operational contingency plan meaning

What Is Contingency Planning? [+ Examples]

Published: January 13, 2023

The COVID-19 pandemic has shown, more than ever, the importance of being prepared with a contingency plan for the unexpected, especially when it comes to business continuity.

While some unexpected interruptions can be due to situations outside of your control, some issues arise that may be caused by internal errors. Unexpected problems can also be positive, like a sudden influx of interest in a new product.

Regardless of the scenario, it's essential to prepare for everything, and contingency planning helps you do so. This post will explain what contingency planning is, outline the steps you can follow to create your own plan, and give examples that you can use for inspiration.

• Contingency Planning
• Business Contingency Plan
• Making a Contingency Plan
• Contingency Plan Timeline
• Contingency Plan Example

Contingency Plan Definition

What is a contingency plan? Simply put, a contingency plan is an action plan designed to help organizations respond to a potential future incident. Think of it as a backup plan, or plan B to guide organizations through a worst-case scenario.

Contingency plans are helpful for all types of organizations, from businesses to non-profits, to government organizations. While these scenarios may never come to fruition, it’s important to have a plan in place so that your team isn’t panicking or scrambling to deal with an unfavorable event at the last minute.

What is contingency planning?

Contingency planning is a proactive process of creating a strategy to help you prepare for any scenario that can affect your business, regardless of the likelihood of its occurrence.

These plans shouldn't focus solely on situations that may harm your business. For example, you may experience a significant increase in revenue during a specific period due to changes in market behavior. This is a good scenario, but you will still need to adapt your operations to scale and appropriately meet the new demands of your growing audience.

Contingency Planning vs. Crisis Management

Contingency planning is also different from crisis management , as it is not a reaction to something that has already happened but more so a plan for if and when something may happen. However, a contingency plan can help you with crisis management when issues arise.

Contingency Planning vs. Risk Management

Risk management is the identification, mitigation, and assessment of potential risks that may affect your organization. This process helps an organization prevent losses before they occur and aids in assessing whether or not certain risks are worth taking. Contingency planning can be a component of risk management since that process helps organizations survive these potential risks.

To ensure your business is prepared for everything, it's crucial to understand how to create a contingency plan.

What is a business contingency plan?

A business contingency plan is a strategy that outlines the steps your business’ teams will take in the event of a crisis occurring. It is essentially the backup plan that goes into action when the worst-case scenario occurs. The goal of your contingency plan is to help your business stay up and running after an issue arises.

Business Continuity Plan vs. Contingency Plan

Although their names vary by few letters, business continuity and contingency plans are different concepts. Continuity is the ability of your business to continue functioning after an incident that has disrupted operations occurs. A contingency plan is an action plan that goes into place if an incident were to happen.

Contingency plans can significantly impact whether your business can achieve continuity. Being able to react and take action during a crisis can dictate whether or not your business can emerge from the other side and continue normal business operations.

You can think of it like this: your continuity plans contain five sections: program administration, governance, business impact analysis, strategies and requirements, and training and testing. If your business also uses contingency plans, it could be part of the strategies and requirements section, which dictates how your business will respond to a crisis if it occurs.

Contingency Planning: How to Make a Business Contingency Plan

Creating a contingency plan is responding to the question of "What if?"

What if your storefront floods? Or what if your supplier goes out of business? The responses to the what-ifs are contingency plans. These scenarios aren't necessarily going to happen, but if there is a possibility that they'll affect your business, you're prepared if they do.

Below we'll discuss the steps that go into contingency planning.

Contingency Planning in 7 Steps

1. identify critical business functions..

This first step is the most important aspect of your planning, as it sets the tone for why your plans need to exist in the first place.

During this phase, identify all critical areas essential to keeping your business up and running every day. As these operations are imperative to success, you need to have plans to ensure that these operations continue, regardless of whatever scenarios arise.

You can think of it like this: these critical areas keep your business up and running on a day-to-day basis. Other areas are important, but these are the main functions that keep you afloat. Given this, you want to be prepared for anything and everything that may happen that can affect the critical areas, whether positive or negative. Contingency planning is exactly that.

Identifying these areas helps you move on to the next step as you begin brainstorming possible scenarios that can impact them.

2. Conduct a scenario assessment.

Once you've identified the critical operations of your business, you'll want to conduct a scenario assessment to identify situations that will affect these functions and put stress on your day-to-day operations.

For example, if your business operates out of a storefront, keeping your storefront up and running is a critical area of your business's success. Maybe you launch a new product that attracts more interest than you thought, and you need to deal with higher in-store traffic and a lack of products to satisfy the market. While it is a positive situation that will draw in more revenue, it can still have negative repercussions for your business if you don't deal with it when it happens.

You can think of this stage as similar to a risk assessment, but the possibilities are positive and negative. It may be helpful to meet with people who work in these critical areas and understand what they think may cause interruptions to their job duties and barriers to their success. Ask them how they feel situations will impact them and how they would deal with each scenario.

If you come up with a long list of threats, you can prioritize them based on their likelihood of occurring and how significant their impact would be on your business.

3. Create contingency plans for each scenario.

During this phase, you'll create contingency plans. Begin with the highest priority "threats," or those most likely to occur and most likely to cause significant stress to your business.

Outline the scenarios, people to inform, and the roles and responsibilities involved parties will have when they respond. We'll go over an example below, but a helpful template to follow can be:

• Outlining the scenario,
• Determine the probability of it occurring,
• Explain how you'll prepare ahead of time,
• Detail what the response will be if and when it happens.

Once you've created your plans, distribute them to key stakeholders in each scenario, so everyone understands what they are responsible for and can prepare ahead of time.

4. Get your plan approved.

Once you’ve come up with a desired plan of action, it’s time to get approval from stakeholders and management. If you’re creating both department-level and company-wide plans, this is especially important. Your plan won’t be a success unless there is buy-in from key members of your team and management. Once all parties agree that the course of action described in the contingency plan works for everyone, you can move forward with confidence.

5. Share the plan with your team.

Once your plan is approved, it’s time to distribute it. Putting it in a shared folder accessible to everyone creates transparency and makes it readily available if the time comes.

Make sure the parties involved know what they’re responsible for in the plan, that way you can execute the plan seamlessly should the worst-case scenario occur.

6. Test your plans.

As with all plans, it's essential to continuously test (more on that in the next section) and update them over time. As businesses scale and change, your business needs will likely change, and specific scenarios will no longer have as significant of an impact. There may also be new scenarios to plan for that you hadn't anticipated or thought of when you were a smaller operation.

