Small business owners review crisis management plan on paper and laptop

How to build a crisis management plan for small business

Thursday, January 19, 2023

Despite the expectation of recession and continued supply chain issues, almost half of small business owners are optimistic about the future. They’re also not slowing down. According to research from the Small Business Administration (SBA), the number of small businesses has bounced back to pre-Great Recession levels and recovered almost all of the net jobs lost to COVID-19 in 2020.

Is it any surprise? Pushing through turbulent headwinds is what entrepreneurs like you do. But just because resilience is in your blood doesn’t mean you can’t use a little help getting back on track when the proverbial you-know-what hits the fan.

That’s where having an effective crisis management plan comes in handy. And building one can be easier than you may think. Read on to learn:

Let’s get started.

Gather your crisis team

While you may be tempted to tackle crisis management planning alone, it’s important to include other key players from the very beginning. Not only can they identify the types of crises that should be included in the plan, they can also help design solutions using a level of expertise only they have.

Crisis management team meets to brainstorm and create crisis management plan

For example, if your business falls victim to a ransomware or other cyberattack, your ability to accept or fulfill customers’ orders could be crippled – and their information exposed. Naturally, your IT manager will need to troubleshoot and fix the problem. But employees, customers, key stakeholders and maybe even the members of the media will have questions. Something that looks solely like a tech problem becomes a communication issue quickly.

So who should be a part of your crisis management team?

Recruit the people who fulfill these roles:

  • Business owner or the most senior manager

  • Legal counsel

  • HR or people managers

  • Department or team leaders

  • Marketing, PR or communications employees

  • Security officers, facility managers and operations managers

Depending on the size of your business, each of these roles may belong to a different person or may be shared between just a couple of people. No matter how it shakes out, it’s important that each one of these perspectives inform your crisis management plan.

If you rely on outside firms to perform some of these roles, contact them to see if or how they can participate in the planning process. If they’re unable to or it’s not feasible for your business to cover the cost of them doing so, consider asking them to review the finished plan and provide feedback.

Small business owner points to details of written crisis management plan

Focus your efforts

Anytime you’re leading a group, it helps to establish a guide post to keep everyone on track. This is especially true when it comes to crisis management planning because the process requires collective brainstorming. Setting a goal at the beginning can help your team think outside of the box without going off the rails.

Before you start the planning process, remind everyone their ideas should seek to answer one question: how do we minimize damage and disruption to productivity, and find ways to restore operations as quickly as possible?

Tell them that the exercise should also produce a document that will serve as your action plan or crisis management plan. Not only will it give you something to point to if employees have questions and serve as a roadmap during a crisis, you can also include it in your onboarding process. That way, you never have to wonder if new hires know what to do or who to go to in an emergency.

Perform a risk assessment

This is where your team members will begin to flex their brainstorming muscles. Performing a risk assessment involves thinking about potential crises in three different ways: what could cause them (the hazard), what would be affected (the at-risk assets) and what that would mean for your business (the impact). If you apply this simple framework to the COVID-19 pandemic for example, it could look something like this:

Hazard, asset and impact chart icons

Of course, crises take many other forms. This is just another area where group discussion or contribution is invaluable. Your facility manager may know how a natural disaster could affect your warehouse and office, while your operations manager will probably have thoughts on how a mechanical breakdown will hinder your ability to meet production goals.

If your team is struggling to get started, prompts may help. The US Department of Homeland Security (DHS) offers a robust list of different types of hazards and examples of at-risk assets. Use either one to get folks thinking about potential crisis scenarios and what parts of your business could become vulnerable.

Once your team has identified hazards and at-risk assets, it’s time they start thinking about the potential impact on your business. Performing a business impact analysis (BIA) can help. Not only does it essentially predict the consequences your business could face as the result of different hazards, it lays the groundwork for the solution-finding step of the process.

