Start with a two-hour workshop, not a blank template. The fastest path to a usable business continuity plan is to get your operational leads in a room, work through the ACOSS Six Steps to Resilience framework, and adapt an existing action-plan template rather than drafting one from scratch.
Three things to do this week:
- Book a two-hour cross-team workshop with your service leads, rostering coordinator and one board member.
- Map your essential services: which supports absolutely cannot stop, and for how long.
- Download the LCSA Business Continuity Action Plan Template and adapt the headings to your service mix before the workshop starts.
The rest of this guide walks through what a proper plan contains, how to run the workshop, and what to test once you've got a draft.
Key Takeaways
A usable community-services business continuity plan comes from a workshop-based Six Steps process and an adapted action-plan template, not a solo drafting exercise.
| Point | Details |
|---|---|
| Start with a workshop | Convene operational leads for a two-hour session before drafting anything on paper. |
| Cover the five core components | Roles, communications, temporary accommodation, data backup and emergency supplies, per ACOSS. |
| Use the Six Steps sequence | Lead, build networks, know risks, manage risks, prepare others, learn and inspire. |
| Test before you trust it | Run a desktop exercise within weeks of drafting, then review annually or after any incident. |
| Get facilitation support | The Planning and Practice Hub runs Six Steps workshops and helps embed the finished plan into governance systems. |
What must a community services BCP actually cover?
A workable plan is shorter than most managers expect, but it can't skip sections. ACOSS's resilience framework names five non-negotiable components: roles and responsibilities, a communications strategy with contact lists, temporary accommodation arrangements, data security and backup protocols, and plans for emergency supplies. Build around those five and add the sector-specific layers most generic templates miss.
Your action-plan structure should include:
- Purpose and scope (which services, which sites, which triggers activate the plan)
- Roles and responsibilities, including delegated decision authority
- Essential-service mapping and priority order
- Communications strategy and contact lists
- Data backup and records access
- Temporary accommodation and supply arrangements
- Provisions for clients with heightened vulnerability
- Recovery actions and a review schedule
If your organisation works with children, don't bolt child safety on as an afterthought. The National Principles for Child Safe Organisations set out ten elements for child-safe culture, and your continuity arrangements, especially around alternative supervision and reporting during a disruption, need to reflect them.
A plan that lists five components on paper but has never been discussed by the people who'll actually run it during a flood or a system outage isn't a business continuity plan. It's a document.
How does the Six Steps to Resilience framework work?
ACOSS's Six Steps framework gives you a sequence rather than a checklist to fill in alone:
- Lead resilience from the top, board and executive visibly own it.
- Build networks with peer organisations and local emergency structures.
- Know your risks specific to your services and sites.
- Manage those risks through mitigation and planning.
- Prepare others, staff, volunteers, clients, for disruption.
- Learn and inspire by reviewing what worked and sharing it.
An evaluation of the Six Steps process across nine community service organisations found that collaborative, workshop-based planning built organisational capacity to handle emergencies more effectively than plans drafted top-down by a single manager. Only one of the nine finished a full plan without extra resourcing, which tells you something useful: block out one to two hours, keep the scope tight, and treat the first workshop as a working draft, not a final document.
What's the step-by-step process to build the plan?
Work through this sequence rather than trying to write a finished document in one sitting:
- Scope the plan: which services, sites and functions are in, and which are out.
- Run a basic business impact analysis: what breaks first, and what does that cost clients.
- Draft response actions for your top five risks.
- Assign responsibilities against each action.
- Build contact lists (covered in detail below).
- Test the draft with a desktop exercise.
- Formalise and circulate for sign-off.
Your action-plan table doesn't need to be complex. A simple two-column structure works:
- Essential service → Immediate action: e.g., "Client transport" → "Activate backup driver roster, notify affected clients within two hours."
CSIA's disaster management and recovery toolkit makes the point plainly: plans work best when they reflect your actual service delivery model and integrate with policies you already have, rather than sitting as a standalone document. Keep the plan proportionate to your size. A five-page action plan that staff have actually read beats a fifty-page plan that sits in a folder.
How do you decide which services to prioritise?
Not every service warrants the same level of protection. A simple decision matrix, harm caused if the service stops versus likelihood of disruption, gives you a defensible way to rank priorities without endless debate.
For clients who need extra support during a disruption, your plan should record:
- Primary contact and emergency contact details
- Consent status for information sharing during an emergency
- Critical support needs (medication, equipment, communication needs)
- Alternative contacts or carers
- Mobility, cultural or language considerations
Pro Tip: Cross-check your client-priority fields against your NDIS Practice Standards or Aged Care Quality Standards documentation before finalising them. If the consent wording doesn't match what clients already agreed to, you've created a compliance gap, not a safety net.
Who leads decisions when services are disrupted?
Confusion about who can actually make a call, evacuate a site, stand down a service, spend unbudgeted funds, is where plans fail in practice. Name a disaster lead, at least one deputy, operational leads per service stream, a board contact, and someone responsible for liaison with your Local Disaster Management Group.
