A contractor I know went into the emergency room on a Tuesday with what he thought was a pulled muscle. It was his appendix. He was out for eleven days, groggy for three weeks after that, and the whole time his phone was buzzing with things only he could answer: which vendor to pay, what the gate code was at the Peterson job, whether payroll ran. His wife sat in the hospital hallway trying to guess his laptop password. That is the exact situation a business continuity plan for a small business is built to prevent — not a hurricane, not a cyberattack, but the ordinary human event of the owner being unreachable for a stretch and the business having no way to keep moving without them.
Most of the continuity advice you'll find is written for companies with an IT department and a disaster-recovery vendor. That's not you. For an owner-operator, continuity isn't about server backups. It's about three concrete things: access (can someone get into the accounts?), authority (is someone legally allowed to act?), and instructions (does anyone know what to do?). I've watched businesses stall on all three, and I've helped owners fix them in an afternoon. Here's how it actually works.
Start with the honest test: unplug yourself for one day
Before you build anything, run the diagnostic. Pick a normal Wednesday and pretend you were admitted to a hospital at 6 a.m. with no phone. Don't answer a single work message. At the end of the day, write down every point where the business would have hit a wall. This is uncomfortable and that's the point — it turns "I should probably document things" into a specific list of failure points you can see.
Owners are always surprised by what surfaces. It's rarely the big strategic stuff. It's that the only person who knows the Wi-Fi password for the field tablets is you. It's that the merchant processor calls you personally to release a held deposit. It's that your bookkeeper emails you every payroll to confirm the run, and if you don't reply, payroll doesn't happen. This same exercise underpins a proper operations audit of your own business — you're just running it against a single failure mode: your absence.
The businesses that recover fastest from an owner's absence aren't the ones with the best people. They're the ones where access, authority, and instructions were written down before the crisis, not scrambled together during it.
Layer one: access — who can get into what
Access is the layer that fails first and hardest, because so much of it lives in your head and your fingerprint. Walk through it in this order.
A shared password vault, not a sticky note
If your logins live in your browser, your memory, or a note in your phone, no one else can reach them and you can't safely share them one at a time. Move everything into a real password manager — 1Password, Bitwarden, or similar — and here's the part owners skip: set up emergency access. 1Password has an Emergency Kit you can seal in an envelope; Bitwarden and LastPass let you name a trusted contact who can request your vault and receive it after a waiting period you control, say 48 hours. That waiting period is the safeguard — no one can grab it while you're fine, but the moment you're genuinely out, they don't need you to unlock anything.
A second super-admin on your core platforms
Your email is the master key to your business. If you're the sole administrator on Google Workspace or Microsoft 365 and you're locked out or incapacitated, account recovery through identity verification can take two weeks or more — and during those two weeks nobody can reset a staff password, access a shared drive, or read the invoices piling up in your inbox. Add a second super-admin today. It takes four minutes and it is the single highest-return step on this entire list.
Banking and money movement
Log into your business bank account and check who is listed as an authorized signer. If it's only you, no one can legally move money, approve a wire, or handle a fraud hold while you're out. Most banks require a second signer or an agent to be added in person or by notarized form, so this one has lead time — start it this week. The same goes for your merchant processor, your payroll platform, and any card that gets declined at a supply house at the worst moment.
Layer two: authority — who is legally allowed to act
Access lets someone log in. Authority lets them make decisions that hold up. These are different, and the second one has real legal edges most owners have never looked at.
The core document is a durable power of attorney. An ordinary power of attorney becomes void the instant you're incapacitated — which is precisely when you need it. A durable POA survives your incapacity and lets a named person sign checks, deal with the IRS, talk to your bank, and keep contracts moving. If your business is an LLC or corporation, your operating agreement or bylaws should also name who has signing authority if you can't act; a lot of single-member LLCs have a blank where that clause should be. The SBA's guidance on preparing your business for emergencies is a reasonable starting point, but for the POA itself, spend the money on an attorney — a template off the internet that doesn't match your state's requirements is worthless at the exact moment you need it to work.
Two more authority items owners overlook:
- Key-person disability insurance. Business interruption coverage — usually an add-on to a Business Owner's Policy — generally only pays out after physical property damage. It does nothing for the far more common event of the owner being hospitalized. The product that covers you being out is key-person or business-overhead-expense disability insurance, which replaces income and covers fixed costs while you recover.
