Continuity planning: keeping your charity running through a disruption

This guide is for the founder, director or board member who would get the phone call if the building flooded, the laptop with the donor list was stolen, or the one person who runs the food pantry was suddenly in the hospital. A continuity plan is a short, written plan for keeping your most important work going through a disruption, and getting back to normal afterward. After reading, you'll be able to name your critical work and who covers it, keep records and logins safe and reachable, check your insurance, set up a call tree, know what to do in the first 48 hours, and test the plan once a year.

People depend on small charities: a missed week at a food pantry or a shelter matters. FEMA's OPEN training (Organizations Preparing for Emergency Needs) is a 40-minute, self-guided online course designed for community-based organizations like yours. FEMA describes it as a training program "for any organization or agency looking to get started in developing an emergency operations plan." Ready.gov, run by FEMA, has the business planning guides this one draws on.

Start with what can't stop

Ready.gov breaks continuity planning into six steps: prepare to plan, define objectives, identify and prioritize risks and impacts, develop strategies, define teams and tasks, and test the plan. For a small charity, that starts with two short lists.

Your critical work. Write down the three to five things that must keep happening, or restart within days, even in a bad week. For example: meals delivered on Tuesdays, payroll on the 15th, the hotline answered, grant reports due this month. Ready.gov calls this a business impact analysis: working out what happens if each function stops, and for how long you could cope.

Your likely risks. Ready.gov describes a risk assessment as "a process to identify potential hazards and analyze what could happen if a hazard occurs." Think about what's realistic where you are: storms, flooding, fire, a power or internet outage, a cyberattack, losing your space, a supplier or partner that suddenly can't deliver, or a key person who is suddenly unavailable.

Key people and their backups

In a small charity, one person often holds a whole job in their head. For each critical task, name:

• the person who does it now;
• a backup who has been shown how, at least once;
• where the instructions are, in a few plain steps.

Cross-training key people is one of the ten actions FEMA's OPEN training covers. It doesn't need to be formal. Have the backup do the task once, with the usual person watching, and write down anything that wasn't obvious.

Planning for losing a leader, permanently or for months, is a bigger job. Our succession planning guide covers an emergency succession plan, a how-we-run-things binder and safe shared access to the bank.

Records and logins, safe and reachable

If your office is closed or a laptop is gone, can someone else get to what they need? Ready.gov's IT recovery guide says "data should be backed up frequently," and suggests scanning important paper records into digital form.

• Know what matters. Ready.gov says a backup plan "begins with identifying what data to backup." Typically: donor and client records, financial records, board minutes, your IRS determination letter, insurance policies, leases and contracts, and grant agreements.
• Back up regularly, and keep a copy somewhere else. If your files live only on one computer or in one office, a single fire takes everything.
• Share logins safely. Use a password manager with a shared vault, so at least two trusted people can reach the bank, email, website, donor database and social accounts. Never keep passwords in a shared document or on sticky notes. Our cybersecurity guide explains how.
• List the software and equipment you depend on, so you know what to replace first. Ready.gov says IT recovery priorities "should be consistent with the priorities for recovery" of your critical work.

Check your insurance before you need it

The time to learn what your policy covers is before the fire, not after. Ready.gov's insurance discussion form is a one-page worksheet for a talk with your agent. For each policy it asks you to note the policy number, deductibles, limits and what it covers, and it asks three questions:

• Do you need flood insurance?
• Do you need earthquake insurance?
• Do you need business income and extra expense insurance? Ask your agent what it would pay for if you had to close or move for a while.

Ask your agent what each policy does and doesn't cover, and keep a copy of every policy with your backed-up records. Our insurance basics guide explains the main kinds of cover for charities.

A communication tree

When something happens, people need to hear from you quickly, and the same message from everyone. Ready.gov says contact information for each audience "should be compiled in advance and be accessible during an incident," and that lists "should be updated regularly and secured."

Make a simple call tree on one page:

1. Who starts it. Usually the director or board chair, with a named backup.
2. Who calls whom. Each person calls or texts two or three others, so no one has to reach everyone.
3. Who else to tell. Staff and volunteers, the people you serve, the board, key funders, your landlord, your insurer and partners.
4. How. Phone and text first, then email, your website and social media. Have a second way to reach people if one fails.

Keep a printed copy and a copy on each key person's phone. Ready.gov also suggests giving whoever answers calls a short script and a list of answers to common questions, so everyone says the same thing. If the disruption is public or sensitive, our crisis communications guide covers what to say and when.

The first 48 hours

Put this on one page, with the call tree:

1. Make sure people are safe. Staff, volunteers and the people you serve come first. Call 911 if anyone is in danger.
2. Start the call tree. Tell your team what happened, what you know and when they'll hear from you next.
3. Decide what keeps going. Look at your list of critical work. Which pieces can continue, move, or pause for a few days?
4. Tell the people you serve. If a program is paused or moved, say so plainly, and point them to other help nearby if you can.
5. Call your insurer. Report the loss early, take photos and keep receipts for everything you spend.
6. Secure money and data. If there's any chance of theft or a hack, change passwords and tell your bank.
7. Tell your board and key funders. Most funders would rather hear early. Ask what flexibility they can give on deadlines.
8. Write things down. Keep a simple log of decisions, costs and who you talked to. It helps with insurance, funders and the next plan.

Test it once a year

Ready.gov says "tests should be conducted to validate that business continuity recovery strategies will work," and calls training, testing and exercises "essential components of preparedness." FEMA's OPEN training lists regularly testing and updating your plans among its ten actions.

Once a year, perhaps at a board meeting, try a short tabletop exercise: someone reads out a scenario ("The building is closed for two weeks after a burst pipe"), and the group talks through what they'd do, using the plan. Then:

• run the call tree for real, and note who couldn't be reached;
• check that a backup person can log in to the key accounts;
• restore one file from your backup;
• update names, phone numbers and the insurance details.

Fix what didn't work, and change the date on the plan.

Your continuity checklist

• We've listed our three to five most critical tasks
• Each critical task has a named backup who has done it at least once
• Short written instructions exist for each critical task
• Important records are backed up regularly, with a copy kept off-site
• At least two trusted people can reach key accounts through a password manager
• We've reviewed our insurance with our agent, including flood and business income cover
• We have a one-page call tree, printed and on key people's phones
• We have a one-page plan for the first 48 hours
• We tested the plan this year and updated it afterward