building resilience and the capability for an effective response that safeguards
   - the interests of your beneficiaries and stakeholders  
   - your charity's reputation & brand 
   - your organisation's income-generating activities.

BCM brings together the disciplines of risk assessment, emergency response, disaster recovery and business continuity.

Why is BCM getting more important

  • Climate change impacts: extreme weather events are occurring more often 
  • Terrorism: the government says there is a sustained threat of terrorist events
  • Pandemics: regular large-scale outbreaks of infectious diseases
  • Supply chain complexity: longer supply-chains and outsourcing of services can mean that impacts can come from many sources
  • Digital technology: greater reliance on any one resource - in this case  i.t. and data - can increase vulnerability to disruption
  • Insurance: insurance companies increasingly want to see evidence of business continuity planning 
  • Governance: risk management requirements, trustees' awareness
  • Stakeholders: your service-users may need additional support and safeguarding

Seven steps to start on BCM

How to start on BCM:

  1. Introduce: Discuss the need for BCM at senior level and assign responsibility. BCM will require staff time and may involve additional expenditure.  A senior person should have ownership of the business continuity plan and be able to ssemble small team to work on BCM.
  2. Assess risks: Review your charity’s activities and identify critical operations. Identify risks and how a worst-case scenario would impact each area.
  3. Identify responses: For each risk, set out what action  your charity will take. Prioritise critical functions.
  4. Plan: Identify what processes and resources your charity needs to put place in order to achieve resilience and implement them. There may be additional costs involved, such as paying for backup services. 
  5. Document and communicate: compile key information into a BCM pack (see below) inform staff and stakeholders about your BCM plans, train key staff.
  6. Test: don’t assume, test your proposed measures.  Testing can include regular fire drills, testing your emergency communications chains - eg a staff WhatsApp group and "walking through" a specific risk scenario with a group of key staff to see how your planned response works.
  7. Maintain: new and different threats will keep emerging, review your BCM plans at least annually and whenever new risks emerge or your charity undergoes significant changes.

The vital importance of documentation and communication

A great plan is no use if nobody knows about it! 

Documenting and communicating your BCM planning is essential if it is to be effective. 

Communicate your BCM plans to senior staff and key people in each area of your charity. Ensure they know where to find critical information and what their next actions should be.

A basic business continuity pack

Your business continuity pack can be distributed to key staff in hard copy and online. Also ensure that at least one copy of this pack is stored safely and securely in an off-site location.


  • A copy of your detailed business continuity plan
  • Emergency contact details for all staff (,home, mobile phone numbers and email addresses) and any emergency contact chains.
  • A site plan with information the shut-off points for utilities 
  • Emergency contact details and key details needed for:

    1. Emergency services

    2. Local authorities

    3. Utility companies

    4. Key contractors, eg plumbers, glaziers

    5. Travel advisors

    6. Insurance

    7. Banks 

    8. Legal advisors


The Government has prepared a Business Continuity Management Toolkit (PDF) which you can use to get started. 

The British Standards Institute has published the standard ISO 22301 for BCM

The Business Continuity Institute has a selection of resources on its website. 

The London Resilience Partnership brings together over 170 organisations which have specific responsibilities for preparing for, and responding to, emergencies. Its website offers advice on protecting your organisation and planning for emergencies.

More on safety and risk: 

How to do a risk assessment