- Written authority limits. Give your fill-in person a clear ceiling: "You can approve any expense under $2,500 and any refund under $500 without calling anyone. Above that, here's who to reach." Without a number, they either freeze or overreach. Both are bad.
Layer three: instructions — the thing only you know how to do
This is where the work of building real systems pays off. If you've already been capturing the processes that live only in your head, you're most of the way there. If you haven't, an absence plan is the forcing function that finally makes it happen.
You don't need to document everything. You need to document the things that (a) happen on a fixed schedule while you're out, and (b) only you know how to do. Those two filters cut the job down to something you can finish in a weekend. In my experience it comes down to roughly a dozen recurring items:
- Payroll — when it runs, who approves it, how to handle a correction. The IRS does not pause federal deposit deadlines because you're in a hospital bed; a missed EFTPS deposit starts a failure-to-deposit penalty at 2% and climbs to 15%. This one cannot wait for you to feel better.
- Bills and vendor payments — what's on autopay, what needs manual approval, which vendors will hold a job if they're not paid.
- Invoicing and collections — how work gets billed and who chases the money, because cash flow is what kills businesses during an owner's absence, not the absence itself.
- The customer-facing promise — how appointments get confirmed, who answers the phone, what a customer is told if there's a delay.
- Recurring compliance dates — sales tax filings, quarterly estimates, license renewals, insurance premiums.
For each one, write it the way you'd explain it to a competent adult who has never done it — the same discipline you'd use to write a usable SOP. Screenshots beat paragraphs. A short screen recording beats both. Store them where your fill-in person can actually find them, and put a one-page "if I'm out, start here" index at the front that points to each one.
Name the person before you need them
A plan with no named person is a document, not a continuity plan. Decide now who steps in — a spouse, an operations lead, a trusted bookkeeper, a fellow owner you trade coverage with. It doesn't have to be one person for everything; the best setups split it, with one person on money and one on operations. The point is that the role is assigned, the person knows they're assigned, and they've seen the folder before the emergency.
This is also the strongest argument for not being the only capable operator in your own company. Every step you take toward making the business run without you is a step toward being able to disappear for a month without the revenue disappearing too. Continuity planning and delegation are the same muscle worked from two directions.
Keep it alive — a plan you never revisit is a lie
Passwords rotate. Signers change. That vendor you named retired. A continuity plan you wrote once and filed away will be quietly wrong within a year, and wrong is worse than nothing because it creates false confidence. Put a recurring 30-minute review on the calendar every quarter: confirm the emergency access still works, the second admin is still active, the durable POA still names the right person, and the top dozen instructions still match how you actually operate. Ten minutes of the review should be your fill-in person actually opening the folder and telling you what they can't find.
Good books, a website that captures the customer while you're out, and sensible automation on the recurring tasks all make the plan easier to execute — that's the back-office layer a well-run business keeps humming regardless of who's steering. But the plan itself is simpler than any of that. It's access, authority, and instructions, written down, assigned to a real human, and kept current. Build it on a quiet week, not from a hospital hallway. The continuity-planning framework at Ready.gov and the IRS disaster-preparedness guidance for businesses are both worth an hour of your time as you build yours.
Frequently asked questions
What is a business continuity plan for a small business, in plain terms?
It's a written plan that lets your business keep operating when you, the owner, are suddenly unavailable. For an owner-operator it comes down to three things: who can access the accounts, who has legal authority to act, and who has clear instructions for the recurring work that only you currently know how to do.
How long does it take to build one?
The core version takes a weekend. Adding a second admin and setting up emergency access in your password manager takes under an hour. The banking signer and durable power of attorney have lead time because they involve your bank and an attorney, so start those first, then write the top dozen instructions.
What's the single most important step if I only do one thing?
Add a second super-admin to your business email and set up emergency access in your password manager. Email is the master key to almost everything else, and a locked-out sole admin can be frozen out for two weeks or more during identity-verification recovery.
Do I really need a lawyer, or can I use a template?
Use an attorney for the durable power of attorney specifically. POA requirements vary by state, and a template that doesn't meet your state's execution and notarization rules can be rejected at the exact moment it matters. The instructions and access steps you can do yourself.