Most business crises are survivable. What decides the outcome is whether the decisions were made in advance, while there was time to think, or in the first frantic hour when there was not.
A crisis plan for a small business does not need to be a document. It needs to answer four questions before anything goes wrong: what are we most exposed to, who decides, how do we keep paying people while trading is interrupted, and who must be told. This guide works through each, with the exposures that are specific to operating here.
Start with what would actually take you down
Generic risk registers list everything and prepare you for nothing. Write down the five events that would genuinely stop you trading, then score each on how likely it is and how much damage it would do. Plan for the top two and accept the rest.
For most small businesses here the real list is short:
- A power or water interruption long enough to stop production, or to spoil stock that has to stay cold.
- Losing a single customer or supplier you depend on. If one client is more than a quarter of your revenue, that is a concentration risk, not a good account.
- Theft, fire or damage to premises, including damage arising from civil unrest.
- A cyber incident, most often ransomware or a compromised email account used to redirect a customer payment.
- Losing the person who holds something only they know, whether that is the banking, the supplier relationships or how the machine is fixed.
That last one is the most common crisis in a small business and the least insured against. Anything that exists only in one person’s head is an outage waiting to happen.
Check whether your insurance covers what you think it does
Two gaps come up repeatedly, and both are found after the event rather than before.
Damage from riot, strike or civil unrest is not covered by an ordinary policy. That cover comes from Sasria, the state-owned special risks insurer, and it covers loss or damage caused by civil commotion, riot, strike, lockout, public disorder and terrorism. You do not buy it directly. It is added through your own insurer or broker as an extension, and it only responds if you have an underlying policy in force at the time of the event. Businesses that discovered this after the July 2021 unrest did so at the worst possible moment.
Business interruption cover is what pays the wages while you are not trading. Material damage cover repairs the building and replaces the stock. It does nothing about the months of lost income in between, which is what actually closes businesses. Our guide on what business interruption insurance is covers how it works and what to check.
Phone your broker and ask two questions: is Sasria on this policy, and does the business interruption indemnity period reflect how long it would realistically take us to get trading again. Most policies default to a period that is shorter than the reality.
A cyber incident is now a legal notification event
This is the part that has changed and the part most owners have not caught up with.
If personal information is accessed or acquired by an unauthorised person, section 22 of POPIA requires you to notify both the Information Regulator and the affected data subjects. There is no minimum threshold below which you may stay quiet, and there is no 72-hour rule as there is under European law. The obligation is to notify as soon as reasonably possible after discovering the breach, delayed only where a public body needs time for a criminal investigation.
The practical consequence is that your incident plan needs a communication step, not just a technical one. Decide now who drafts the notification, who signs it off, and where the list of affected people would come from. Doing that while the systems are down is how businesses end up either saying nothing or saying too much. The wider obligations sit in our guide to POPIA.
Basic prevention still does most of the work: multi-factor authentication on email and banking, offline backups tested by actually restoring from them, and a rule that any change to supplier banking details is verified by phone on a number you already had.
Decide who decides
In a small business the crisis team is usually three people, and their roles need naming before the event.
Someone decides, with the authority to spend money and stop work without calling a meeting. Someone communicates, so that staff, customers and suppliers hear one version rather than five. Someone keeps operations running at whatever reduced level is possible.
Write down who takes over if the decision-maker is unreachable, because in a real incident they often are. Keep the contact list somewhere that does not depend on the systems that might be down, which in practice means printed and in someone’s car.
Cash is what buys you time
Every crisis becomes a cash crisis if it lasts long enough. Two things decide how long you can hold out.
A reserve. Enough to cover fixed costs for a defined number of months, with the number chosen deliberately rather than left to whatever is in the account.
A facility arranged before you need it. Credit is easiest to arrange when you demonstrably do not need it, and close to impossible in the week after an incident. Having a facility in place and unused is a cheap insurance policy of its own. The options are set out in our guide to cash flow solutions for SMEs.
Know your break-even and know how many months of fixed costs you can absorb. Owners who can answer both make faster decisions under pressure, because they know exactly how much runway they are spending.
Rehearse the one thing you would do badly
Full simulations are unrealistic for a business of five people. A twenty-minute conversation is not.
Pick the most likely scenario and talk it through: who calls whom, what we tell customers, what we stop doing first, how we pay staff this month. The value is not the plan that comes out of it. It is discovering the thing nobody had thought about, which is usually mundane, like nobody else knowing the alarm code or the insurance broker’s number.
Do it once a quarter and update the plan when something in the business changes. Structured thinking under pressure is a skill, and our guide on critical decision making for leaders covers how to build it.
Frequently asked questions
What should a small business crisis plan contain?
The two or three exposures most likely to stop you trading, who decides and who takes over if they are unreachable, how staff and customers will be told, and how long the business can cover fixed costs. One page is enough if it answers those.
Does my insurance cover damage from riots or civil unrest?
Not under an ordinary policy. That is Sasria cover, added through your insurer or broker, and it requires an underlying policy in force at the time of the event. Confirm with your broker that it is on your schedule.
Do I have to report a data breach?
Yes. Section 22 of POPIA requires notification to both the Information Regulator and the affected data subjects as soon as reasonably possible after discovery. There is no minimum threshold and no 72-hour deadline.
How much cash reserve should a small business hold?
There is no universal figure. Work out your monthly fixed costs, decide how many months you want to survive without revenue, and treat that total as a target rather than a rule.
How often should the plan be reviewed?
Quarterly, and whenever something material changes: a new key customer, a new system, a new location, or a person leaving who held knowledge nobody else has.
Do these three things this week
Phone your broker and confirm Sasria and business interruption cover are both on the policy. Write down who decides and who takes over. Work out how many months of fixed costs you could cover today. Those three take an afternoon, and they are the difference between a bad month and a closed business.
This article was updated in September 2026.
