When we talk about business continuity, it can sound like something designed for large organisations with sizeable teams, dedicated IT departments and detailed disaster recovery plans.
But for a small association with only one or two staff, business continuity can be much simpler — and arguably even more important.
It does not necessarily mean having somebody who can immediately step in and do the Executive Director’s job.
It means making sure that, if something happened to that person tomorrow, the organisation could still function.
There is a very simple test:
“If I got hit by a bus tonight, could somebody get into the organisation tomorrow morning?”
And by “get into the organisation”, I mean much more than getting through the office door.
Could somebody access the organisational email accounts?
Could they get into the membership database or CRM?
Could they access the accounting system and work out what bills need to be paid?
Could they access the bank — and know who has authority to approve payments?
Could staff still be paid?
Could somebody find the organisation’s contracts and agreements?
What about the website, social media accounts and domain name?
Would they know where to find the constitution, Board papers, minutes and policies?
Would they know what events are coming up, what has already been committed to and which suppliers have been booked?
Could they identify the organisation’s major partners, sponsors and key contacts?
Would they know whether there were any statutory, regulatory or reporting deadlines approaching?
And perhaps most importantly:
Could they work out what absolutely needs to happen this week — and what can safely wait?
That is business continuity.
The danger of the single point of failure
Small associations are particularly vulnerable to what is sometimes called a single point of failure.
And very often, that single point is the Executive Director or Chief Executive.
Nobody deliberately creates this situation. It simply develops over time.
The Executive Director knows:
“That’s in my emails.”
“I know who to ring.”
“I’ve got the password.”
“I know how we did that last year.”
“I know what the Board agreed.”
And everything works perfectly well.
Until that person is suddenly unavailable.
The Executive Director gradually becomes the organisation’s filing system, password manager, relationship manager, institutional memory and operating manual.
So the question for a small association is not:
“Can somebody else do my job?”
It is:
“Have I left enough behind for somebody else to keep the organisation functioning?”
Access and knowledge are two different things
There are really two parts to good continuity planning.
1. Can somebody access what they need?
There should be secure organisational access to the key systems the association relies on.
That might include administrator accounts, delegated authority, secure password management, backup administrators and an emergency access process.
It should not depend on somebody knowing the Executive Director’s personal password, being able to unlock their laptop or having access to their mobile phone.
2. Would they understand what they were looking at?
Access alone is not enough.
There is little benefit in giving the Chair access to a shared drive containing 10,000 documents if nobody knows which documents matter.
Likewise, being able to log into the accounting system is not particularly helpful if nobody knows which invoices need approval, when payroll runs or which payments are already committed.
There needs to be a roadmap.
Every small association should have a continuity file
For a small organisation, the solution does not have to be a 100-page business continuity manual.
A simple Business Continuity File or Executive Director Continuity Guide could be enough.
Its purpose is simple:
If an authorised person had to take control of the organisation tomorrow morning, where would they start?
The guide should cover six areas.
People
Who are the key staff, Board members and external contacts?
Who handles accounting, payroll, IT, legal matters and insurance?
Who are the important partners, sponsors, suppliers and advisers?
Systems
What systems does the organisation use?
Who is the administrator for each?
How is emergency access obtained?
Where is password recovery or authentication information securely held?
Money
Which bank accounts exist?
Who has payment or signing authority?
Who processes accounts and payroll?
What regular payments are due?
Where are the latest budgets, management accounts and financial reports?
Work
What major projects and events are underway?
What deadlines are approaching?
What contracts and commitments have already been made?
What needs attention immediately — and what could be deferred for a week or two?
Governance
Where are the constitution, policies, Board minutes and Board papers?
When is the next Board meeting?
What decisions are currently outstanding?
Are there statutory, regulatory or reporting obligations approaching?
Relationships
Who are the people the organisation simply cannot afford to suddenly stop communicating with?
What commitments have been made to them?
Who should make contact if the Executive Director is unavailable?
For many associations, those relationships are every bit as important as the systems.
Don’t create another single point of failure
There is an important qualification here.
The solution is not necessarily giving the Chair a spreadsheet containing every password.
That simply creates another risk.
The organisation needs a secure arrangement that allows authorised people to recover access when necessary.
That might mean organisational rather than purely personal administrator accounts, backup administrators, secure password management and documented recovery procedures.
The same principle should apply to banking, email, domains, websites, social media and cloud storage.
If the only person who can reset the password is the person who is unavailable, the problem has not actually been solved.
This is not succession planning
It is also worth distinguishing business continuity from succession planning.
Succession planning asks: “Who leads the organisation next?”
Business continuity asks: “How does the organisation keep operating until we work that out?”
For a small association, you may not have another senior employee who can immediately step into the Executive Director role.
And that is perfectly realistic.
What you can have is enough structure, access and organisational knowledge so the Board is not starting from zero.
The test is surprisingly simple
You do not need to over-engineer this.
Imagine the Executive Director was unexpectedly unavailable for the next four weeks.
Could the Chair or another authorised person find one document that told them:
who to contact, where things are, how to access the critical systems, what money needs attention, what commitments have been made and what needs to happen next?
If the answer is yes, you are in reasonably good shape.
If the answer is no, that is probably a conversation worth having.
Because in a small association, business continuity is not about creating another large policy.
It is about making sure the organisation does not exist only inside one person’s head.