It can be helpful to create a timeline that you'll use to spend dedicated periods reviewing your plans, testing them, and communicating with the necessary stakeholders about any changes you've made to the plans.

7. Update your plan as needed.

Consider your contingency plan a work in progress. You’ll need to adapt it as new risks arise and to ensure it still makes sense for your business needs. Whenever a new manager or executive joins the team, be sure to share it with them as needed so they know what (if anything) is expected of them.

Contingency Planning Timeline

As planning is always an involved process, you may be wondering how much time you should devote to each step. Let's discuss a timeline below.

Week One: Identify Key Operations

Give yourself about a week to identify the operational areas essential for business function. You likely already know what these areas are, but you want to do enough research to identify them all.

Weeks Two & Three: Brainstorm Scenarios

Take two to three weeks to brainstorm the scenarios you're going to create plans for. Spend as much time as possible speaking to the necessary stakeholders to understand their ideas about the scenarios and how they'd like them dealt with. You'll want to conduct probability assessments and market research to understand if your competitors have ever dealt with something similar. You want to make sure you have all the necessary information before drafting your plan, so this step should be the longest.

Week Four: Draft Plan

Give yourself a week to draft your plans. The first two steps should give you all the information you need, so the third step is simply fine-tuning your research and creating the final plan. You can also share what you've created with your stakeholders and iterate on what you have based on their feedback.

The final step to creating your plan, maintaining and testing, is a continuous effort. As mentioned above, your business will likely be impacted by different things at different times, so it's always important to review plans and ensure they still relate to your needs. For example, maybe you plan to do quarterly reviews and training so new hires, and existing employees, are all on the same page.

Contingency Planning Example

It may be helpful to have an example of a contingency plan, so we'll go over one below. The examples are of a positive and negative situation, so you can get a sense of how a plan applies to both.

Contingency Planning Mistakes to Avoid

Even with the best intentions, your contingency plan may get off to a rocky start. Here are some common mistakes to avoid when creating one of your own.

Not securing executive buy-in first.

Before you can get your team or department onboard, you must get buy-in from the executive team. Otherwise, you risk creating a doomed plan from the start.

Get their feedback on potential risks and other factors that may impact guidelines in the plan. Having executive support from the start ensures the plan put forth is approved and also can motivate those at the department level to buy-in as well.

Failure to cover multiple scenarios.

When assessing potential risks and scenarios, it’s important not to cut corners or slack. Scenario planning is key to your contingency plan’s success. All potential risks should be taken into account. You can rank them by likelihood, but you should by no means leave less likely events out. Otherwise, you leave yourself vulnerable should the event happen.

Think about how many businesses were affected by supply chain issues during the pandemic. Most probably never predicted such a catastrophe, but the ones that had a plan in place for such an obstacle were better prepared.

Set it and forget it.

It’s really easy to get comfortable once your contingency plan is in place — after all, if you did your due diligence from the start, you’re ready to tackle any obstacle thrown your way.

Unfortunately, it’s not a one-and-done process. A contingency plan should be looked at as a living document and updated as needed. Your business needs will change over time and so will its obstacles and risks.

Create Business Contingency Plan

All in all, contingency plans help you prepare for a host of what-if scenarios, whether they happen or not. As you never want to be caught in a challenging situation, being prepared is the best thing you can do to ensure your business continues to succeed, regardless of whatever happens along the way.

As the saying goes, better safe than sorry .

Editor's note: This post was originally published in November 2021 and has been updated for comprehensiveness.

Don't forget to share this post!

Related articles.

Social Media Crisis Management: Your Complete Guide [Free Template]

De-Escalation Techniques: 19 Best Ways to De-Escalate [Top Tips + Data]

Situational Crisis Communication Theory and How It Helps a Business

What Southwest’s Travel Disruption Taught Us About Customer Service

Showcasing Your Crisis Management Skills on Your Resume

What Is A Business Continuity Plan? [+ Template & Examples]

What Is Reputational Risk? [+ Real Life Examples]

10 Crisis Communication Plan Examples (and How to Write Your Own)

Top Tips for Working in a Call Center (According to Customer Service Reps)

Top 5 Crisis Management Skills for Business Leaders (& How to Apply Them)

Use this contingency plan template to communicate risk, prevention, and mitigation measures in your company.

100% Free CRM

Nurture and grow your business with customer relationship management software.

• Contact sales

Start free trial

What Is Contingency Planning? Creating a Contingency Plan

Table of Contents

What is contingency planning, what is a contingency plan, contingency plan example, how to create a contingency plan, business contingency plans, project contingency plans.

Contingency plans are used by smart managers who are aware that there are always risks that can sideline any project or business. Without having a contingency plan in place, your organization won’t be well prepared for risk management.

The term contingency planning refers to the process of preparing a plan to respond to any risks or unexpected events that might affect an organization. Contingency planning starts with a thorough risk assessment to identify any risks and then developing a contingency plan to resolve them or at least mitigate their negative impact.

Contingency planning takes many shapes as it’s used for helping businesses and projects across industries. Even governments use contingency plans to prepare for disaster recovery or economic disruption, such as those caused by natural disasters.

A contingency plan is an action plan that’s meant to help organizations mitigate the negative effects of risks. In simple terms, a contingency plan is a plan B that organizations should execute when things don’t go as expected.

ProjectManager has everything you need to build contingency plans to ensure your organization can respond effectively to risks. Use multiple planning tools such as Gantt charts, kanban boards and project calendars to assign work to your team and collaborate in real time. Plus, dashboards and reports let you track progress, costs and timelines. Get started today for free.

Now that we’ve briefly defined what contingency planning is, let’s take a look at a contingency plan example involving a manufacturing project.

Let’s imagine a business that’s planning to manufacture a batch of products for an important client. Both parties have signed a contract that requires the manufacturer to deliver the products at a certain date or there may be negative consequences as stated on the purchase agreement. To avoid this, the business leaders of this manufacturing company start building a contingency plan.

To keep this project contingency plan example simple, let’s focus on three key risks this company should prepare for.

