The continuity of operations plan and tabletop
What this is: A continuity plan built for organizations that cannot pause: essential functions with recovery times, succession three deep with the licensed-role column, the seventy-two hour grid, the five losses, and the tabletop record.
It assumes: You deliver a service that continues whether or not your office, your systems, or your executive director are available.
Change before use: Your functions, recovery times, succession order, and every name and number. It carries no statutory notification deadlines by design — those depend on what you hold and where you operate.
This document is the method and the reasoning. The plan is the accompanying spreadsheet — essential functions with recovery times and three names deep, succession of authority with the licensed-role column, the seventy-two hour grid, the five losses, and the tabletop record.
The spreadsheet carries no statutory notification deadlines either, for the same reason this document does not.
The problem this fixes
Most continuity plans are written for organizations that can stop. A firm whose office floods can work from home on Monday and lose a few days of billing. An agency with children in placement cannot. The service is continuous, the obligations are statutory, and the people who depend on it do not have an alternative supplier.
That difference changes what a plan has to contain. Not a list of insurance contacts and a backup schedule, but the two questions that actually get asked in the first hour: who is authorized to decide this, and what has to keep running tonight? This plan answers both in writing, before anyone needs them, and then tests the answers.
This is not legal, insurance, or emergency-management advice. It is an organizing structure. Your obligations in an emergency are set by your license, your contracts, and the law of your jurisdiction, and your counsel is the person to read them with.
It does not replace any emergency, disaster, or safety plan your license requires. Many licenses specify the content of those plans precisely. Build this alongside them, and where the two overlap, the licensing requirement governs.
It asserts no notification deadlines. Statutory clocks vary by what you hold, where you operate, and who you serve. Enter your own, verified with counsel, in the table provided.
Step one — name the essential functions
An essential function is one where interruption causes harm, breaches a legal obligation, or cannot be recovered later. Most organizations discover they have fewer than they assumed, and that two of them were never assigned to anyone.
For each function, agree a recovery time objective — the longest interruption you could sustain before the consequence becomes serious. Argue about these numbers now, while it is cheap.
| Function | Why it is essential | Recovery time | Owner | Deputy |
|---|---|---|---|---|
| Illustrative rows — replace all of them | ||||
| Twenty-four hour on-call response | Safety obligation; cannot be deferred | Immediate | ||
| Placement support and family contact | People depend on it daily | Same day | ||
| Mandated reporting and incident notification | Statutory clock runs regardless | Immediate | ||
| Payroll | Staff leave if it fails once | Before the next run | ||
| Access to case records | Needed for every decision above | 24 hours | ||
| Licensing and funder reporting | Deadlines do not move for your emergency | 72 hours |
The discipline is in what you leave out. A function that can wait two weeks is not essential, and putting it on this list dilutes the list. Fundraising events, website updates, and most internal meetings belong in the deferred column.
Step two — succession of authority
This is the section that is used first and written last. In an emergency, someone must be able to say "I am authorized to decide this," and be right.
- Order of succession for each authority: name three deep, by role and by person. Two deep is not enough — the first two are often at the same event or unreachable for the same reason.
- What each successor may decide, and what they may not. Spending limits, contract signature, media statements, closure or relocation decisions. Silence here produces either paralysis or an unauthorized commitment.
- How succession is activated, and by whom. State the trigger. "When the executive director is unreachable" needs a definition — how long, tried how many ways.
- How it is stood down. Temporary authority that never ends becomes a governance problem of its own.
Where a role is held by a specific licensed or approved individual — an Administrator, a clinical supervisor, a designated safety officer — succession is not yours to design freely. The license usually specifies who may act, what notification the regulator requires, and how long a temporary arrangement may run. Write the actual requirement into this section, cite it, and have counsel confirm it. This is the single most common defect we see in continuity plans in this sector.
Step three — the seventy-two hour grid
One page. It is what someone reads at two in the morning while the situation is still unclear, and it should be legible to a person who has never opened this document before.
| When | What happens | Who |
|---|---|---|
| First hour | Confirm everyone is safe and accounted for. Nothing else happens until this is done. Activate succession if the incident commander is unreachable. | First senior person aware |
| First hour | Open an event log — time, decision, who decided. Keep it for the whole event. It will matter afterwards more than anything else you do today. | Named recorder |
| Hours 1–4 | Determine which essential functions are affected and which are not. Do not fix anything yet; know the shape first. | Incident commander |
| Hours 1–4 | Notify: staff, then the people you serve and their families, then funders and licensing as required. Order matters and rarely changes. | Incident commander |
| Hours 4–24 | Stand up workarounds for affected essential functions. Confirm payroll can run. Confirm records are reachable. | Function owners |
| Hours 24–72 | Written situation update to the board chair. Regulator and funder notifications completed and evidenced. | Executive director |
| Hours 24–72 | Decide whether this is short (days) or long (weeks). The answer changes everything downstream, and delaying the call is itself a decision. | Incident commander and board chair |
Step four — the five losses
Plan against losses rather than causes. A flood, a fire, and a burst pipe are one problem — you cannot get into the building. Causes are infinite; losses are five.
| Loss | The first question | What must be pre-arranged |
|---|---|---|
| Premises | Where do people work, and where do scheduled meetings happen instead? | Alternate location or remote posture; who holds keys and access; what physically must be retrieved and by whom |
| Systems and records | Can we reach case records, and can we prove we did? | Restoration path and tested restore; offline access to the minimum needed; the paper fallback nobody wants but everybody uses |
| Money and payroll | Can we pay staff on the next run? | Second signatory, second bank channel, and a documented manual payroll path |
| Key people | Who is authorized, and who actually knows how this is done? | Succession order; the tasks only one person knows, written down before they are needed |
| A funder or contract | Which functions and staff does this affect, and by when? | The concentration table from the Financial Sustainability Model, and a pre-agreed decision date |
Step five — vital records and access
List what must be reachable when the primary route is not available. For each: where it lives, where the copy lives, who can reach it, and when that was last proved.
