Business Continuity Plan – for WA Businesses

Why WA businesses need a different plan

A business continuity plan (BCP) is a written plan for how your business keeps operating, or gets back to operating, when something serious goes wrong. It covers people, premises, suppliers, communication and technology, not just your IT backups.

Most free templates online were written for businesses on the east coast or overseas. Western Australia has its own mix of risks: cyclones across the north from November to April, bushfires on the edge of Perth and through the South West, long distances between sites, and regional offices that can lose their only internet link for days. Add ransomware, which does not care where you are, and a generic template leaves real gaps.

This guide gives you a business continuity plan template built for WA conditions, a worked example, and the testing routine that keeps the plan useful. It is written by the team at Qbit IT Solutions, who support businesses from Port Hedland to Busselton, West Perth to Kalgoorlie.

Business continuity vs disaster recovery vs backup

These three terms get used interchangeably, but they are layers of the same protection. A backup without a recovery plan is a copy of data you may not be able to use in time.

Two terms do most of the work in any plan:

• Recovery Time Objective (RTO): the longest a system can be down before the damage becomes serious. If your accounting system has an RTO of four hours, your recovery setup must restore it within four hours.
• Recovery Point Objective (RPO): the most recent data you can afford to lose. An RPO of 30 minutes means you must be able to restore to a point no more than 30 minutes before the incident.

The risks a WA business continuity plan must cover

Start your plan with the events most likely to stop your business. For most WA organisations, these five matter most.

Bushfire. Fires on the urban fringe and in the South West can close premises, cut roads and take out power and telecommunications for days, even when the building itself survives.

Power and internet outages. A regional site often relies on a single NBN or fixed wireless link. If your phones, point of sale and cloud apps all depend on it, one line becomes a single point of failure. A 4G or 5G failover, or Starlink in remote areas, is cheap insurance.

Ransomware and cyber attacks. The Australian Signals Directorate reports that the average self-reported cost of cybercrime for an Australian small business reached $56,600 per report in 2024-25. Attackers now target backups too, so your plan needs protected, isolated backup copies and a tested recovery process.

Losing key people. In many small and mid-sized businesses, one person knows how payroll runs, where the passwords are, or how the server is configured. If they are sick, on leave or leave the business, so does that knowledge.

Cyclones and severe weather. November to April is peak season for tropical cyclones, floods and severe storms in the north, and DFES describes the coast between Exmouth and Broome as one of the most cyclone-prone areas in Australia. When Tropical Cyclone Sean passed the Pilbara in January 2025, Karratha recorded a record 274.4 mm of rain in 24 hours, with flooding, damaged power infrastructure and port closures. A Pilbara or Kimberley office needs a plan for staff working elsewhere and systems running somewhere other than the site.

The business continuity plan template

Copy these ten sections into a document and fill them in with your leadership team. Keep each section short: a plan people can read in a crisis beats a thorough one nobody opens.

1. Plan details
   • Business name, sites covered, plan owner, version number, date of last review and next review date.
2. Activation and authority
   • Who can declare an incident and activate the plan, and who stands in if they are unavailable.
   • What triggers activation, for example any outage of a critical system longer than one hour, a cyclone warning for a site, or a suspected cyber attack.
3. Emergency contacts
   • Leadership team, IT provider, internet and phone providers, landlord, insurer and broker, bank, key suppliers and key customers. Include after-hours numbers, and store a printed copy offsite.
4. Critical business functions
   • List what the business must keep doing: taking orders, paying staff, invoicing, delivering services. Rank them by how quickly each must resume.
5. Business impact analysis
   • For each critical function: the systems, people and suppliers it depends on, the cost per hour or day of it stopping, and its RTO and RPO.
6. Risk scenarios and responses
   • For each likely event (loss of premises, loss of internet or power, ransomware, key person unavailable, supplier failure, severe weather), write the immediate actions and who does them.
7. Technology recovery (your disaster recovery plan)
   • Where backups are kept, how they are protected from ransomware, the order systems are restored in, and who carries out each step. Your IT provider should write or review this section.
8. Alternative working arrangements
   • Where staff work if a site is unusable, what equipment and access they need, and how phones are redirected.
9. Communication plan
   • Who tells staff, customers, suppliers and, if personal information is involved, the OAIC under the Notifiable Data Breaches scheme. Prepare template messages now.
10. Testing, review and sign-off
    • When the plan was last tested, what was learned, and the date of the next test and review.

Worked example: a 40-person engineering firm

Here is how the business impact analysis section might look for a firm with a West Perth head office and a small site office in Karratha.

In the risk scenarios section, the firm’s cyclone response for Karratha reads:

• When a cyclone watch is issued, site staff confirm their laptops are fully synced and take them home.
• Phones divert to mobiles and to the Perth office.
• Perth project managers pick up urgent client contact for the site.
• The office does not reopen until power and internet are confirmed and staff are safe.

Notice what this does. Because drawings sit on a file server with a four-hour RTO, the firm now knows it needs more than nightly backups to the cloud. It needs a recovery setup that can bring that server back within hours, which is a decision it can budget for in advance rather than discover in the middle of an outage.

Testing and keeping the plan current

An untested plan is an assumption. These four routines turn it into something you can rely on.

1. Check backups continuously, test restores regularly. A backup job that reports success is not proof the data can be restored. Restore real files and systems on a schedule, and keep a record.
2. Run a tabletop exercise once a year. Gather the leadership team for an hour, describe a scenario (“it is 7am on a Monday and every file is encrypted”), and walk through the plan step by step. Gaps show up quickly.
3. Do a full recovery test at least annually, and whenever you change major systems, providers or premises.
4. Review before the wet season. For businesses with northern sites, October is the time to confirm contacts, failover links and remote access before 1 November.

If you are working towards compliance to a framework such as SMB1001, documented backups, recovery testing and incident response planning are part of the evidence you will need, so this work counts twice.

Get help building your plan

The business side of the plan is yours to own. The technology recovery section is where most WA businesses need help, because it depends on how your backups, servers and cloud services are actually set up.

Qbit’s business continuity and disaster recovery service covers the full process: assessing your critical systems, setting realistic RTOs and RPOs, deploying protected backups and standby recovery, documenting the procedures and testing them. Qbit is WA’s most certified MSP, with four ISO certifications and SMB1001 Gold, and supports businesses from Port Hedland to Busselton, West Perth to Kalgoorlie.

Not sure your backups would get you through a bad week? Book a free IT assessment and we will tell you how long your recovery would really take.

Frequently asked questions

What should a business continuity plan include? At minimum: who activates the plan, emergency contacts, your critical business functions, a business impact analysis with RTOs and RPOs, responses to likely risks, technology recovery steps, alternative working arrangements, a communication plan, and a testing schedule.

What is the difference between a business continuity plan and a disaster recovery plan? A disaster recovery plan restores your technology. A business continuity plan keeps the whole business running, covering people, premises, suppliers and communication, with the disaster recovery plan as one part of it.

How often should a business continuity plan be reviewed? At least once a year, and whenever you change premises, key systems, IT providers or senior staff. Businesses with northern WA sites should review before each wet season.

Does a small business need a business continuity plan? Yes. Smaller businesses usually have less cash and fewer people to absorb a disruption, so a short, practical plan matters more, not less.

Is a business continuity plan a legal requirement in Australia? For most private businesses it is not mandated by law, although regulators in some sectors, insurers, government buyers and larger clients increasingly expect one. Check the requirements for your industry and your contracts.

How long does it take to write a business continuity plan? A first version for a small or mid-sized business can be drafted in a few working sessions. The technology recovery section takes longer if backups and recovery have never been tested.