• Supply chain shortages: The supply chain is one of the most important business processes for this manufacturing company. Therefore, one of the most impactful risks is a raw material shortage which may occur if their main supplier is unable to deliver the materials they need on time. To prepare a contingency action for this risk, the business owners decide to reach out to other suppliers and place standing purchase orders which give them the opportunity to ask for a certain quantity of materials at some point in the future. If the risk of a supply chain shortage occurs, they’ll have multiple sources of raw materials available in case their main supplier can’t keep up with their demand levels.
• Machinery breakdown: Another risk that might halt production is the malfunction of machinery. To prepare for this, business leaders hire extra maintenance personnel and order spare parts for their production line machinery as part of their contingency plan. If the risk of machinery breakdown becomes a reality, the organization will have the labor and resources that are needed to mitigate it.
• The team is not meeting the schedule: If the manufacturing team members are failing to meet their goals on time for whatever reason, the manufacturing business will need to allocate more resources such as extra labor and equipment to complete the work faster. However, this contingency action will generate additional costs and reduce the profitability of the project.

A contingency plan is an action plan , and like any plan, it requires a great deal of research and brainstorming. And like any good plan, there are steps to take to make sure you’re doing it right.

1. Identify Key Business Processes and Resources

To create an effective contingency plan you should first identify what are the key processes and resources that allow your organization to reach its business goals. This will help you understand what risks could be the most impactful to your organization. Research your company and list its crucial processes such as supply chain management or production planning as well as key resources, such as teams, tools, facilities, etc., then prioritize that list from most important to least important.

2. Identify the Risks

Now, identify all the risks that might affect your organization based on the processes and resources you’ve previously identified. Figure out where you’re vulnerable by brainstorming with employees, executives and stakeholders to get a full picture of what events could compromise your key business processes and resources; hire an outside consultant, if necessary.

3. Analyze Risks Using a Risk Matrix

Once you’ve identified all the risks that might affect your processes and resources, you’ll need to establish the likelihood and level of impact for each of those risks by using a risk assessment matrix . This allows you to determine which risks should be prioritized.

4. Think About Risk Mitigation Strategies

Now, write a risk mitigation strategy for each risk that you identified in the above steps. Start with the risks that have a higher probability and higher impact, as those are the most critical to your business. As time permits you can create a plan for everything on your list.

5. Draft a Contingency Plan

Contingency plans should be simple and easy to understand for the different members of your audience, such as employees, executives and any other internal stakeholder. The main goal of a contingency plan is to ensure your team members know how to proceed if project risks occur so they can resume normal business operations.

6. Share the Plan

When you’ve written the contingency plan and it’s been approved, the next step is to ensure everyone in the organization has a copy. A contingency plan, no matter how thorough, isn’t effective if it hasn’t been properly communicated.

7. Revisit the Plan

A contingency plan isn’t chiseled in stone. It must be revisited, revised and maintained to reflect changes to the organization. As new employees, technologies and resources enter the picture, the contingency plan must be updated to handle them.

A business contingency plan is an action plan that is used to respond to future events that might or might not affect a company in the future. In most cases, a contingency plan is devised to respond to a negative event that can tarnish a company’s reputation or even its business continuity. However, there are positive contingency plans, such as what to do if the organization receives an unexpected sum of money or other resources.

The contingency plan is a proactive strategy, different from a risk response plan , which is more of a reaction to a risk event. A business contingency plan is set up to account for those disruptive events, so you’re prepared if and when they arrive.

While any organization is going to plan for its product or service to work successfully in the marketplace, that marketplace is anything but stable. That’s why every company needs a business contingency plan to be ready for both positive and negative risk management.

In project management, contingency planning is often part of risk management. Any project manager knows that a project plan is only an outline. Sometimes, unexpected changes and risks cause projects to extend beyond those lines. The more a manager can prepare for those risks, the more effective his project will be.

But risk management isn’t the same as contingency planning. Risk management is a project management knowledge area that consists of a set of tools and techniques that are used by project managers to create a risk management plan.

A risk management plan is a comprehensive document that covers everything about identifying, assessing, avoiding and mitigating risks.

On the other hand, a contingency plan is about developing risk management strategies to take when an actual issue occurs, similar to a risk response plan. Creating a contingency plan in project management can be as simple as asking, “What if…?” and then outlining the steps to your plan as you answer that question.

Related: Free Action Plan Template

Using ProjectManager to Create a Contingency Plan

ProjectManager has the project planning and risk management tools you need to make a reliable contingency plan that can quickly be executed in a dire situation.

Use Task Lists to Outline the Elements

Use our task list feature to outline all the elements of a contingency plan. Since a contingency plan likely wouldn’t have any hard deadlines at first, this is a good way to list all the necessary tasks and resources. You can add comments and files to each task, so everyone will know what to do when the time comes.

Reference Dashboards to Monitor the Contingency Plan

Our dashboard gives you a bird’s eye view of all of the critical project metrics. It displays live data so you’re getting a real-time look at how your project is progressing. This live information can help you spot issues and resolve them to make sure that your contingency plan is a success. Which, given that it’s your plan B, is tantamount.

If you’re planning a project, include a contingency plan, and if you’re working on a contingency plan then have the right tools to get it done right. ProjectManager is online project management software that helps you create a shareable contingency plan, and then, if you need to, execute it, track its progress and make certain to resolve whatever problems it’s addressing. You can do this all in real time! What are you waiting for? Check out ProjectManager with this free 30-day trial today!

Deliver your projects on time and under budget

Start planning your projects.

• Contact Sales
• Download App
• Business strategy |
• What is a contingency plan? 9 steps tha ...

What is a contingency plan? 9 steps that could save your business when crisis strikes

A business contingency plan is a backup strategy for your team or organization. It lays out how you’ll respond if unforeseen events knock your plans off track—like how you’ll pivot if you lose a key client, or what you’ll do if your software service goes down for more than three hours. Get step-by-step instructions to create an effective contingency plan, so if the unexpected happens, your team can spring into action and get things back on track.

No one wants Plan A to fail—but having a strong plan B in place is the best way to be prepared for any situation. With a solid backup plan, you can effectively respond to unforeseen events effectively and get back on track as quickly as possible. 

A contingency plan is a proactive strategy to help you address negative developments and ensure business continuity. In this article, learn how to create a contingency plan for unexpected events and build recovery strategies to ensure your business remains healthy.

What is a business contingency plan? 

A business contingency plan is a strategy for how your organization will respond to important or business-critical events that knock your original plans off track. Executed correctly, a business contingency plan can mitigate risk and help you get back to business as usual—as quickly as possible. 

