Business continuity and emergency preparedness procedure checklist

Source anchors

How to use this checklist

Use this checklist to audit whether the service can keep people safe during disruption. It can be used annually, after a test, after a live incident, after premises or IT change, or before an inspection-readiness review.

Continuity arrangements vary by service model. Check current CQC, commissioner, local authority, public health, cyber, fire safety and sector-specific requirements before relying on local defaults.

For each row, record:

Met: evidence is current and complete.
Part met: evidence exists but has a gap or needs follow-up.
Not met: evidence is absent or the control is not working.
Not applicable: the service does not carry out this activity.

Every Part met or Not met item should create an action with an owner and due date.

The PDF is designed for printing, or for completing on screen with a PDF viewer's Fill & Sign, Markup or comment tools. Use those tools to tick boxes and type into the lines.

Service details

Field	Local entry
Service name
Location
Date completed
Completed by
Registered Manager
Incident lead
Deputy incident lead
Period reviewed

1. Plan ownership and essential functions

Check	Evidence to review	Status	Action owner	Due date
Business continuity plan is current and owned by a named lead.	Plan, review record.
Essential functions are identified and prioritised.	Essential-function map.
Deputies and out-of-hours leadership arrangements are clear.	On-call rota, escalation chart.
Contact lists are current and accessible if IT is unavailable.	Contact list, paper fallback.
Continuity risks are linked to the risk register.	Risk register, governance minutes.
Plan is accessible to senior staff during disruption.	Staff interview, plan location check.

2. Incident activation and escalation

Check	Evidence to review	Status	Action owner	Due date
Activation triggers are defined for staffing, premises, IT, medicines, infection and other disruption.	Procedure, plan.
Incident lead knows how to open an action log.	Action log template, staff interview.
Emergency services and provider escalation routes are clear.	Escalation chart, contact list.
Commissioner, local authority or public health routes are listed where relevant.	Contact list, contract requirement.
CQC notification decision is considered for significant service disruption.	Notification decision record.
Staff know how to escalate immediate continuity risks.	Induction record, staff interview.

3. Staffing and communication continuity

Check	Evidence to review	Status	Action owner	Due date
Minimum safe staffing and cover options are defined.	Staffing plan, on-call route.
Bank, agency, locum or redeployment arrangements are current where used.	Supplier record, agency assurance.
Non-urgent activity can be postponed or reduced safely where needed.	Prioritisation plan, risk assessment.
People using the service and representatives can be contacted during disruption.	Contact list, communication plan.
Communication templates are factual and proportionate.	Template, incident sample.
Communication decisions are recorded.	Action log, call log.

4. Records, IT and cyber fallback

Check	Evidence to review	Status	Action owner	Due date
Essential records can be accessed if normal IT is unavailable.	Records fallback test.
Paper fallback forms and secure storage are available where relevant.	Forms, storage check.
Temporary records can be reconciled after systems return.	Reconciliation procedure.
Backup and recovery contacts are current.	Supplier contact, backup record.
Cyber incident escalation route is clear.	Cyber procedure, contact route.
Data protection reporting decisions are recorded where personal data may be affected.	Incident record, ICO decision note.

5. Premises, utilities, equipment and medicines

Check	Evidence to review	Status	Action owner	Due date
Fire, flood, heating, water, power and building-failure responses are documented.	Premises plan, maintenance contacts.
Evacuation, relocation or service suspension decision route is clear.	Evacuation plan, relocation record.
Essential equipment and medical-device failure route is documented.	Equipment log, supplier contact.
Medicines, controlled drugs, vaccines or cold-chain fallback is covered where relevant.	Medicines plan, cold-chain procedure.
Vehicle or transport continuity is covered where relevant.	Vehicle plan, supplier record.
Cleaning, infection control and waste arrangements are included where disruption affects premises.	IPC plan, contractor contact.

6. Testing, recovery and governance

Check	Evidence to review	Status	Action owner	Due date
Continuity plan is tested at a stated cadence.	Test schedule, drill record.
Tests include realistic scenarios for the service model.	Tabletop exercise, scenario log.
Recovery steps confirm records, medicines, premises, staffing and delayed tasks are safe.	Recovery checklist, stand-down note.
Debriefs happen after tests and live incidents.	Debrief record.
Actions from tests and incidents have owners, due dates and evidence.	Improvement actions.
Registered Manager reviews overdue continuity actions.	Governance minutes, dashboard.

7. Summary judgement

Question	Answer
Which disruption would most quickly affect safe care or treatment?
Which essential function has the weakest fallback?
Which contact list, supplier route or escalation route is most likely to fail?
Which continuity action or test is overdue?
What would a CQC inspector see if they asked for continuity evidence today?

8. Action log

Action	Source check	Owner	Due date	Completion evidence

9. Completion

Sign-off	Name	Date
Completed by
Reviewed by Registered Manager

This checklist is a working tool. It does not replace emergency services advice, live regulator guidance, public health advice, cyber advice, fire safety advice, legal advice, commissioner requirements or local emergency plans.