Start by outlining the operational impacts and financial losses your business could experience. According to the DHS, those might include:

  • Lost sales and income
  • Delayed sales or income
  • Increased expenses (e.g., overtime labor, outsourcing, expediting costs, etc.)
  • Regulatory fines
  • Contractual penalties or loss of contractual bonuses
  • Customer dissatisfaction or defection
  • Delay of new business plans
Emergency planning chart icon

Using a risk assessment form is a good way to keep track of everyone’s ideas, whether you meet in person, via video conference or solicit feedback through email.

If you want to take the analysis a step further, you can sort the impacts according to how much they could cost based on how long they last. Doing this deep dive can help you prioritize the specific impacts you want your crisis management plan to address and set triggers for when your team should spring into action. This BIA questionnaire can make digging in a little bit easier.

For example, if your ecommerce site is down for ten minutes, you could lose some sales. To know exactly how much, you might look at your average sales volume per hour and break it down by the minute. You’ll likely find the value of those lost sales may not be worth the effort of actively managing or mitigating the situation.

However, if your site is down for ten hours, it affects your business to a different degree and is worth the time and money it takes to address it. As a result, you may decide that your crisis management plan goes into effect based on how long the website is down as opposed to jumping in the moment there’s trouble. This kind of prioritization can be especially helpful if your business runs on a lean staff.

Crisis management team meets to brainstorm about possible crisis scenarios and solutions

Decide how to respond and recover

It’s time to find solutions. Deciding how to respond consists of a two-pronged approach: the steps your team will take internally to correct the problem, and the action you’ll take publicly to address it.

Develop your internal response

This is where the rubber meets the road. Your internal response should consist of all of the actionable steps your team can take to correct problems. This part of the plan will be largely operational and likely include the restoration of infrastructure, whether it be physical or otherwise.

When deciding what you’ll do if a particular issue comes up, it can be helpful to ask the team how IT will support the response. Whether it's a natural disaster that destroys your on-premise equipment or a pandemic that requires everyone to start working from home overnight, preserving the technical foundation of your business is worth a mention in every part of your internal response plan.

Craft your communication plan

While taking steps to fix what’s going wrong on the back end can be challenging, managing internal and external communications is no small feat. Any business impact that lasts for more than a short amount of time will likely impact new and existing customers. Without any type of context or explanation, they could attempt to gain information or support in a highly visible way, bringing even more negative attention to the situation. That’s why you need a crisis communication plan.

A good one starts with your team. Work with them to determine what your official responses will be. That could include brainstorming some of the most likely scenarios you’ll encounter and drafting canned responses.

Then communicate it internally to your employees first so that every possible customer touch point receives — and delivers — a consistent message. Setting the record straight up front will cull speculation, keep everyone calm and make it easier to present a united front. Communicate with any other key stakeholders, like the ownership group or the board of directors for the same reasons.

Positive social media sentiment icon

70% of buyers intend to use social media messaging as a way to ask customer service questions in the future.

Next, focus on your customers. Many of them use social media as a stand-in for other forms of customer service support. Sixty-four percent of people prefer to message a brand on social media instead of calling in for help, and 70% of buyers intend to use social media messaging as a way to ask customer service questions in the future.

But that’s not all. Reporters also cull customer comments from popular social media platforms to write news stories before you’ve had an opportunity to do interviews. For these reasons and more, it’s crucial you communicate with customers early and often during a crisis situation. Doing so can stem the number of messages you receive and the degree to which they can damage your online reputation.

Even though it may seem unnecessary, consider appointing an employee or hiring a company as a designated spokesperson. Should a crisis come to pass, it’s critical whomever you choose knows what to say and when to bring in senior members of management. Between “gotcha” questions and landing the perfect soundbite, some reporters are just hunting for the next scandalous story. Keep your company out of it by including a public relations strategy in your crisis management plan.

These free crisis communications templates can help you get started.