You might be familiar with contingency plans to respond to natural disasters—businesses and governments typically create contingency plans for disaster recovery after floods, earthquakes, or tornadoes. 

But contingency plans are just as important for business risks. For example, you might create a contingency plan outlining what you will do if your primary competitors merge or how you’ll pivot if you lose a key client. You could even create a contingency plan for smaller occurrences that would have a big impact—like your software service going down for more than three hours.

The differences between a business contingency plan and a project risk management plan

A contingency plan is similar to a project risk management plan or a crisis management plan because it also helps you identify and resolve risks. However, a business contingency plan should cover risks that span multiple projects or even risks that could affect multiple departments. To create a contingency plan, identify and prepare for large, business-level risks.

Contingency plan examples

There are a variety of reasons you’d want to set up a contingency plan. Rather than building one contingency plan, you should build one plan for each type of large-scale risk or disaster that might strike. 

Environmental contingency plan

While severe earthquakes aren’t particularly common, being unprepared when “the big one” strikes could prove to be catastrophic. This is why governments and businesses in regions prone to earthquakes create preparedness initiatives and contingency plans.

A government contingency plan for an earthquake could include things like: 

The names and information of the people designated to handle certain tasks in advance to ensure the emergency response is quick and concise

Ways to educate the public on how to respond when an earthquake hits

A timeline for emergency responders.

Technology contingency plan

If your business is particularly data-heavy, for example, ensuring the safety and security of your information systems is critical. Whether a power surge damages your servers or a hacker attempts to infiltrate your network, you’ll want to have an emergency response in place.

A business’s contingency plan for a data breach could involve: 

Steps to take and key team members to notify in order to get data adequately secured once more

The names and information of stakeholders to contact to discuss the impact of the data breach and the plan to protect their investment

A timeline to document what is being done to address the breach and what will need to be done to prevent data breaches in the future

9 steps to create a contingency plan

You can create a contingency plan at various levels of your organization. For example, if you're a team lead, you could create a contingency plan for your team or department. Alternatively, company executives should create business contingency plans for situations that could impact the entire organization. 

As you create your contingency plan, make sure you evaluate the likelihood and severity of each risk. Then, once you’ve created your plan—or plans—get it approved by your manager or department head. That way if a negative event does occur, your team can leap to action and quickly resolve the risk without having to wait for approvals.

1. Make a list of risks

Before you can resolve risks, you first need to identify them. Start by making a list of any and all risks that might impact your company. Remember: there are different levels of contingency planning—you could be planning at the business, department, or program level. Make sure your contingency plans are aligned with the scope and magnitude of the risks you’re responsible for addressing. 

A contingency plan is a large-scale effort, so hold a brainstorming session with relevant stakeholders to identify and discuss potential risks. If you aren’t sure who should be included in your brainstorming session, create a stakeholder analysis map to identify who should be involved.

2. Weigh risks based on severity and likelihood

You don’t need to create a contingency plan for every risk you laid out. Once you outline risks and potential threats, work with your stakeholders to identify the potential impact of each risk. 

Evaluate each risk based on two metrics: the severity of the impact if the risk were to happen, and the likelihood of the risk occurring. During the risk assessment phase, assign each risk a severity and likelihood—we recommend using high, medium, and low. 

3. Identify important risks

Once you’ve assigned a severity and likelihood to each risk, it’s up to you and your stakeholders to decide which risks are most important to address. For example, you should definitely create a contingency plan for a risk that’s high likelihood and high severity, whereas you probably don’t need to create a contingency plan for a risk that’s low likelihood and low severity. 

You and your stakeholders should decide where to draw the line.

4. Conduct a business impact analysis

A business impact analysis (BIA) is a deep dive into your operations to identify exactly which systems keep your operations ticking. A BIA will help you predict what impact a specific risk could have on your business and, in turn, the response you and your team should take if that risk were to occur. 

Understanding the severity and likelihood of each risk will help you determine how exactly you will need to proceed to minimize the impact of the threat to your business. 

For example, what are you going to do about risks that are low severity but high likelihood? What about risks that are high severity, but relatively low likelihood? 

Determining exactly what makes your business tick will help you create a contingency plan for every risk, no matter the likelihood or severity. 

5. Create contingency plans for the biggest risks

Create a contingency plan for each risk you’ve identified as important. As part of that contingency plan, describe the risk, and brainstorm what your team will do if the risk comes to pass. Each plan should include all of the steps you need to take to return to business as usual.

Your contingency plan should include information about:

The triggers that will set this plan into motion

The immediate response

Who should be involved and informed

Key responsibilities, including a RACI chart if necessary

The timeline of your response (i.e. immediate things to do vs. longer-term things to do)

For example, let’s say you’ve identified a potential staff shortage as a likely and severe risk. This would significantly impact normal operations, so you want to create a contingency plan to prepare for it. Each person on your team has a very particular skill set, and it would be difficult to manage team responsibilities if more than one person left at the same time. Your contingency plan might include who can cover certain projects or processes while you hire a backfill, or how to improve team documentation to prevent siloed skillsets. 

6. Get approval for contingency plans

Make sure relevant company leaders know about the plan and agree with your course of action. This is especially relevant if you’re creating team- or department-level plans. By creating a contingency plan, you’re empowering your team to respond quickly to a risk, but you want to make sure that course of action is the right one. Plus, pre-approval will allow you to set the plan in motion with confidence—knowing you’re on the right track—and without having to ask for approvals beforehand.

7. Share your contingency plans

Once you’ve created your contingency plans, share them with the right people. Make sure everyone knows what you’ll do, so if and when the time does come, you can act as quickly and seamlessly as possible. Keep your contingency plans in a central source of truth so everyone can easily access them if necessary.

Creating a project in a work management platform is a great way of distributing the plan and ensuring everyone has a step-by-step guide for how to enact it.

8. Monitor contingency plans

Review your contingency plan frequently to make sure it’s still accurate. Take into account new risks or new opportunities, like new hires or a changing business landscape. If a new executive leader joins the team, make sure to surface the contingency plan for their review as well. 

9. Create new contingency plans (if necessary)

It’s great if you’ve created contingency plans for all the risks you found, but make sure you’re constantly monitoring for new risks. If you discover a new risk, and it has a high enough severity or likelihood, create a new contingency plan for that risk. Likewise, you may look back on your plans and realize that some of the scenarios you once worried about aren’t likely to happen or, if they do, they won’t impact your team as much.

