Accountio / Templates / IT security / Business continuity plan

Business continuity plan template for accountancy practices

Know who leads, what comes back first and how client deadlines are met when ransomware hits, the office closes or a key person is off. This business continuity plan template is one Word plan that also covers disaster recovery, with a record of every test.

UK practices
$15
In the pack
Practice IT security pack
Files
5, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

IT security · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the plan looks like

Business continuity plan template
What the plan coversSection in the plan
Who is in charge and who to call
✓
1. Who leadsPlan lead, deputy, IT support, insurer, bank and landlord, with a printed copy kept off site
What must come back first
✓
2. Our critical systemsEmail, accounting and tax software, practice management, payroll and phones, each with a recovery time
The first hour
✓
3. First hour, whatever has happenedSafety, deciding to start the plan, containing the problem, calls and a written log
Ransomware or a cyber attack
✓
4.1 Scenario: ransomware or a cyber attackDisconnect, don't pay, reset from a clean device, restore from the separate backup
Losing the office
✓
4.2 Scenario: office unavailable (fire, flood, power, no access)Home working, phone diversion, post redirection and telling clients with urgent deadlines
A lost laptop or phone
✓
4.3 Scenario: laptop or phone lost or stolenRemote lock and wipe, and a decision on whether client data was at risk
A key person off
✓
4.4 Scenario: key person unavailableWhat only one person can do now, such as approving payroll, and who covers it
A supplier or internet outage
✓
4.5 Scenario: supplier or internet outageBackup connection and a note of anything missed near a deadline
Client deadlines during the disruption
✓
5. Deadlines during a disruptionVAT, PAYE, payroll, tax returns and Companies House filings in the next two weeks, each with a named person
Backups and restore tests
✓
6. BackupsHow often each system is backed up, where the separate copy is and the last restore test
Who tells staff, clients and the regulator
✓
7. Telling peopleIncluding the Information Commission if personal data is affected
Review and testing
✓
8. After the event, 9. Test recordA review after each event and a dated record of every test and its actions

When you need it

A continuity plan is written before anything goes wrong, so that on the day nobody has to work out who to call or what to restore first. A small practice needs one when:

  • Client files, email and accounting software sit in the cloud or on a few laptops
  • One partner holds the HMRC agent credentials or approves every payroll
  • You have backups but have never tested restoring from one
  • Staff could work from home, but nothing says how phones, post and client deadlines are handled

How to use the business continuity plan template

  1. Fill in who leads. Plan lead, deputy, IT support, insurer, bank and landlord, with phone numbers. Keep a printed copy at the office and at the plan lead's home.
  2. Set recovery times. For each critical system, say how soon it must be back, for example four hours for email.
  3. Name cover for key people. List what only one person can do now and who takes it over.
  4. Record your backups. For each system, how often it is backed up, where the separate copy is and the date of the last restore test.
  5. Test it once a year. Run a restore test or a desk exercise, write the result in the test record, and review the plan after any real event.

Questions

What is the difference between business continuity and disaster recovery?

Disaster recovery is getting systems and data back: restoring from backup, resetting accounts and replacing devices. Business continuity is keeping the practice working while that happens: who leads, how clients are told and how deadlines are still met. This plan covers both in one document.

What should a business continuity plan include?

Who leads and how to reach them, the critical systems and how soon each must be back, first steps for any incident, a short plan for each likely scenario, cover for key people, backups, who tells staff and clients, and a record of tests.

What should a practice do first after a ransomware attack?

Disconnect affected devices from the network without turning them off, disable affected accounts, and call your IT support and insurer. Don't pay or contact the attacker. Restore from the separate backup only once the cause is removed.

Do we have to report a cyber attack to the Information Commission?

If personal data was affected, report the breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. The Information Commission took over from the ICO on 30 September 2026.

How should backups be kept?

The NCSC advises backing up all the data the business needs to operate, keeping a storage device disconnected when not in use, turning on 2-step verification for online backups, and checking that you know how to restore. The plan records where the separate copy is and when it was last restored.

How often should the plan be tested?

Once a year, with a restore test or a desk exercise, and again after any real event. Each test goes in the test record with its result and actions.

Also in the practice IT security pack

Information security policyStaff IT acknowledgementIT asset and access register

See the whole pack →

Who it's for

Small UK accountancy and bookkeeping practices that run on cloud software and a handful of laptops.

Last checked

Checked against UK GDPR article 33 and the NCSC's guidance on backing up data in November 2026.