Flood Risk Assessment for Business Continuity

A flood risk assessment for business continuity is an independent, site-specific study of the flood risk to a business's existing premises — a single location or a whole portfolio — written to feed your business continuity plan. It is a form of commercial flood risk assessment, but its purpose is neither planning consent nor an insurance quote. It exists to keep a trading business running when water arrives, by turning a vague worry about flooding into a defined scenario you can plan around: where the water would come from, how likely it is, how deep it would get, and how long you would be out of action.

Unda has delivered more than 5,000 flood risk assessments since 2014 and is a CIWEM chartered flood risk consultancy. We are independent of insurers, developers and product suppliers, so the findings reflect your property and your operations rather than anyone's sales pitch, and every report is signed off by a senior flood risk consultant. The focus here is your existing site and the business that runs from it, not a proposed development.

Flood Re, the government-backed scheme that helps homeowners, does not cover commercial property — so for most businesses, resilience is the part of flood risk you can actually control.

What is a flood risk assessment for business continuity?

A flood risk assessment for business continuity is a bespoke assessment of the flood risk to an existing, occupied business site. It covers every relevant source of flooding, the depth and likelihood of an event, and how long the site would be unusable, presented so the findings can feed straight into your business continuity and continuity-of-operations planning. It goes well beyond the map-based flood search bought during a property transaction, combining published flood data with a site visit and professional interpretation.

It is not a planning document. A flood risk assessment for planning is written to satisfy the National Planning Policy Framework and the local authority when you are developing land. It is not an insurance report either, and it is not a transactional due-diligence review. A continuity assessment answers a different question: given this business, operating from this site or these sites as they stand today, how exposed are we, how long could a flood stop us trading, and what should we do about it? The audience is the people who run the business — owners, and operations, facilities and risk managers — not a planning officer or an underwriter.

Because it is built around your operations, the assessment picks up things a national dataset never will: a low loading-bay threshold, a yard that falls towards the building, a substation or server room at ground level, an access road that floods long before the site does, or a back-up site that shares a floodplain with your main one. These are the details that decide whether a flood is an inconvenience or a shutdown.

Business continuity, continuity plans and where flood risk fits

Business continuity is the capacity of an organisation to keep delivering its most important products and services through a disruption, at an acceptable level, and to recover the rest in good time. A business continuity plan (BCP) is the document that sets out how you will do that: who does what, which activities come back first, and how you keep going in the meantime. The international standard for this discipline, ISO 22301, builds a plan on two pieces of analysis — a business impact analysis and a risk assessment — and a flood risk assessment is the evidence base for the flood strand of both.

Flooding is one of the disruptions a plan has to reckon with, and increasingly a leading one. The Business Continuity Institute's 2025 Horizon Scan found extreme weather to be the single largest cause of business disruption over the previous twelve months. But "flooding" as a bare word is not something a plan can act on. The job of the assessment is to convert it into a defined, quantified scenario:

• The source and mechanism. River, surface water, tidal, groundwater, sewer or a defence being overtopped — often more than one at once.
• The likelihood. The annual chance of an event, expressed as a return period, and how climate change shifts it over the life of the site. Our guide to flood return periods and annual probability explains the terms.
• The depth and hazard. How deep water would get, how fast it would move, and whether the site could keep operating at all during an event.
• The warning lead time. How much notice the Environment Agency's service would give you to deploy barriers, move stock and get people to safety.
• The recovery time. How long the site would be out of use — the figure that decides whether your plan holds.

That last point is where a flood risk assessment meets a business continuity plan most directly. A business impact analysis sets how long you can tolerate losing an activity before the damage becomes unacceptable — your maximum tolerable period of disruption — and the target time to get it back, your recovery time objective. The assessment tells you how long a realistic flood would actually keep the site down. Line the two up and the gap is obvious: if the likely outage is longer than the business can bear, you need a strategy, whether that is property flood resilience, an alternative site, or protecting the plant, stock and data that take longest to replace. A flooded commercial property can take many months to dry, strip out and reinstate — the Association of British Insurers notes that a badly flooded building can take up to a year to become usable again — so the outage is rarely as short as owners hope.

Planning, insurance, due diligence or continuity: which flood assessment?