Common contingency planning pitfalls—and how to avoid them

A contingency plan is a powerful tool to help you get back to normal business functions quickly. To ensure your contingency planning process is as smooth as possible, watch out for common pitfalls, like: 

Lack of buy-in

It takes a lot of work to create a contingency plan, so before you get started, ensure you have support from executive stakeholders. As you create your plan, continuously check in with your sponsors to ensure you’ve addressed key risks and that your action plan is solid. By doing so, you can ensure your stakeholders see your contingency plan as something they can get behind.

Bias against “Plan B” thinking

Some company cultures don’t like to think of Plan B—they like to throw everything they have at Plan A and hope it works. But thinking this way can actually expose your team to more risks than if you proactively create a Plan B.

Think of it like checking the weather before going sailing so you don’t accidentally get caught in a storm. Nine times out of ten, a clear sunny day won’t suddenly turn stormy, but it’s always better to be prepared. Creating a contingency plan can help you ensure that, if a negative event does occur, your company will be ready to face it and bounce back as quickly as possible. 

One-and-done contingency plans

It takes a lot of work to put a contingency plan together. Sometimes when you’ve finished, it can be tempting to consider it a job well done and forget about it. But make sure you schedule regular reminders (maybe once or twice a year) to review and update your contingency plan if necessary. If new risks pop up, or if your business operations change, updating your contingency plan can ensure you have the best response to negative events. 

You’ve created a contingency plan—now what?

A contingency plan can be a lot of work to create, but if you ever need to use it, you’ll be glad you made one. In addition to creating a strong contingency plan, make sure you keep your plan up-to-date.

Being proactive can help you mitigate risks before they happen—so make sure to communicate your contingency plan to the team members who will be responsible for carrying them out if a risk does happen. Don’t leave your contingency plan in a document to collect dust—after creating it, you should use it if need be!

Once you’ve created the plan, make sure you store it in a central location that everyone can access, like a work management platform . If it does come time to use one of your contingency plans, storing them in a centrally accessible location can help your team quickly turn plans into action.

Related resources

Learn Why Asana is a Customers' Choice for the Collaborative Work Management Market

Meet Asana Intelligence: AI has joined the team

What is demand management? And do you need it?

What is a matrix organization and how does it work?

This is a potential security issue, you are being redirected to https://csrc.nist.gov .

You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality.

Official websites use .gov A .gov website belongs to an official government organization in the United States.

• Drafts for Public Comment
• All Public Drafts
• NIST Special Publications (SPs)
• NIST interagency/internal reports (NISTIRs)
• ITL Bulletins
• White Papers
• Journal Articles
• Conference Papers
• Security & Privacy
• Applications
• Technologies
• Laws & Regulations
• Activities & Products
• News & Updates
• Cryptographic Technology
• Secure Systems and Applications
• Security Components and Mechanisms
• Security Engineering and Risk Management
• Security Testing, Validation, and Measurement
• Cybersecurity and Privacy Applications
• National Cybersecurity Center of Excellence (NCCoE)
• National Initiative for Cybersecurity Education (NICE)

contingency plan

   Management policy and procedures used to guide an enterprise response to a perceived loss of mission capability. The Contingency Plan is the first plan used by the enterprise risk managers to determine what happened, why, and what to do. It may point to the continuity of operations plan (COOP) or disaster recovery plan (DRP) for major disruptions. Sources: CNSSI 4009-2015    A plan that is maintained for disaster response, backup operations, and post-disaster recovery to ensure the availability of critical resources and to facilitate the continuity of operations in an emergency situation. Sources: NIST SP 800-57 Part 1 Rev. 5 under Contingency plan

Glossary Comments

Comments about specific definitions should be sent to the authors of the linked Source publication. For NIST publications, an email is usually found within the document.

Comments about the glossary's presentation and functionality should be sent to [email protected] .

See NISTIR 7298 Rev. 3 for additional details.

An overview of business contingency plans

Reading time: about 3 min

Natural disasters, data hacking, theft—your organization has likely prepared for major catastrophes.

Less significant events can also be majorly disruptive—say your biggest customer suddenly switching to a competitor or your entire sales staff getting food poisoning at their annual retreat.

Many circumstances have the potential to disrupt, or worse, shut down your business. A business contingency plan can save the day. Follow the steps below to develop a business contingency plan that will help you stay prepared for the worst.

What is a contingency plan?

A contingency plan is a roadmap created by management to help an organization respond to an event that may or may not happen in the future—whether it’s a large-scale event like a natural disaster or a small-scale roadblock like employee theft.

The purpose of a business contingency plan is to maintain business continuity during and after a disruptive event. A contingency plan can also help organizations recover from disasters, manage risk, avoid negative publicity, and handle employee injuries.

By developing a contingency plan, your business can react faster to unexpected events. The faster your organization is able to get back up and running, the less impact you'll see on profits and revenue.

How to write a contingency plan

There are many factors to consider when building a contingency plan. These four steps are a good place to start preparing for the unexpected.

1. Identify the risks

Before you can prepare for a disaster, you need to understand what types of disasters you’re preparing for. Think about all the possible risks to your organization, including natural disasters, sudden changes to revenue or personnel, or security threats.

2. Prioritize the risks

Make sure you spend your time and resources preparing for events that have a high chance of occurring as you write and develop your contingency plan. For example, you may have listed earthquakes as a possible risk. However, if your area doesn't experience many earthquakes, you wouldn’t want to spend all your time preparing for this event. If your area is prone to flooding, you should spend more of your resources preparing for floods.

To determine which risks are more likely to occur, use a risk impact scale . This will help you to estimate the likelihood that an event will occur and determine where to focus your efforts.

3. Develop contingency plans

Once you’ve created a prioritized list, it’s time to put together a plan to mitigate those risks. As you write a contingency plan, it should include visuals or a step-by-step guide that outlines what to do once the event has happened and how to keep your business running. Include a list of everyone, both inside and outside of the organization, who needs to be contacted should the event occur, along with up-to-date contact information.

You can also create a list of ways to minimize the risk of these events now and start acting on it. 

4. Maintain the plan

Maintenance of your contingency plan is arguably the most important part of the process because it’s where the work happens to ensure you’re always ready.

Review your plan frequently. Personnel, operational, and technological changes can make the plan inefficient, which means you may need to make some changes.  

You’ll want to communicate the plan to everyone who could potentially be affected and clearly define what everyone's roles and responsibilities will be during a time of crisis. 

