Business Continuity Planning for Charities: A Practical Guide | LegalDocuments.co.uk

Overview

A business continuity plan for a charity is a written framework that sets out how the organisation will keep critical functions running when something disrupts normal operations. It is not the same as a disaster recovery plan (which tends to focus narrowly on IT systems) and it is not the same as a risk register (which lists threats without necessarily saying what you will do about them).

A BCP sits between the two: it identifies the services and activities that absolutely must continue, the minimum resources needed to keep them going, and the people who will make decisions when the pressure is on. For charities specifically, the plan needs to reflect the charitable objects.

If your mission is to feed vulnerable people or provide emergency accommodation, continuity is not just an operational preference, failing to deliver may mean real harm to beneficiaries. The Charity Commission expects trustees to manage risk in a way that is proportionate to the charity's size, income and activities.

A small community group does not need the same 80-page document as a national charity with multiple sites, but both need something written down, tested, and reviewed.

Key steps

1. Identify your critical activities. Start by listing every service, activity and function the charity delivers, then mark which ones cannot stop without causing significant harm to beneficiaries, breaching funder agreements, or damaging the charity's reputation. Be honest, not everything is critical, and trying to protect everything equally means protecting nothing well. This prioritisation is the foundation of the whole plan.
2. Assess the threats that matter to your charity. Work through the realistic scenarios that could disrupt those critical activities: loss of premises, IT failure or ransomware, loss of a key member of staff, supply chain failure, a safeguarding incident, funding withdrawal, or a reputational crisis. For each, think about likelihood and impact. A charity with one paid member of staff faces very different risks from one with fifty, and your plan should reflect that reality rather than a generic template.
3. Decide on mitigation and response measures. For each significant risk, set out what you will do to reduce the chance of it happening and what you will do if it does. This might include cloud backups, dual signatories on bank accounts, cross-training between staff, reserves policies, insurance cover, alternative premises arrangements, or pre-agreed communications templates. The point is to make decisions in calm conditions so you are not improvising in the middle of a crisis.
4. Set clear roles, communications and escalation routes. A plan that does not say who does what is not really a plan. Identify who leads in a disruption, who deputises if they are unavailable, how trustees are notified, and how you will communicate with beneficiaries, staff, funders, regulators and the press. Include out-of-hours contact details and a documented process for reporting serious incidents to the Charity Commission where the reporting threshold is met.
5. Test, review and record. A continuity plan that sits in a drawer is worse than useless because it creates false confidence. Run tabletop exercises at least annually, update the document after any real incident or significant change to the charity, and present it to the trustee board for formal review. Keep a dated version history so you can evidence that the trustees are actively managing risk, which is what the Charity Commission expects to see.

Common questions