- Case and client records, and the minimum subset needed to act safely tonight.
- Staff roster with personal contact details, held somewhere reachable without the network.
- Licenses, insurance policies, and the contracts that define your obligations.
- Banking and payroll credentials, under whatever dual control your policy requires.
- This plan itself. A continuity plan stored only on the system it exists to survive is not a plan.
Prove the restore, do not assume it. A backup that has never been restored is a belief. Record the date of the last successful restore test next to each item; if a row has no date, that is your first finding.
Step six — communications
Decide in advance who speaks, because the alternative is that everyone does.
| Audience | Who speaks | First message contains |
|---|---|---|
| Staff | Executive director or successor | What happened, are you safe, what to do now, when you will hear again |
| People served and families | Named program lead | Whether service continues, what changes, who to contact |
| Board | Executive director to chair | Facts known, actions taken, decisions needed from the board |
| Funders and licensing | Executive director | Required notification content; timing per your own verified obligations |
| Press and public | One named person only | Confirmed facts only. No speculation, no client information, ever. |
Two rules that survive every scenario. Never release identifying information about the people you serve — not to reassure, not to correct a story, not under pressure. And say when you will next speak, even when there is nothing new; silence gets filled with something worse than the truth.
Step seven — reconstitution
Returning to normal is a phase, not an event, and it is where plans usually stop. Write down who declares the event over, what has to be true first, and what happens next.
- Criteria for standing down, and who declares it.
- Standing down temporary authority, in writing, so the record is clean.
- Catching up deferred work, in priority order, with the deadlines that moved identified.
- Reconciling the event log into a record the board and any regulator can read.
- The after-action review, within thirty days, producing changes to this plan. A review that changes nothing was not a review.
The tabletop exercise
A plan that has never been exercised is a document. Run this once a year; it takes ninety minutes and needs no external facilitator.
| Element | How to run it |
|---|---|
| Who attends | Executive director, every function owner from step one, at least one board member. Deputies attend instead of principals at least every other year — the deputies are the ones who will actually be there. |
| Ground rules | No wrong answers, no blame, no fixing the plan during the exercise. Write findings down and address them afterwards. Say plainly that discovering the plan is wrong is a successful outcome. |
| Format | Read the scenario aloud. Work through the seventy-two hour grid in real order. Deliver each inject at the stated point. One person records decisions and gaps. |
| Scenario | Choose one loss from step four, unannounced. Rotate annually so the same loss is not exercised twice running. |
Injects — deliver these in order
- Fifteen minutes in. The person with primary authority is unreachable and stays unreachable for the whole exercise. Do not explain why. *Tests: succession, and whether anyone actually knows the order.*
- Thirty minutes in. A staff member has already posted about the situation publicly. *Tests: the single-spokesperson rule, and whether anyone panics into disclosing client information.*
- Forty-five minutes in. A funder or regulator calls asking what happened. *Tests: who speaks, and whether notification obligations are known rather than looked up.*
- Sixty minutes in. Payroll runs in two days and the usual route is unavailable. *Tests: the second channel, and whether anyone has ever tried it.*
- Seventy-five minutes in. The event will last three weeks, not three days. *Tests: whether the plan has a long-duration mode, or quietly assumed everything resolves by Friday.*
The last inject finds the most. Nearly every continuity plan is written for a short outage and collapses when the duration extends, because the workarounds that carry an organization for four days cannot carry it for a month.
What the exercise produces
- A dated record that the exercise happened, who attended, and the scenario used — which is frequently itself a licensing or insurance requirement.
- A list of gaps, each with a named owner and a date.
- Corrections to this plan, made within thirty days while the exercise is still fresh.
- One thing worth telling the board, in a sentence.
Keeping it current
Review annually, and immediately whenever any of these change: the executive director or any successor, your case system, your bank or payroll provider, your premises, or your license conditions. Record the review date on the front page. An out-of-date continuity plan is more dangerous than none, because people rely on it.
Limits of this plan
- It does not satisfy a licensing requirement by itself. Read your license; where it specifies content, that content governs.
- It carries no notification deadlines, deliberately. Those depend on what you hold and where you operate, and a wrong number here would be worse than a blank one.
- It assumes you have a systems inventory. If you do not, build that first — the Open Shelf has it, and step five is guesswork without it.
- It is not an insurance document, though your insurer may ask whether you have one, and having exercised it is a materially better answer than having written it.
Free to adapt and use. No registration, no fee, no attribution required. This is a working template, not legal, tax, or accounting advice — the requirements that apply to your organization are confirmed by your own counsel, auditor, and licensing authority.