A business continuity plan for SME operations is not a thick binder written by consultants. It is one page that answers a single question: if the system dies at 9 AM on your busiest day, how do you keep selling until it comes back?
I ask this question in almost every engagement, and the honest answer is usually silence. Which is ironic, because five years ago the same business ran entirely on paper and phone calls. Digitization made you faster, but it also created a dependency that did not exist before. The cashier who used to write receipts by hand now freezes when the POS screen goes blank, not because she forgot how to sell, but because nobody told her she is allowed to.
The failure will happen. Internet outages, a payment gateway incident, a server disk that fills up, a laptop stolen from a car, PLN taking the neighborhood down for maintenance. The question is never whether, only whether you lose one hour of composure or one full day of revenue.
Digitization creates a new single point of failure
Here is the pattern I keep seeing. A business digitizes a process, the POS, the order intake, the delivery scheduling, and it works so well that within six months nobody remembers the manual way. The paper forms get thrown out. New staff are trained only on the app. The system becomes the process.
That is exactly what you want on a normal day. On an abnormal day, it means a Rp 200 thousand modem failure can stop a business doing Rp 30 million a day. A distributor I worked with lost most of a Saturday, their biggest day, because the internet went down and nobody knew whether they could take orders without the system. They could have. Nobody had decided it in advance, so nobody decided it at all.
Continuity planning is simply making those decisions before the outage, when you are calm, instead of during it, when you are not.
The one-page continuity plan
Do not write a document nobody will read. Write one page with three sections and stick a printed copy at the cashier, in the warehouse, and in the office.
1. Manual fallback per critical process
List your critical processes, usually four to six, and write one line for each: what we do when the system is down.
| Process | Manual fallback |
|---|---|
| Taking payment | Pre-printed numbered receipt book, cash and bank transfer to the listed account, QRIS standee still works if it is the bank's static code |
| Recording sales | Paper sales log sheet, one line per transaction, entered into the system after recovery |
| Checking stock | Physical check, mark items sold on the log so counts stay reconstructible |
| Taking orders | WhatsApp on the owner's phone as the fallback channel, orders written on the intake form |
| Deliveries | Printed copy of today's delivery schedule, printed every morning as routine |
Two details matter more than they look. Numbered receipt books keep the paper trail auditable, so recovery data entry is complete and fraud during outages stays hard. And printing today's schedule every morning costs one sheet of paper and means an outage never erases the current day.
2. Who to call, in what order
During an outage, the most expensive activity is people asking each other who should be doing something. Write the escalation list with actual names and phone numbers:
- First responder: who checks the obvious things, power, modem restart, is it just us or is the provider down.
- Technical contact: your developer, vendor, or IT support, with the phone number, not just an email.
- Provider contacts: ISP customer service number, payment gateway status page URL, hosting provider support.
- Decision maker: who is authorized to say "switch to manual mode" so staff do not wait for permission that never comes.
That fourth line is the one most plans miss. Give the shift supervisor explicit authority: if the system is down for more than 15 minutes, switch to paper, no approval needed. The permission, written down in advance, is worth more than any technology.
3. Recovery priority order
When systems come back, or when your technical person has to choose what to restore first, the order should be a business decision, made now. A typical order for a trading business:
- Ability to take payment
- Ability to take new orders
- Stock accuracy
- Reporting and everything else
Your order may differ. A service business might put customer communication first. The point is that your developer should not be guessing your commercial priorities at midnight during an incident.
Run one tabletop drill, it takes an hour
A plan that has never been rehearsed is a theory. You do not need to actually pull the plug on a busy day. Run a tabletop drill instead: gather the team for an hour, announce a scenario, "it is Saturday 10 AM, the POS is dead and the ISP says four hours", and walk through the plan verbally.
You will find the holes in the first fifteen minutes. The receipt book that was never actually bought. The ISP account number nobody knows. The QRIS standee that turns out to be dynamic and needs the system to generate codes. The new cashier who has never seen the paper log sheet. Every hole found in a drill is a hole that will not surprise you during a real outage.
Fix the holes, update the one page, and put a repeat drill in the calendar for six months later with a colleague invited to observe. In my experience an SME's first drill surfaces three to five real gaps, and the second drill runs almost boring. Boring is the goal.
Continuity is not the same as backups
One clarification, because these get mixed together. Backups answer "can we get our data back after a disaster". Continuity answers "can we operate while we wait". You need both, and they are different projects. A perfect backup does not help the cashier at 9 AM, and a perfect paper fallback does not save you if the database is gone forever. I covered the data side separately in backups and disaster recovery, the unsexy lifesaver, and the plan above pairs with the broader thinking in why your business needs a technology strategy.
The takeaway
A real business continuity plan for SME scale is one page, four hours of total effort, and one tabletop drill:
- One line of manual fallback per critical process, with the physical materials actually purchased and placed.
- A contact list with names, numbers, and one person pre-authorized to declare manual mode.
- A recovery priority order decided by the owner, not improvised by the technician.
- One hour-long drill to find the holes while they are still free to fix.
The businesses that handle outages well are not the ones with the most sophisticated systems. They are the ones where a fifteen-minute outage triggers a calm, rehearsed switch to paper, and the customers barely notice. That calm costs almost nothing to build. Build it this week, before you need it.