Charity business continuity plan

Where the expectation comes from

The Charity Commission's expectation of a business continuity plan is in section 2.4 of Charities and risk management (CC26), headed “What is disaster recovery planning?”: “As a part of an effective risk management process, a charity should consider what needs to be done if a serious event does take place. This could range from a fire or flood to a serious computer malfunction.” The guidance was last updated on 16 September 2026, to reflect changes to the Commission's guidance on charity accounts.

The same section says what the plan is for: “Charities should consider how their services to their beneficiaries would be affected as a result of a serious incident, including those with a major impact and a low likelihood, and plan to resume normal operations as far as and as soon as possible.” It also accepts that names vary – “Many charities develop disaster recovery plans (sometimes referred to as business contingency plans) and follow good practice procedures used in the public and private sector” – and that size matters: “The scope and complexity of any disaster recovery plan will vary according to the size and activities of the charity concerned.”

Read the verb. CC26 explains at 1.3 that “The word ‘must’ is used where there is a specific legal or regulatory requirement that you must comply with. ‘Should’ is used for minimum good practice guidance you should follow unless there’s a good reason not to.” Disaster recovery planning is a “should”: minimum good practice, not a legal duty for every charity. Three requirements sit around it:

• The risk management statement. CC26 section 3.3: “All charities that are under a legal requirement to have their accounts audited must make a risk management statement in their trustees’ annual report.” For a non-company charity the wording comes from regulation 40 of the Charities (Accounts and Reports) Regulations 2008: a statement as to whether the trustees “have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks”. Smaller charities below the audit threshold “are encouraged to make a risk management statement as a matter of good practice”, and charitable companies other than small companies “must include a strategic review in their directors’ report” describing “the principal risks and uncertainties facing the company”. A trustee who signs that statement while the charity has no idea how it would run its services after a fire is signing something hard to defend.
• Restoring personal data. Article 32(1)(c) of the UK GDPR requires measures that include, as appropriate, “the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident”, and 32(1)(d) “a process for regularly testing, assessing and evaluating the effectiveness” of those measures. A charity that holds records of beneficiaries, volunteers or donors is a controller of that data, so being able to restore it after an incident, and testing that it can, is a legal duty scaled to the risk, not only good practice. The regulator is the Information Commission, still known as the ICO, which replaced the Information Commissioner on 30 September 2026.
• Academy trusts. An academy trust is an exempt charity, and the Academy trust handbook 2026 (paragraph 2.44) requires its risk management to include contingency and business continuity planning; the school business continuity plan guide covers that duty and the DfE's expectations.

CC26 is the Commission's guidance for charities in England and Wales. Charities in Scotland are regulated by OSCR and in Northern Ireland by the Charity Commission for Northern Ireland, which publish their own guidance; the practical content of a plan below applies wherever a charity works.

What a charity's plan should cover

A business continuity plan starts from the services, not the building. CC26 asks how “services to their beneficiaries would be affected”, and the Commission's 15 questions trustees should ask about governance, finance and resilience put the same point as a question for the board: “What will the consequences be for our charity’s beneficiaries (in particular vulnerable beneficiaries) if the charity has no financial reserves to enable it to continue in the event of loss of regular income?” A charity's critical activities are the ones whose interruption would harm beneficiaries first: the helpline, the lunch club, the safeguarding cover at the youth session, the payments to carers.

The disruptions a charity plans for are wider than a company's, and CC26's own table of example risks names most of them alongside the responses it suggests:

• Premises lost. Fire, flood, storm or a landlord's notice. CC26 lists “destruction of property, equipment, records through fire, flood or similar damage” and the response “create disaster recovery plan including alternative accommodation”. Record where each service could move, and who holds the keys there.
• Systems and data lost. Ransomware, a failed server, a supplier's outage, a laptop stolen with the only copy of the volunteer rota. CC26: “computer system failures or loss of data”, met by “agree IT recovery plan”, “implement data back up procedures and security measures” and “create disaster recovery procedures”. The cyber security guide for charities covers backups and Cyber Essentials in detail.
• Key people lost. In a small charity the one paid member of staff, the treasurer who alone can approve payments, or the volunteer who runs the Saturday session. CC26 lists “Loss of key staff”, with “operational impact on key projects and priorities” and “loss of contact base and corporate knowledge” among its consequences, and the responses “succession planning”, “document systems, plans and projects” and “agree notice periods and handovers”.
• Volunteers unavailable. An illness outbreak, a heatwave, a school holiday: a service that depends on volunteers needs a minimum safe number below which it pauses rather than runs unsafely.
• Funding or a contract lost. A grant not renewed, a commissioner ending a contract, a major donor withdrawing. This is the slower disaster, and the Commission lists it beside fire and flood damage as a loss to report (section 04).
• A supplier or partner failing. The caterer, the IT provider, the partner organisation whose premises you share, the payroll bureau. Ask the third-party suppliers a critical service depends on what their own continuity arrangements are and how quickly they would restore your service, and note a fallback for each.
• A safeguarding or reputational crisis. An allegation that closes a service while it is investigated, or a story that stops donations. The reputational risk guide covers the reputation side; the continuity plan covers keeping the service going in the meantime.

Money is the other half of continuity. The 15 questions ask whether the reserves policy will “identify and plan for the maintenance of essential services for beneficiaries?” and “help to address the risks of unplanned closure on our beneficiaries, staff and volunteers?” A continuity plan that assumes the charity can pay for temporary premises, replacement equipment and overtime for a month should be read alongside the reserves policy that says whether it can. CC26's table makes the same link, answering a dependency on income sources with “implement adequate reserves policy”, and reminding trustees to “review insurance cover”.

Writing the plan: CC26's six stages

CC26 says “the basic stages in establishing an effective disaster recovery or business contingency plan are likely to be similar to those shown in the following grid”. The grid is a guide, not a required format, and its six stages are a sound order of work for a charity of any size:

1. First steps. “commit to planning across the charity”, “develop a plan by a team representing all functional areas of the charity”, and “plan as a project if appropriate”. In practice: the trustees agree that a plan is needed, name who will write it, and make sure services, fundraising, finance and volunteering are all represented.
2. Impact and risk assessment. “identify all major risks”, give each “an impact and likelihood rating”, and “consider overall risk profile of charity”. This is the charity's risk register, read with one question in mind: if this happened tomorrow, which services would stop, and for how long could beneficiaries manage without each one?
3. Drawing up the plan. “establish milestones to move charity from disaster to normal operations”, “start with immediate aftermath”, “outline what functions need to be resumed and in what order”, and the “plan should identify key individuals and their roles and duties”.
4. Testing. “plan process of testing properly”, “reproduce authentic conditions as far as possible”, have the plan “tested by the key individuals identified in the plan”, “document test procedures and record results” and “consider amendments to plan”.
5. Training. “make all charity trustees, staff and volunteers aware of plan and their own duties and responsibilities”, “stress the importance of planning even if the disaster appears to be a remote likelihood”, and “get feedback from all to ensure that duties and responsibilities are understood”.
6. Updating and maintaining. The “plan should be updated to be applicable to current activities”; “give someone responsibility for updating plan and communicating any changes”; “all changes should be fully tested”; and “key staff informed of changes in duties and responsibilities”.

Stage three is the plan itself, and it is where most templates are thin. Start with the immediate aftermath, as CC26 says: the emergency response in the first hour and the first day. Rank the services by how quickly their loss harms beneficiaries, and give each a target time to resume – some planners call this a recovery time objective – and a fallback that works without the building or the systems. Then add the details that decide whether the plan works on the day:

• Contact details for trustees, staff, key volunteers, beneficiaries who need a call, funders, the landlord, the insurer and the IT provider, held somewhere reachable when the office and the email are not.
• Who can decide to close or move a service, and who deputises when that person is away.
• How staff, volunteers and beneficiaries will be told when email and the website are down, and who sends the messages.
• Bank signatories and payment authority when a signatory is unavailable, consistent with the charity's financial controls, so that emergency spending is still authorised properly.
• Where the backups are, how a restore is started, and who checks that personal data has come back complete.
• A short log of decisions and actions during the incident, started in the first hour (section 04).