Several kinds of flood risk assessment exist, and they are not interchangeable. Each answers a different question and is written for a different reader. The table below shows where a business continuity assessment sits; the section after it points you to the right report if your need is really one of the others.

A business continuity assessment is a voluntary, operational exercise. There is no planning application, so the Sequential Test, the Exception Test and the statutory validation requirements do not apply. What drives it is resilience, insurance, lender and board expectations, and a duty of care to staff — not a legal duty to submit a report. A good voluntary assessment still applies the Environment Agency's climate change allowances and follows the same technical standards we use on planning work.

Is this the right type of flood risk assessment for you?

Flood risk work covers a lot of ground, and people often land on the wrong service. Use this to find the report that matches your situation, even if it turns out not to be this one:

• Applying for planning permission? You need a flood risk assessment for planning, or in Wales a flood consequence assessment.
• An insurer has raised flood risk? A flood risk assessment for insurance gives underwriters the independent, property-level evidence they ask for.
• Buying or investing in a property? A due diligence flood risk assessment folds flood exposure into the transaction.
• Buying a home flagged for flood risk? The flood risk survey for homebuyers is built around the purchase decision.
• Site failing the Sequential Test? Our Sequential and Exception Test reports address that planning hurdle.
• Groundwater the main concern? A specialist groundwater flood risk assessment brings in hydrogeological expertise.
• Need modelled flood levels? Where the maps are too coarse, flood modelling produces site-specific levels, depths and extents.
• Chasing a BREEAM credit? A BREEAM flood risk assessment is scoped for the certification.

Not sure which you need? Tell us about the business and the sites, and we will point you to the right assessment before you spend anything.

When a business continuity flood risk assessment makes sense

This kind of assessment earns its place when a business has a site with a history, a nagging exposure, or operations worth protecting. It is often the right call when:

• Your insurer or broker has asked for it. A risk report may recommend a flood risk assessment, or ask you to set out the impact of a flood and a scenario-based response plan. We regularly prepare exactly that evidence.
• The site has flooded before, or come close. You want to understand why, how likely it is to recur, and what would reduce the impact next time.
• You operate in a higher-risk location. A site in Flood Zone 2 or 3, or one exposed to surface water, can keep trading — but only with the right resilience and response measures in place.
• You are reviewing a portfolio. Several sites carry flood exposure and you want a consistent, comparable picture across all of them.
• Critical functions sit on the ground floor. Plant, stock, servers, records or a back-up site whose loss would stop the wider business.
• You are relocating or expanding. You want to understand the flood risk at prospective new premises before you commit.
• Resilience is a board, contract or ESG requirement. Customers increasingly expect suppliers to hold a credible continuity plan, and flooding is a threat that plan has to address.

One site or a whole portfolio

Businesses of every size need this work, from a single unit to a spread of premises across the country. Where a portfolio is involved, the assessment can evaluate each site in turn and set the results side by side, so exposure can be compared, prioritised and built into a single continuity strategy. Relocation and expansion fit here too: we can screen prospective new premises for flood risk before a lease is signed, so a critical function is not quietly moved onto a floodplain.

Multi-site operations carry a risk that single-site thinking misses. A continuity plan usually assumes that if the main site is lost, a back-up site, a second branch or a data centre carries the load. That assumption only holds if the two sites fail independently. If a primary site and its designated back-up sit in the same river catchment, floodplain or coastal stretch, a single flood event can take out both at the same time — the losses are correlated, not independent, and the back-up is a hidden single point of failure.

The question that matters for a portfolio is not just each site's flood risk in isolation, but the joint probability that more than one site floods in the same event.

The same logic extends to the connections between sites. Even where two premises would not flood together, flooding of the roads or rail between them can stop staff, stock and equipment moving — which defeats a plan that depends on people relocating to keep the business running. Data centres and back-up server rooms deserve particular attention: not only is the data and hardware at risk, but a flood in the surrounding area can prevent the very staff needed to fail systems over from reaching either site. We assess these dependencies explicitly, so your continuity arrangements are tested against the way a real flood would behave rather than an idealised one.

What we assess

Every assessment is tailored to the site, the property type and the operation that runs from it. A site visit is usually undertaken, because reading how water arrives, gathers and drains away on the ground is often what separates a real assessment from a desk study. The work draws together a desk study, a property survey and a technical analysis.

