Beyond fire drills
Emergency preparedness and business continuity for Canadian manufacturers
By Kelly Killby
On a smoky Tuesday last June, intake shutters snapped shut at a mid-sized metal shop on the Prairies. The air was safe inside—but the line wasn’t. With compressors idled and a truck due by 3 o’clock, the plant manager faced a choice: ship late and lose a customer or restart without a plan and risk quality—and safety.
That moment is why emergency preparedness and business continuity matter. The question isn’t if an emergency will strike, but when.
The new risk reality
Wildfire smoke that forces air-intake shutdowns. Ransomware that encrypts recipes and orders. Floods, hail, and wind events that knock out power and logistics. A public-health event that keeps half your team at home.
Canada’s manufacturers are feeling the strain:
• Severe weather: Insured damages in 2024 reached $8.5 billion, the costliest year on record; four catastrophic events (Jasper wildfire, Calgary hail, Southern Ontario flooding, remnants of Hurricane Debby) drove more than $7 billion of losses—translating on the shop floor to damaged facilities, prolonged outages, and costly downtime
• Pandemics: Public Health Agency of Canada modelling suggests 4.5–10.6 million Canadians could be clinically ill during an influenza pandemic, with absenteeism that will cripple production without cross-training or contingency labour plans
• Cybersecurity: The Canadian Centre for Cyber Security sent 336 pre-ransomware notifications to organizations in 2024–25; if ICS/OT is affected, production stops.
• Supply chains: In early 2025, 20.6 per cent of manufacturers expected supply-chain obstacles in the next quarter, a risk that cascades into missed windows and stressed customer relationships
The COVID-19 pandemic laid this bare. In 2020, 85 percent of manufacturing establishments reported operational impacts; total sector revenue fell $69.8 billion (a 9.3 per cent decrease from 2019). Plants with continuity measures—alternate suppliers, cross-trained teams, flexible schedules, and clear remote-comms protocols—bounced back faster.
Preparedness vs continuity (and why you need both)
Most plants keep people safe with emergency preparedness: alarms, evacuation routes, first aid, and safe shutdowns. That’s the first hour covered, but what about the hours and days that follow?
Business continuity is everything after how you keep critical functions operating—or bring them back quickly—so customers stay with you and quality stays intact.
Think of preparedness as the seatbelt. Continuity is the airbag, the spare tire, and the roadside assistance plan.
Bridge the two by answering four questions:
• How will we communicate with employees, regulators, and customers during a prolonged outage?
• Which lines or production units must resume first to meet critical orders?
• How long can your information technology or operational technology be down before quality or compliance is at risk (your Recovery Time Objective (RTO) and Recovery Point Objective (RPO)? RTO and RPO are two essential metrics for developing data backup and recovery, business continuity and disaster recovery, and operational resilience plans. RTO focuses on the maximum acceptable downtime for a system or business process, while RPO designates the maximum amount of data that can be lost during an outage.
• Which suppliers, carriers, and service partners are verified backups if primary channels fail?
“We’re an SME. Do we really need this?”
Yes, and perhaps even more than the larger companies. SMEs often have thinner margins, a single facility, one key supplier, or one machine that they can’t afford to fail. A right-sized plan reduces downtime, proves reliability to customers, and strengthens your hand in contract talks.
Build your business continuity-ready plan in six steps
WEEKS 1-2: Assess hazards, potential disruptions and business impact
List credible hazards by site (e.g., facility incidents, hazardous materials, utility loss, natural events, cyber). Pair this with a Business Impact Analysis to identify critical functions (e.g., QA, shipping, production, core line), their potential impact on company financials, production lines, production sites, technology systems, and data and rank consequences over time (safety, regulatory, financial, customer, brand).
As a priority, establish a team and Business Continuity Coordinator. The team will work through all these tasks. Typically, this is leadership team with representatives from other areas of the organization.
The business continuity plan should also include an emergency communication plan.
WEEK 2: Prioritize critical functions and set recovery targets
For each critical function, set:
• RTO (Recovery Time Objective): maximum tolerable downtime
• RPO (Recovery Point Objective): acceptable data loss
• MASL (Minimum Acceptable Service Level): throughput in “limp mode”
Capture these in a one-page matrix; it will be your blueprint for decisions under pressure.
WEEKS 2-4: Minimize the impact
Map dependencies and pre-position backups:
• Suppliers & logistics: pre-approve alternates; note lead times and minimum order quantities (MOQ)
• People: cross-train at least one backup for every critical role; create job aids
• Equipment: pre-arrange rentals/spares; list emergency service contacts
• Utilities/IT/OT: generators and uninterruptable power supplies (UPS), offline copies of recipes, tested backups, MFA and network segmentation. Inventory of hardware, software applications and data and backup sites, technology personnel, workflow and
recovery priorities.
