Contingency Plan Basics: Vital Steps for Contingency Planning

A contingency plan is about preventive control—it’s a course of action developed to mitigate any financial or reputational damage to a business due to unexpected events or circumstances. A contingency plan is your “plan B,” a backup plan that you’ve prepared specifically for a scenario that might or might not happen.

Contingency planning is an important aspect of risk management, business continuity, and disaster recovery. It’s so vital the National Institute of Standards and Technology (NIST) has outlined a seven-step contingency planning process for federal information systems and other critical organizations to use in case of a negative event.

A contingency plan doesn’t always have to involve prep for a negative event. You might make a contingency plan for when your company sees a surge in business or when your nonprofit receives a large anonymous donation. Contingency plans differ from crisis management, which is an unprepared response to an event that’s just happened.

A company needs to have a contingency planning guide in place to minimize losses and maintain normal functions should there be any such event that could negatively impact business.

Good contingency planning is important because it ensures your business can function if your “plan A” falls through. Scenarios around which you might design a contingency plan could include a natural disaster hitting your business operations, the departure of a project manager, and a power outage taking out information systems on the busiest day of the year.

Businesses and individuals alike can and do create contingency plans. For example, you might have a system in place for backing up your personal computer in the event it receives damage or dies. In such a scenario, your contingency plan would involve repairing your computer (or securing a new computer) and restoring all your files from the digital backup you made.

Similarly, a company might store copies of its data and working files on multiple secure servers. This way, in the event one of the servers fails, the business will have not lost all the information necessary for its day-to-day operations. Also, an IT (information technology) department usually has a contingency plan in the event a company experiences a security breach. These types of contingency plans usually involve freezing user accounts, resetting passwords, and other necessary steps.

Both contingency plans and mitigation plans revolve around preventing damage from risks, but their approaches differ. You follow a contingency plan after the specific risk has already occurred, while you follow a mitigation plan to decrease the chances of the risk happening in the first place, or to minimize the negative impact of the risk if it does come to pass.

Consider this example: Building a structure out of steel rather than wood is part of a mitigation plan against the risk of fire, but building the structure next to a fire station is part of a contingency plan in the event the structure does catch fire.

A business contingency plan is necessary for most businesses and can save a company time, money, and resources. For a thorough look at the contingency planning process, consider the steps below:

• Create an official policy. In the event something goes disastrously wrong, having a contingency policy statement in place provides clear guidelines to follow so all employees and team members are on the same page when responding. This optimizes the quality of response.
• Gather your resources. For your contingency planning, make a list of important resources the company has access to and can use in the event of an emergency or recovery strategy. Knowing what you have makes it easier to identify what you don’t.
• Use risk assessment. A business impact analysis (BIA) can determine the likelihood of a particular scenario occurring and its potential impact on your most critical business processes. A BIA can both identify future risks and help a company prioritize what should be planned for first.
• Draft your plan. Different risks require different plans. Prioritize your plans to address the most significant potential threats to your company. Focus on minimizing losses. Work in flexibility to account for multiple scenarios and circumstances.
• Test your plan. Testing a business continuity plan ensures its effectiveness. Conduct exercises or simulations to measure response time and execution of recovery strategies. Plan testing can expose weaknesses or vulnerabilities and reveal additional training or information your staff needs to see an increase in preparedness.
• Update your plan. It’s important to enact plan maintenance, revising and amending as necessary. Systems change as information technology advances, so keep your plan up to date.
• Brainstorm unlikely scenarios. A scenario might be unlikely to occur, but that doesn’t mean it’s impossible. A contingency plan is like insurance—it ensures you have what you need in the event of a worst-case scenario.

Get the MasterClass Annual Membership for exclusive access to video lessons taught by business luminaries, including Chris Voss, Sara Blakely, Bob Iger, Howard Schultz, Anna Wintour, and more.