The desk study reviews every source of flooding that could reach the site — surface water, river, tidal, groundwater, sewer and reservoir or infrastructure failure — using Environment Agency mapping and detailed modelled flood data, the national surface water and river datasets, LiDAR terrain data, the local Strategic Flood Risk Assessment, historic flood records and any Section 19 flood investigation reports for the area. Surface water is now the largest single source of flood risk in England, and it is exactly the mechanism the river-based flood zones leave out, so it gets particular attention.

The property survey looks closely at the building and the yard:

• Finished floor levels and thresholds at doors, loading bays and shutters, relative to the surrounding ground and to likely flood levels.
• Entry points and weak spots — airbricks, cable and service penetrations, low windows, basements and below-ground voids.
• Critical assets and utilities — electrical intake and switchgear, comms, plant, servers, stock and records, and where they sit relative to flood risk.
• Site access and egress — the routes staff, customers and deliveries use, and how they might be cut off during an event.
• Existing defences and drainage — any barriers, pumps or protection already in place, and their apparent condition and standard.

The technical analysis then compares modelled flood levels against the surveyed floor and threshold levels to derive the likely depth, and where the data allows the velocity and hazard, at your building for a range of events. A flood modelling stage can be added where the national data is too coarse to give a defensible depth. Climate change is built in, so the picture reflects how the risk grows over the life of the asset rather than just today. Where a topographical survey is needed to pin levels down precisely, we can arrange one.

From flood hazard to business impact

Establishing the hazard is only half the work. The value for continuity planning comes from translating depth, likelihood and recovery time into operational consequence — the step that makes this a business continuity assessment rather than a technical report that sits in a drawer. We set the flood scenario against the things that keep the business running:

• Downtime against tolerance. How long the site would realistically be unusable, compared with how long the business can afford to be without it.
• Access and egress. Whether people and vehicles could reach the site, and reach it safely, during and after an event.
• Utilities. Loss of power, comms or water, which can halt operations even when the building itself stays dry.
• Critical assets. The plant, stock, records and IT whose loss would stop the wider business, and how quickly each could be recovered.
• People and supply chain. Staff safety and availability, and knock-on disruption to the suppliers and customers you depend on.

The point is not physical damage alone. In the winter 2015–16 floods, damage to business premises reached an estimated £513 million and outstripped the £350 million of damage to homes, even though businesses were a minority of the properties flooded — a reminder that for a trading operation the losses run well beyond the fabric of the building.

What you receive: the report and a flood response plan

The finished assessment brings the site inspection and the technical analysis together into one clear report, written to be understood and acted on. It is prepared so it can also be shown to an insurer or a future purchaser as a high-level statement of the flood risk to the site. A typical report sets out:

• The primary source of flood risk to the site, and the other mechanisms in play.
• How a flood would interact with the site — likely flow routes, where water would collect, and the depths and levels the data supports.
• The areas of greatest vulnerability, from low thresholds and exposed openings to ground-floor plant and access roads.
• The operational impact — likely downtime, access and utility risks, and the consequences for critical functions.
• Prioritised resistance and resilience measures, proportionate to the risk found, to reduce both the chance of water entering and the damage if it does.

Where it is needed, the assessment can also include a flood response and evacuation plan for the people who use the building — the operational layer that turns the findings into action on the day. It sets out the trigger levels tied to the Environment Agency's flood warning service, the lead time available to deploy any defences and move stock and plant, the roles and responsibilities during an event, and safe arrangements for access and evacuation. Where the safety of access during a flood is in question, we can advise on depth thresholds for people and vehicles and on local water-level monitoring, so the decision to stay, deploy or evacuate rests on evidence rather than guesswork.

Resistance, resilience and staying operational

There is a real difference between keeping water out and coping well when it gets in, and a good assessment helps you invest in the right balance. Resistance measures reduce or stop water entering — flood barriers and gates across doorways and loading bays, flood doors, airbrick covers, non-return valves on drainage and low perimeter bunding. Resilience, or recoverability, measures limit the damage and speed recovery once water is in — raised sockets and plant, water-resistant materials, moving servers, stock and records above flood level, and sump-and-pump systems. Both sit under the umbrella of property flood resilience, and our article on property flood resilience in the UK sets out the measures in more detail.