Retail business owner and manager review crisis management plan on paper and tablet

Think about disaster recovery

We’ve talked about how most crises impact businesses significantly. So what are the steps your business will take to get back to normal as soon as it possibly can?

First, take stock of your resources. Keep in mind that they may be depleted after a crisis, especially if the negative event impacted any of these areas:

  • Employees
  • Office space, furniture and equipment
  • Technology (computers, peripherals, communication equipment, software and data)
  • Vital records (electronic and hard copy)
  • Production facilities, machinery and equipment
  • Inventory including raw materials, finished goods and goods in production
  • Utilities (power, natural gas, water, sewer, telephone, internet, wireless)
  • Third party services

Once you’ve listed your resources, use them to come up with contingency plans and processes that act as stop gaps for different business impacts.

For example, if a natural disaster damages one of your facilities to the point you can’t use it, is there a second facility that could support additional employees and production? If not, could you rent another space, or buy or rent another piece of equipment to pick up the slack? Part of building your recovery plan is getting creative and deciding how to strategically map your resources to potential threats.

IT recovery is also important. According to the DHS, your recovery plan should include strategies to restore:

  • Computer room environment (secure computer room with climate control, conditioned and backup power supply, etc.)
  • Hardware (networks, servers, desktop and laptop computers, wireless devices and peripherals)
  • Connectivity to a service provider (fiber, cable, wireless, etc.)
  • Software applications (electronic data interchange, electronic mail, enterprise resource management, office productivity, etc.)
  • Data

Working with a cloud-based provider for some of your business’ most important functions can help limit the amount of IT restoration you need to do in the event of a crisis.

Lastly, you may need additional funding to enact your recovery plan and keep your business afloat. Before the unthinkable happens, nail down where you can obtain financing in case of an emergency. Consult your accountant or attorney for advice.

You can also look for resources from professional organizations or government agencies. For example, the SBA offers disaster assistance in the form of low-interest loans.

Restaurant owner, manager and employee review crisis management plan in kitchen

Educate and communicate

No matter how brilliant your plan is, it doesn’t deliver much value if people don’t use it. That’s why it’s important to ensure everyone in your organization knows the plan exists, knows their role within it and knows exactly where to find it when the time is right. So don’t just file it away once it’s done.

Periodically bring it to the forefront of everyone’s minds by:

  • Making it part of new-hire training and onboarding

  • Including a link to it in your employee handbook

  • Conducting monthly or quarterly training sessions

  • Practicing procedure through trial runs

  • Creating a quiz game and offering prizes to winners

Crisis management team meets in conference room to discuss the crisis management plan

Don’t wing it

Entrepreneurs and small business owners are some of the toughest people around. With real determination, they roll up their sleeves and optimistically work through major challenges to find success on the other side. But having a little help never hurt anyone.

Make life easier on yourself and your team by creating a crisis management plan. It will better equip everyone to meet hardship head-on, relieving you of the burden that comes with having to think of and manage every aspect of an emergency. It can also help your business bounce back quickly and stronger than ever before.

For more information and resources on creating a crisis management plan, visit the DHS’s business preparedness website. And for more tips and tools on building and growing your business, follow The Entrepreneur’s Studio.

Disclaimer: The information provided in this document does not, and is not intended to constitute legal advice; instead, all information, content, and materials available are for general informational purposes only. Information provided may not constitute the most up-to-date legal or other information, and readers of this information should contact their attorney to obtain advice with respect to any particular legal matter, in the relevant jurisdiction. All liability with respect to actions taken or not taken based on the contents here are hereby expressly disclaimed.


Heartland is the point of sale, payments and payroll solution of choice for entrepreneurs that need human-centered technology to sell more, keep customers coming back and spend less time in the back office. Nearly 1,000,000 businesses trust us to guide them through market changes and technology challenges, so they can stay competitive and focus on building remarkable businesses instead of managing the daily grind. Learn more at heartland.us