WEEKS 3-5: Write succinct scenario plans
For your top three to five risks, draft a plan that details the specific steps to be taken before, during and after an event to maintain operations, including procedures for personnel, assets, and business partners/stakeholders. These plans should cover triggers, immediate safety actions, communication tree (with backup channels), shutdown/restart steps, quality checks, and role assignments (primary + alternate). Employee compensation and sick-leave, flexible policies regarding remote work, spread of infectious disease at the workplace, and restricting travel should be included. Remember to document procedure and authorities/responsibility for activating and terminating the plan, for alternating business operations and for transferring business knowledge to key employees.
WEEK 5 and onward: Train & exercise
• Tabletop (quarterly): discussion-based activity where the team walks through a simulated crisis to test and improve their BCP without a full scale drill. Leadership walks a scenario, record decisions and gaps.
• Live drill (semi-annual): e.g., a power-loss drill during peak shipping or an OT isolation exercise during a rush order. Document and identify what went well and what gaps may exist.
• Debrief: fix what you find; update plans and training.
Ongoing: Sustain it
Assign a Business Continuity Coordinator and a back up person. Review after process or staffing changes and at least annually. Keep printed and digital copies accessible (plan for network/power loss). Track a few simple KPIs (see below as an example).
On the floor: the first 15 minutes
• 0–2 min — Safety: hit emergency stops/safe shutdowns; account for your people
• 2–5 min — Activate: name the Incident Commander; switch to backup communications if needed
• 5–10 min — Stabilize: isolate affected equipment/areas; secure utilities; protect work in progress (WIP)
• 10–15 min — Communicate: brief internal teams, regulators (as required), and key customers with status and the time of the next update. Document all actions. Should have a platform for communicating emergency status and actions to employees, vendors, suppliers, and customers inside and outside the workplace in a consistent and timely manner.
Say it clearly (templates you can adapt)
Employees (SMS/Email): Incident at [Site]. Everyone is safe. We’ve paused [Line/Area] and activated our business continuity plan. Next update at [HH:MM]. If off shift, await scheduling instructions.
Customers: We’ve experienced [event]. Safety protocols are complete; recovery actions are underway. Orders [#] currently project for [date/time]. We will confirm at [next update time]. For escalations: [name/phone].
Regulators/Authorities: Notification of [event] at [facility]. Safety measures executed at [time]. No injuries [or specify]. We are securing [materials/area] and will provide an update by [time]. Contact [name/title], [contact].
Community / Neighbours: Notification of [event] at [facility]. All safety controls are in place and there is no risk to the public. You may notice [visible effects, e.g., increased traffic, emergency vehicles, noise, odour, etc.]. We are working closely with [local authorities/emergency services] to manage the situation and will share updates by [time] through [communication channel—e.g., website, local alert system, or media]. For questions or concerns, contact [name/title], [phone/email].
A 30–60–90-day starter plan
Days 1–30: Establish a team and name a coordinator; Assess hazards, potential business disruptions and potential impact. Prioritize critical functions, minimize the impact, set targets and draft an emergency communication plan. Perform a light business impact analysis (BIA) on your five most critical functions; set RTO/RPO/MASL; draft a comms tree with off-network backups.
Days 31–60: map dependencies; identify alternates (suppliers, carriers, equipment, IT/OT); write succinct plans; communicate and train internal staff.
Days 61–90: run one tabletop and one short live drill; close gaps; stage spares/backup power; brief key customers on your continuity posture to build trust.
What good looks like: simple KPIs
• Time to account for personnel: 15 minutes.
• Mean time to restart priority line versus its RTO.
• Coverage: 90 per cent of critical roles have a trained backup.
• Alternates: Two qualified suppliers for every A-class fire material.
• Discipline: Tabletop quarterly; live drill once a year; corrective actions identified closed.
Common pitfalls (and how to avoid them)
• Plans that read like doorstops – keep plans short; put policy in the appendix.
• IT-only thinking – include OT and utilities; practice network isolation without compromising safety.
• Single-champion risk – build a cross-functional team; assign alternates.
• No paper – assume a network outage; keep hard copies where people work.
The payoff: less chaos, faster recovery
Emergencies will keep coming—wildfire, flood, cyber, or the next unknown. With a tested plan, Prairie manufacturers can turn crises into manageable challenges and protect the long-term strength of Canada’s manufacturing sector and the people whose livelihoods depend on it.
Kelly Killby is Health, Safety & Environment Professional with EMC. Kelly is a Certified Sustainability Practitioner and an ISO Management System Lead Auditor. She has been a guest speaker at ISO’s Next Generation Climate Change Project, as well as a guest lecturer for Western University’s Masters of Environment & Sustainability program. Prior to joining EMC, she worked in the automotive and handheld electronics sector for more than 20 years.