Pro Tip: Write down dollar and decision thresholds explicitly. "The CEO or deputy can approve up to $5,000 in emergency spend without board sign-off" removes hesitation exactly when you need speed. Confirm this governance structure against your existing delegation policy, and if your board hasn't formally sighted the continuity plan, that's a gap under the ACNC Governance Standards worth closing now.
What should the communication strategy include?
Your plan needs separate contact lists for staff and volunteers, clients and carers, partner agencies, council or LDMG contacts and emergency services, and key suppliers.
Draft short message templates in advance for three scenarios:
- Initial notification of a disruption
- Service change updates (what's running, what's paused)
- Welfare check messages for vulnerable clients
Review and update contact data every quarter. A phone tree that's twelve months stale is worse than no phone tree at all.
How often should you test and review the plan?
Three formats suit different needs. A desktop exercise talks through a scenario around a table in under an hour. A tabletop exercise adds more detail and role-play across teams. A functional exercise physically tests a system, like your data backup, under real conditions.
Run a desktop exercise first:
- Pick one realistic scenario (power outage, system failure, extreme weather).
- Walk through your action plan step by step, out loud, with the actual roles involved.
- Note where responsibilities were unclear or a contact was wrong.
- Debrief in fifteen minutes: what worked, what needs fixing, who owns the fix.
Review the plan briefly after any real incident, and run a formal test annually with executive sign off. CSIA's guidance is consistent on this point: a plan updated only after a real event stays sharper than one revised on a fixed but arbitrary schedule.
Pro Tip: Treat every debrief note as a mandatory plan edit, not an optional improvement. If you're not updating the document within a week of the exercise, the exercise achieved nothing.
How long does it take to build a working plan?
Three realistic paths, depending on your capacity:
- Quick: a weekend workshop produces a working draft covering your top risks within days.
- Medium: four to six weeks, with peer review from another manager or your board.
- Full: three months, including scenario simulations and formal governance sign-off.
Internal facilitation works for smaller organisations; larger or multi-site services often get more out of external facilitation to keep the workshop focused. If resourcing is the barrier, Hunter JO's evaluation found that's the most common reason plans stall, consider partnering with a neighbouring organisation to share the facilitation cost.
How did one community organisation put this into practice?
A regional homelessness service with around 20 staff ran its first continuity workshop after a near-miss flood evacuation exposed gaps in its contact list. The team used the Six Steps sequence over two ninety-minute sessions, prioritising client transport and after-hours contact as the two functions that couldn't fail. The workshop surfaced that three staff didn't know who held backup keys to the supply store.
Three lessons transferred directly to their final plan:
- Workshop discussion revealed gaps a solo draft would have missed entirely.
- Contact list accuracy mattered more than plan length.
- A named deputy for every role removed hesitation during the actual test run three months later.
The plan that mattered wasn't the document. It was knowing, within thirty seconds, who picks up the phone when the primary contact doesn't answer.
What's the real gap between a compliant plan and a workable one?
Most organisations already have a document called a business continuity plan sitting in a policy folder somewhere. The gap isn't compliance, it's whether staff have actually rehearsed it. I've seen boards sign off on plans that name the right five components and still fail the first real test, because nobody had walked through the scenario out loud before the crisis arrived. The workshop process matters more than the document. Build the habit of a short annual exercise linked to your Local Disaster Management Group, and the paperwork looks after itself.
Who in your organisation will lead a one-hour continuity workshop this month?
How The Planning and Practice Hub can help you finish the plan
Getting the framework right is one thing. Getting a board to sign off on it, and getting staff to actually use it under pressure, is where most plans stall. The Planning and Practice Hub runs the Six Steps workshop with your team, adapts a sector-appropriate action-plan template to your service mix, and helps embed the finished plan into your existing governance and quality systems so it doesn't sit unused after the first review.
Services relevant to this work include:
- Strategic planning facilitation for the initial workshop and draft
- Policy and procedure consulting to formalise workshop outputs into a governance-ready document
- Practice assurance support to keep the plan embedded in day-to-day operations, not filed and forgotten
If you're ready to move past the draft stage, book a strategic planning consultation and get a facilitated workshop on the calendar.
Sources
- Business continuity plan — ACOSS resilience resource
- CSIA disaster management and recovery toolkit
- Six Steps to Resilience evaluation — Hunter JO
- About the National Principles for Child Safe Organisations
- Business Continuity Action Plan Template — LCSA
FAQ
What are the five components of a business continuity plan?
ACOSS names five core components for community services: roles and responsibilities, a communications strategy with contact lists, temporary accommodation arrangements, data security and backup, and emergency supply plans.
What are examples of a business continuity plan?
Council-published plans, like those from Burke Shire Council and Perenjori Shire Council, show how organisations map essential services and contact lists in practice.
What should a good business continuity plan include?
Beyond the five core components, a strong plan for community services adds essential-service prioritisation, provisions for clients with heightened vulnerability, and alignment with the National Principles for Child Safe Organisations where relevant.
What is a business continuity plan for community services?
It's a working document that sets out how a service keeps supporting clients during a disruption, covering roles, communications, essential services, records access and recovery actions, built through a workshop process rather than drafted alone.