Testing it, and the record when it is used

A plan in place that has never been tried is a list of assumptions. CC26 asks for testing that is planned “properly”, uses “authentic conditions as far as possible” and is carried out by the people the plan names, with test procedures documented and results recorded. The simplest test is a tabletop exercise: the incident lead, a trustee and two or three staff or volunteers spend an hour walking through one scenario – the hall floods on a Monday at 6am, the email is locked by ransomware on a Friday afternoon – and write down every point where the plan was silent, wrong or out of date. A harder test is a real one: restore a file from backup, or run the Thursday session from the fallback venue.

The Commission sets no fixed interval for testing or review. CC26 asks that the plan be kept “applicable to current activities”, that someone be responsible for updating it, and that “all changes should be fully tested”. Many charities review it each year alongside the risk register and after any real incident; that is good practice, not a rule. UK GDPR Article 32(1)(d) separately asks for regular testing of the measures that protect personal data, which in practice means checking that backups can actually be restored.

When the plan is used for real, keep a decision log from the start: what happened and when the charity found out, what was decided, by whom and why, who was told, and what was spent. That log is what the trustees use to review the plan afterwards, and it is the evidence several other bodies may ask for:

• The Charity Commission. Under its guidance on how to report a serious incident in your charity (updated 16 January 2026), trustees should report any significant financial loss “where this threatens the charity’s ability to operate and serve its beneficiaries, or where the charity’s financial reserves are not sufficient to cover the loss”. Its examples include “significant fire, flood or storm damage destroying or seriously damaging the charity’s main premises” and “loss of significant institutional donors, public funding or key delivery contracts that threatens the charity’s ability to operate”. As a guide, the Commission expects losses of £25,000 or more, or over 20% of the charity's income, to be reported, and a smaller loss “might prevent the charity from delivering vital services to beneficiaries so may be reportable”. A significant data breach or loss is reportable too. Report “as soon as is reasonably possible”; the serious incident reporting guide covers the form and the decision.
• Report Fraud. Fraud and cyber crime affecting a charity in England, Wales or Northern Ireland go to Report Fraud, which replaced Action Fraud on 4 December 2025; the Commission asks charities to obtain a crime reference number and make a serious incident report as well. In Scotland, call Police Scotland on 101.
• The ICO. If personal data has been lost, locked or exposed, decide whether the breach must be reported to the Information Commission; the data breach log guide covers what to record either way.
• The insurer, broker and funders. Check what the insurance policy and each grant agreement require the charity to tell them, and how quickly; the plan should say who calls the insurer or insurance broker, and who tells each funder.

Charities with income over £25,000 must also confirm in the annual return that no reportable serious incident went unreported. A decision log written during the incident is how the trustees show, months later, what they knew and why they reported or did not.

Roles and responsibilities: who owns the plan, and who acts on it

The trustees own the plan. CC26 places disaster recovery planning inside the trustees' risk management, and the risk management statement is theirs to sign. In practice the board approves the plan and its review date, receives the results of each test, and names one trustee – often the treasurer or the trustee who leads on risk – to hold the plan between meetings. Staff, or volunteers in a charity with no staff, write and run it. During an incident the incident lead acts and the trustees are informed and consulted on the decisions that are theirs: closing a service for good, emergency spending beyond agreed limits, and whether to make a serious incident report.

Training under CC26's fifth stage reaches further than in most organisations, because it names “all charity trustees, staff and volunteers”. A volunteer who opens the building on a Saturday needs to know three things: who to ring, what to do if the building cannot be used, and how they will be told the session is cancelled or moved.

Smaller charities can ask for help. Under section 4 of the Civil Contingencies Act 2004, local authorities in England, Scotland and Wales “shall provide advice and assistance to the public in connection with the making of arrangements for … the continuance of the activities of bodies other than public or local authorities whose activities are not carried on for profit, in the event of an emergency”. The duty is to advise, not to step in, and a council need only help the voluntary organisations it considers appropriate and may charge for advice given on request, but its emergency planning or resilience team is a sensible place to start, and it can tell a charity what the local emergency plans expect of voluntary organisations.

The first hour of an incident runs on phones

Most charity plans list the communications they expect to use: the phone tree, the website, an email to staff. Picture the morning the plan is needed. The caretaker sends the chief executive a photograph of water across the hall floor at ten past six. The chief executive messages the chair; the chair asks whether the lunch club can move to the church hall; the volunteer coordinator texts twenty volunteers one by one from her own phone, and some reply in a group set up years ago for a summer event. By nine the service has moved, the main funder has been warned, and nobody has opened the plan. If ransomware has locked the charity's email, personal apps are all that is left working, and the whole of the first day runs on them.