Measures should be specified against the assessed hazard, not fitted blind. The industry benchmark, the CIRIA Code of Practice for Property Flood Resilience, makes a flood hazard assessment and a property survey the first two steps, before any design or installation, because a barrier or door has a maximum safe depth and the right choice depends on how deep the water would actually get. Assessing first is what stops a business either under-protecting a site or paying for the wrong measures. If the worst has already happened, our guide to cleaning up after a flood is a useful companion to a formal assessment.

What a business continuity flood risk assessment costs

There is no flat fee, because no two businesses present the same risk. The cost reflects the work the sites actually need rather than a fixed price list. The main drivers are:

• The number and type of sites — a single unit is simpler than a multi-site portfolio, and a large industrial or commercial building more involved than a small one.
• The sources of flooding in play — a site facing river, surface water and groundwater risk together needs more analysis than one with a single source.
• The depth of technical work — whether a topographical survey or bespoke flood modelling is needed to derive site-specific levels. Where modelling is required, we scope it as a separate, clearly-costed stage once the first phase is complete.
• Whether a site visit is required, and how far the sites are from us.
• The history of each site, and how much archive, modelling and Section 19 material has to be gathered and interpreted.

Every quote is free, tailored to the sites and sent within 60 minutes on a working day, so you know the scope and the cost before anything begins.

Insurance, Flood Re and the commercial gap

Insurability is central to business continuity, and this is where commercial property is exposed. Flood Re, the government-backed reinsurance scheme that improves the availability and affordability of home flood cover, does not extend to commercial property or most business premises, and it is due to end in 2039. Businesses in flood-risk areas therefore buy cover on the open market, where premiums and excesses can be high, and where cover is sometimes restricted or declined. Record flood insurance claims in recent years have only sharpened underwriters' appetite for detail.

A property-level assessment gives an insurer or broker site-specific evidence — the real flood mechanism, depths, defences and the measures in place — that can be used to challenge a generic postcode loading, support the case where cover has been declined, and inform decisions on excesses. It cannot guarantee cover or a particular price, which every insurer sets by its own criteria, but it moves the conversation onto the building rather than the map. Where insurance is the immediate concern, our flood risk assessment for insurance is written for that purpose and dovetails with continuity work.

Why the risk is rising, and why it is worth understanding

Flood risk to business is growing. The Environment Agency's 2024 national assessment puts around 6.3 million properties in England in areas at risk of flooding from rivers, the sea or surface water, about 4.6 million of them from surface water alone, and expects the total to approach 8 million — roughly one in four properties — by mid-century as the climate changes. The government's own indicator data records hundreds of thousands of non-residential properties among them. You can read the detail in our guide to understanding flood risk with NaFRA2, and screen any address quickly with our free flood risk map or keep an eye on conditions with the live river levels map.

Unda works on sites across England and Wales. Wherever your premises sit, you can explore local flood context through our area guides, our river flood risk pages and our local authority guides. You can read more about the team and our track record on our about page.

Why businesses choose Unda

• Chartered and independent. A CIWEM chartered consultancy with no commercial tie to insurers, developers or product suppliers, so the findings reflect your business, not a sale.
• Genuine track record. More than 5,000 flood risk assessments since 2014, across residential, commercial and strategic sites, every one signed off by a senior consultant.
• Property-level, not postcode-level. We go to the thresholds, floor levels and flow routes that actually decide whether a site floods and how badly.
• Multi-site and portfolio experience. We assess single sites and whole portfolios, including the joint probability of more than one site flooding at once.
• Local knowledge everywhere. Our area, river and local authority guides mean we understand how your specific location and watercourse behave.
• Responsive. A named consultant, a quote within 60 minutes, and support that continues after the report is delivered.

Frequently asked questions

Protect the business you run today

A business continuity flood risk assessment turns uncertainty about flooding into a clear, site-specific picture you can act on — whether you are safeguarding a single premises, reviewing a portfolio, or checking a site before you move in. If flooding has affected your business, or you simply want to understand and reduce your exposure, we can help.