Buniness contingency plan example

To help you prepare for the unexpected, get started with these business contingency plan examples below. 

Ready to get started? Business contingency plans help you prepare your organization to handle anything unexpected. Give your employees a realistic plan for how they should handle any problem that arises. 

Learn the 5 steps to an effective risk management process.

Popular now.

Sign up to get the latest Lucidchart updates and tips delivered to your inbox once a month.

About lucidchart.

Lucidchart is the intelligent diagramming application that empowers teams to clarify complexity, align their insights, and build the future—faster. With this intuitive, cloud-based solution, everyone can work visually and collaborate in real time while building flowcharts, mockups, UML diagrams, and more.

The most popular online Visio alternative , Lucidchart is utilized in over 180 countries by millions of users, from sales managers mapping out target organizations to IT directors visualizing their network infrastructure.

Related posts:

Enterprise risk management 101

A complete guide to the risk assessment process

• Get started
• Project management
• CRM and Sales
• Work management
• Software development
• Construction management
• Product updates
• monday apps
• Comparisons
• Productivity
• Remote work

What is a contingency plan, and why every project needs one

Create a plan.

Follow that plan.

And … FAIL.

The vast majority of failed projects and bankrupt companies had a plan and followed it. So why do these projects and companies end up failing?

As it turns out, things don’t often follow a script to a tee in the real world. Instead, unexpected things happen that companies don’t plan for, and many fail to adapt in time.

A few years ago, people would have brushed off companies that prepared for global pandemics and government lockdowns. But it all paid off for them in this time of crisis.

The key: having a sound contingency plan.

Simply put, a contingency is all about expecting the unexpected and preparing to deal with worst-case scenarios ahead of time.

This article will cover what a  contingency plan is, why it’s essential, and provide step-by-step instructions for creating one immediately.

What is a contingency plan?

A contingency plan is a plan for a “what if” scenario that could ruin your project or business.

A simple example of a contingency plan is to back up all website data in case a website gets hacked. If this scenario happens, it’s easy to restore the data after regaining access and changing passwords.

Not prepared? The team might have to recreate the entire website from memory or build a website from scratch . That’s a significant expense and can mean several extra days (or weeks!) of downtime.

A contingency plan deals with eventualities like the above. But, it’s about managing and lowering risk and setting up for speedy disaster recovery .

Running a small business without a digital component? Unfortunately, there are still plenty of things that could go wrong.

• Most of your staff could get sick on the same day
• Your supplier could have a delayed shipment
• Your organization could file for bankruptcy

There’s no limit to how much bad luck you could have. But with the proper preparation, you can still come out on top.

Don’t miss more quality content!

What is the purpose of contingency planning.

The purpose of contingency planning is to ensure your business operates as smoothly as possible, despite mistakes and unexpected events.

But what’s the big deal?

On average, 32% of customers will walk away from a brand they love after a single bad experience .

Think about what that means.

The far majority could not.

If you’re providing a service that your customers expect 24/7 access to, it’s a constant risk.

When T-Mobile experienced a service outage in June 2020, at its peak, 113,980 customers reported the issue in a 15-minute period.

( Image Source )

The outage went on to last for several hours. If even 1/3 of those who reported — not experienced — the issue went on to switch brands, that’s millions of dollars in lost revenue.

That’s what you’re working to prevent at all costs.

Most causes of project failure can be kept at bay with good planning.

Even couples planning a picnic have a backup plan if the weather forecast is iffy. As a business, you can’t afford to be less prepared than picnic goers!

How to write a contingency plan for your business in 4 simple steps

Have we convinced you that not having a contingency plan is a horrible idea yet?

Let’s cover the basic contingency planning process and detail how to get yours up and running.

1. Map out essential processes.

What processes are essential to your business and safely delivering your product or service to customers?

If you’re a manufacturing company that ships directly to consumers, a simplified process list might look something like this:

• Getting raw materials from suppliers
• Manufacturing process
• Freight and shipping
• Packaging and warehousing
• Last-mile delivery

Looking at this list, you can see how vulnerable it is to natural disasters or even minor human errors.

Pro tip: Using a digital workspace platform like monday.com, you can plot out every step of your workflow .

Create an overview of every crucial process in your organization.

2. Create a list of risks for each process.

Once the process list is created, consider what might disrupt business continuity .

What can go wrong with each of these critical processes?

Let’s look at an example of what could go wrong with “last-mile delivery” …

• The driver can deliver single or multiple packages to the wrong address.
• The package can be damaged during delivery.
• The package could get lost at a distribution center.
• A truck full of packages could be involved in an accident.
• A flood could cripple the road system in a specific area.
• The driver could get delayed because a moose wants to lick salt splatter off the car (seriously, it’s a thing ).

And that’s only a preliminary list. Once you start thinking about it, you’ll realize how many things you rely on to avoid going wrong, even for fundamental processes.

Every business process is vulnerable to some sort of emergency or human error.

3. Evaluate the potential impact and likelihood of each risk.

Once the risks are identified, it’s essential to determine how they could impact your business.

Are they likely to happen? How large will the impact on your business if they do occur?

Most companies use “qualitative risk assessment” to do this.

PMI uses the following risk exposure assessment table — also called the probability impact matrix — to evaluate … the probability and impact of potential risks.

First, rate the severity of the impact on a scale from 1–100. Then, multiply with a percentage based on how likely it is to occur.

4. Calculate costs and contingency reserves, and identify issues to mitigate.

The quantitative risk assessment approach is less common — but more practical — to assess the potential cost of each risk.

How much would each risk potentially cost your business? To get a better overview, add these 4 columns to the risk register:

• Full potential loss from the event
• Expected loss from the event
• Cost of response (post-event)
• Cost of mitigation (pre-event)

This means you can make an educated decision when budgeting contingency reserves into project plans and yearly budgets.

During the risk analysis, estimate the potential costs of the adverse event.

EXAMPLE: if your online store goes down, multiply the average online sales revenue per hour with expected downtime. Make one pessimistic and one realistic estimate.

Your hosting service may also have a flat fee for restoring sites, which would be your response cost.

If these costs are unreasonably high and the event is likely, estimate the costs of a mitigation effort. In this case, it could be a firewall and extra procedures, like 2-factor authentication, an important security system , for all employees.

Budget in those costs.

An accurate budget is the first part of emergency response and prevention. Without enough cash, your team won’t be able to put any response plans into action.