Those messages are the decision log the plan asks for: who decided to move the service, when, on what information, and who was told. They are what the trustees will rely on if the loss becomes a serious incident report, what the insurer may ask about when the claim is made, and what the next test of the plan should learn from. Held on personal phones, in groups whose membership nobody has checked for months, they are slow to gather and easy to lose when a volunteer moves on.

ComplyChat is designed to be the channel a charity names in its plan for that first hour. Staff, trustees and volunteers are added by mobile number: a mobile number verified by SMS is an identity, so a volunteer with no work email can take part from their own phone. Everyone added is told the channel is on the record and can object or leave, and messages are recorded on the server as they are sent, so the record does not depend on whose phone survived. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept within the charity's own Microsoft 365 subscription, under the retention schedules it already runs. ComplyChat does not keep services running, write or test the plan, or replace the phone tree, the insurer or the Commission's form; it is the channel and the record, nothing more.

A question for the next trustees' meeting: if the building were out of use at six tomorrow morning, which channel would the chief executive, the chair and the volunteer leads use, who decides who is in it, and how would its messages reach the incident record?

Questions people ask

Is a business continuity plan mandatory for a charity?

No single law requires most charities in England and Wales to have one, but the Charity Commission's guidance CC26 says a charity “should consider what needs to be done if a serious event does take place”, and in Commission guidance “should” means minimum good practice to follow unless there is a good reason not to. Charities whose accounts must be audited must state in their annual report whether the trustees have considered the major risks and are satisfied that systems are in place to manage them, and academy trusts must plan for business continuity under the Academy trust handbook.

What should a charity business continuity plan include?

CC26 sets out six stages – first steps, impact and risk assessment, drawing up the plan, testing, training, and updating and maintaining – and says the plan should start with the immediate aftermath, “outline what functions need to be resumed and in what order” and “identify key individuals and their roles and duties”. A workable plan adds critical services ranked by harm to beneficiaries, contacts reachable off-site, fallback premises, backups, payment authority and a decision log.

How often should a business continuity plan be tested or updated?

The Charity Commission sets no fixed interval. CC26 says the plan “should be updated to be applicable to current activities”, that someone should be responsible for updating it, that “all changes should be fully tested”, and that tests should be documented and their results recorded. Many charities review the plan annually alongside the risk register and after any real incident, as good practice rather than a rule.

What is the difference between a business continuity plan and a disaster recovery plan?

The Charity Commission uses the terms loosely: CC26 says “Many charities develop disaster recovery plans (sometimes referred to as business contingency plans)”. In common usage, business continuity covers keeping essential services running through a disruption, and disaster recovery covers restoring systems, data and premises afterwards; a charity's plan needs both.

Does a charity have to report a disaster to the Charity Commission?

Often, yes. The Commission's serious incident guidance asks trustees to report significant losses that threaten the charity's ability to operate and serve its beneficiaries, giving significant fire, flood or storm damage to the main premises as an example; as a guide, losses of £25,000 or more or over 20% of income should be reported, and a smaller loss may still be reportable if it stops vital services. A significant data breach is also reportable. Report “as soon as is reasonably possible”; charities with income over £25,000 must also confirm in the annual return that no reportable incident went unreported.

Official guidance and your next step

The Charity Commission's Charities and risk management (CC26) is the main source: section 2.4 for disaster recovery planning, Part 3 for the risk management statement, and Annex 2, its table of example risks. Read it with the Commission's 15 questions trustees should ask on reserves and resilience and its guidance on how to report a serious incident in your charity. The legal provisions are regulation 40 of the Charities (Accounts and Reports) Regulations 2008, Article 32 of the UK GDPR and section 4 of the Civil Contingencies Act 2004. Quotations are from those pages as published on 28 October 2026.

This guide covers charities in England and Wales and is not legal advice. Your insurer, your local authority's emergency planning team and your umbrella body may publish templates to adapt.

Then do one thing: ask who would make the first phone call if your main premises could not be used tomorrow, and whether that person has the numbers they would need at home. If the answer is unclear, that is where the plan starts.