5. Create a response plan for prioritized events.

Create a response plan for events by exploring the following questions:

• What can be done ahead of time to minimize any adverse effects on the event? For example, backing up data, carrying extra stock, or having more employees on call.
• What can be done immediately after the event to minimize the impact? For example, ordering more from a secondary supplier, rerouting another vehicle, or bringing in on-call staff.

The specifics depend on your company’s unique processes and situation.

Take your contingency plan to the next level with monday.com

Having your business contingency plan on paper is an excellent place to start. But it won’t translate to how your entire company will tackle a crisis.

That’s where monday.com comes in. Our flexible digital workspace provides everything necessary to ensure contingency plans get followed.

Outline entire contingency workflows in boards before events happen.

Make sure that no employee is left clueless during a crisis. Add contingency workflows directly into the workflow tables.

Add expandable workflows to any table to ensure everyone follows the same approach.

With this in place, even your newest employees won’t need to bother senior team members and management for guidance whenever something doesn’t go according to plan.

Use integrations to notify someone of an event automatically.

With monday.com’s powerful integrations and automations , response times to unfavorable events can be accelerated.

For example, you can immediately create and assign a work item whenever a customer submits a bug report.

This approach helps avoid another potential problem: customer service failing to report bug reports to your development team.

Monitor project status at all times in dashboards to avoid bottlenecks and domino effects.

The best time to start acting is before a catastrophic event that puts your entire project or business at risk.

To do that, your management team needs a clear understanding of the project’s status at all times.

With monday.com, easily create custom dashboards focusing on the most critical metrics.

Use the 30,000-foot view every manager dreams of to avoid predictable project delays and failures, and check that project controls are working properly.

Contingency plans are a must-have.

When starting a project or business, most people plan according to the status quo. Unfortunately, that’s a best-case scenario and not helpful in the real world.

A contingency plan helps you prepare for worst-case scenarios and keep your project afloat when everything goes wrong.

Use the monday.com contingency plan template to prepare your business for accidents, blackouts, natural disasters, and more.

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Business Continuity Plan

Business Continuity Planning Process Diagram - Text Version

When business is disrupted, it can cost money. Lost revenues plus extra expenses means reduced profits. Insurance does not cover all costs and cannot replace customers that defect to the competition. A business continuity plan to continue business is essential. Development of a business continuity plan includes four steps:

• Conduct a business impact analysis to identify time-sensitive or critical business functions and processes and the resources that support them.
• Identify, document, and implement to recover critical business functions and processes.
• Organize a business continuity team and compile a business continuity plan to manage a business disruption.
• Conduct training for the business continuity team and testing and exercises to evaluate recovery strategies and the plan.

Information technology (IT) includes many components such as networks, servers, desktop and laptop computers and wireless devices. The ability to run both office productivity and enterprise software is critical. Therefore, recovery strategies for information technology should be developed so technology can be restored in time to meet the needs of the business. Manual workarounds should be part of the IT plan so business can continue while computer systems are being restored.

Resources for Business Continuity Planning 

• Standard on Disaster/Emergency Management and Business Continuity Programs - National Fire Protection Association (NFPA) 1600
• Professional Practices for Business Continuity Professionals - DRI International (non-profit business continuity education and certification body)
• Continuity Guidance Circular - Federal Emergency Management Agency
• Open for Business® Toolkit - Institute for Business & Home Safety

Business Continuity Impact Analysis

Business continuity impact analysis identifies the effects resulting from disruption of business functions and processes. It also uses information to make decisions about recovery priorities and strategies.

The Operational & Financial Impacts worksheet  can be used to capture this information as discussed in Business Impact Analysis . The worksheet should be completed by business function and process managers with sufficient knowledge of the business. Once all worksheets are completed, the worksheets can be tabulated to summarize:

• the operational and financial impacts resulting from the loss of individual business functions and process
• the point in time when loss of a function or process would result in the identified business impacts

Those functions or processes with the highest potential operational and financial impacts become priorities for restoration. The point in time when a function or process must be recovered, before unacceptable consequences could occur, is often referred to as the “Recovery Time Objective.”

Resource Required to Support Recovery Strategies

Recovery of a critical or time-sensitive process requires resources. The Business Continuity Resource Requirements worksheet should be completed by business function and process managers. Completed worksheets are used to determine the resource requirements for recovery strategies.

Following an incident that disrupts business operations, resources will be needed to carry out recovery strategies and to restore normal business operations. Resources can come from within the business or be provided by third parties. Resources include:

• Office space, furniture and equipment
• Technology (computers, peripherals, communication equipment, software and data)
• Vital records (electronic and hard copy)
• Production facilities, machinery and equipment
• Inventory including raw materials, finished goods and goods in production.
• Utilities (power, natural gas, water, sewer, telephone, internet, wireless)
• Third party services

Since all resources cannot be replaced immediately following a loss, managers should estimate the resources that will be needed in the hours, days and weeks following an incident.

Conducting the Business Continuity Impact Analysis

The worksheets Operational and Financial Impacts  and Business Continuity Resource Requirements should be distributed to business process managers along with instructions about the process and how the information will be used. After all managers have completed their worksheets, information should be reviewed. Gaps or inconsistencies should be identified. Meetings with individual managers should be held to clarify information and obtain missing information.

After all worksheets have been completed and validated, the priorities for restoration of business processes should be identified. Primary and dependent resource requirements should also be identified. This information will be used to develop recovery strategies.

Recovery Strategies

If a facility is damaged, production machinery breaks down, a supplier fails to deliver or information technology is disrupted, business is impacted and the financial losses can begin to grow. Recovery strategies are alternate means to restore business operations to a minimum acceptable level following a business disruption and are prioritized by the recovery time objectives (RTO) developed during the business impact analysis .

Recovery strategies require resources including people, facilities, equipment, materials and information technology. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps. For example, if a machine fails but other machines are readily available to make up lost production, then there is no resource gap. However, if all machines are lost due to a flood, and insufficient undamaged inventory is available to meet customer demand until production is restored, production might be made up by machines at another facility—whether owned or contracted.

Strategies may involve contracting with third parties, entering into partnership or reciprocal agreements or displacing other activities within the company. Staff with in-depth knowledge of business functions and processes are in the best position to determine what will work. Possible alternatives should be explored and presented to management for approval and to decide how much to spend.

Depending upon the size of the company and resources available, there may be many recovery strategies that can be explored.

Utilization of other owned or controlled facilities performing similar work is one option. Operations may be relocated to an alternate site - assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to assume the work of the impacted site. Prioritization of production or service levels, providing additional staff and resources and other action would be needed if capacity at the second site is inadequate.

Telecommuting is a strategy employed when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters have a suitable home work environment and are equipped with or have access to a computer with required applications and data, peripherals, and a secure broadband connection.

In an emergency, space at another facility can be put to use. Cafeterias, conference rooms and training rooms can be converted to office space or to other uses when needed. Equipping converted space with furnishings, equipment, power, connectivity and other resources would be required to meet the needs of workers.

Partnership or reciprocal agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation and allocating expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. Periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.

There are many vendors that support business continuity and information technology recovery strategies. External suppliers can provide a full business environment including office space and live data centers ready to be occupied. Other options include provision of technology equipped office trailers, replacement machinery and other equipment. The availability and cost of these options can be affected when a regional disaster results in competition for these resources.

There are multiple strategies for recovery of manufacturing operations. Many of these strategies include use of existing owned or leased facilities. Manufacturing strategies include:

• Shifting production from one facility to another
• Increasing manufacturing output at operational facilities
• Retooling production from one item to another
• Prioritization of production—by profit margin or customer relationship
• Maintaining higher raw materials or finished goods inventory
• Reallocating existing inventory, repurchase or buyback of inventory
• Limiting orders (e.g., maximum order size or unit quantity)
• Contracting with third parties
• Purchasing business interruption insurance

There are many factors to consider in manufacturing recovery strategies:

• Will a facility be available when needed?
• How much time will it take to shift production from one product to another?
• How much will it cost to shift production from one product to another?
• How much revenue would be lost when displacing other production?
• How much extra time will it take to receive raw materials or ship finished goods to customers? Will the extra time impact customer relationships?
• Are there any regulations that would restrict shifting production?
• What quality issues could arise if production is shifted or outsourced?
• Are there any long-term consequences associated with a strategy?

Resources for Developing Recovery Strategies

• The Telework Coalition (America’s leading nonprofit telework education and advocacy organization)

Manual Workarounds

Telephones are ringing and customer service staff is busy talking with customers and keying orders into the computer system. The electronic order entry system checks available inventory, processes payments and routes orders to the distribution center for fulfillment. Suddenly the order entry system goes down. What should the customer service staff do now? If the staff is equipped with paper order forms, order processing can continue until the electronic system comes back up and no phone orders will be lost.

The order forms and procedures for using them are examples of “manual workarounds.” These workarounds are recovery strategies for use when information technology resources are not available.

Developing Manual Workarounds

Identify the steps in the automated process - creating a diagram of the process can help. Consider the following aspects of information and work flow:

Internal Interfaces (department, person, activity and resource requirements)

• External Interfaces (company, contact person, activity and resource requirements)
• Tasks (in sequential order)
• Manual intervention points

Create data collection forms to capture information and define processes for manual handling of the information collected. Establish control logs to document transactions and track their progress through the manual system.

Manual workarounds require manual labor, so you may need to reassign staff or bring in temporary assistance.

Last Updated: 05/26/2021

Return to top

• To save this word, you'll need to log in. Log In

contingency plan

Definition of contingency plan

Example sentences.

These examples are programmatically compiled from various online sources to illustrate current usage of the word 'contingency plan.' Any opinions expressed in the examples do not represent those of Merriam-Webster or its editors. Send us feedback about these examples.

Dictionary Entries Near contingency plan

contingency method

contingency reserve

Cite this Entry

“Contingency plan.” Merriam-Webster.com Dictionary , Merriam-Webster, https://www.merriam-webster.com/dictionary/contingency%20plan. Accessed 29 Aug. 2023.

Subscribe to America's largest dictionary and get thousands more definitions and advanced search—ad free!

Can you solve 4 words at once?

Word of the day.

See Definitions and Examples »

Get Word of the Day daily email!

In order to continue enjoying our site, we ask that you confirm your identity as a human. Thank you very much for your cooperation.

• Contingency planning
• Operational Planning

It's pretty rare that things work exactly to plan with no hiccups or setbacks along the way so it's good to have a plan in case that happens. Contingency planning is about identifying what might go wrong (e.g. equipment failures, supply shortages, cost increases, software malfunctions etc.) and planning for it.  

It's basically having a plan B (and maybe a plan C) in case things change - the last thing you want is to have your progress derailed by something that was within your control to manage.

Time and cost overruns

In the task planning and resource estimation sections we suggested adding an additional 20% to your time estimates and your equipment/materials estimates. This gives you a little room to move in both time and cost. You can obviously adjust that 20% up or down based on what is appropriate for your plan.

In the best case scenario, everything will be delivered on time and within budget, but it's worth factoring in a worst case scenario(s) so if things take more time or cost a bit extra, you've already planned for it.

Risks are basically anything that could go wrong that could prevent you from achieving your goal. It's important that you are aware of the risks that affect you and have an appropriate method for treating those risks.

• Identify - the first stage is to identify all of the known operational risks. This could be anything from equipment breakdowns, safety issues (stop work orders), supply shortages, hardware or software malfunctions; anything that would stop you and your team from getting the work completed.
• Assess - the risks you have identified then need to be assessed for their likeliness to occur and the severity of impact if they did occur. A risk prioritisation matrix (below) is a very useful tool for this.

• Evaluate (prioritise) - now you need to evaluate the risks and prioritise them by potential impact. The more serious the impact of the risk, the more of a priority it becomes.
• Treat - the last stage is to determine the appropriate treatment for the risk. There are several options for treating a risk as discussed below.

Treating risks

• Retain/accept the risk - if, after controls are put in place, the remaining risk is deemed acceptable to the organisation, the risk can be retained. However, plans should be put in place to manage/fund the consequences of the risk should it occur.
• Reduce the likelihood of the risk occurring – this might include new policies and procedures, training staff, preventative maintenance on machinery, introducing certain contract conditions, testing, quality assurance programs etc.
• Reduce the consequences of the risk occurring - through contingency planning, contract conditions, disaster recovery & business continuity plans, off-site back-up, public relations, emergency procedures and staff training etc.
• Transfer the risk - this involves another party bearing or sharing some part of the risk by the use of contracts, insurance, outsourcing, joint ventures or partnerships etc.
• Avoid the risk - decide not to proceed with the activity likely to generate the risk.

Next: Operational Planning - Additional resources