Closing the Premises, Not the Business: A Festive Risk Register for UK SMEs

For many UK SMEs, the Christmas closure is treated as a diary entry: last working day, first working day, and a note to switch on the out-of-office. That is a mistake. A short break in trading does not suspend the obligations that keep the business solvent and insurable. Payroll still falls due. VAT does not observe the bank holidays. Customers still expect answers, and insurers still expect premises to be checked. The owner-manager who leaves without a written risk register is not taking a holiday; they are lending the business to chance.

The practical response is not a long policy document. It is a one-page register, completed in the two weeks before closure, that records what must happen, who owns it, and how the business will prove it was done. The aim is operational resilience: a break that is genuinely restful because the foreseeable failures have been assigned and tested.

Start with cash timing, not tinsel

The first column of any shutdown register should be cash. Map every material inflow and outflow across the closure period, including the days when the bank is closed but the obligation is not. December payroll is the obvious item, but it is rarely the only one. Check the PAYE liability due date, any VAT return that falls in late December or early January, rent, finance lease payments, supplier runs and the cut-off times for CHAPS and Faster Payments.

A useful discipline is to list each payment by value and date, then mark whether it can be made automatically, whether it needs dual authorisation, and who holds the second approval. If the only person who can release a payment is on a beach without signal, the register has found a real risk. Where timing is tight, consider paying routine suppliers earlier rather than later, but only after checking the cash conversion cycle and any agreed terms. Early payment is a choice; a missed direct debit is a consequence.

Put payroll and HMRC on the critical path

Payroll is not simply a finance task. It is a reputational one. Confirm the pay date, the bank holiday movement, and the cut-off for submitting the Full Payment Submission. Check that any overtime, bonuses or deductions have been approved before the payroll team closes the period. If a payroll bureau is used, confirm the final instruction date in writing and identify who at the SME can authorise a correction.

The same rigour applies to HMRC. Log in to the business tax account before closure and confirm what is due, when, and how it will be paid. Do not rely on a paper reminder sitting in a tray. If a payment on account or a VAT direct debit is due near a bank holiday, verify the date the money will actually leave the account. Keep evidence of the instruction. If something goes wrong, a timestamped bank instruction is more useful than a recollection.

Test the insurance and premises assumptions

Many commercial policies require the premises to be maintained, inspected or occupied in a particular way. A festive closure can breach an assumption that no one has read since renewal. Before locking up, check the policy wording for unoccupancy conditions, minimum security requirements, heating and water isolation, and any obligation to notify the insurer of extended closure. If the business is closed for longer than the policy allows without notification, a claim for burst pipes or theft may be compromised.

Walk the premises with the register in hand. Record the isolation of water, gas and non-essential power. Confirm that fire detection and intruder alarms are working and that the monitoring contract is live. Photograph the state of the building, including shutters, locks and any temporary repairs. This is not bureaucracy; it is the evidence base for a claim and the baseline for reopening.

Security is an access issue as much as a lock issue

The most common festive failure is not a break-in. It is a keyholder problem. The person who knows how to reset the alarm, find the stopcock or override the shutters may be the same person who is away. The register should name at least two people who can attend the premises, hold current contact details, and understand the alarm and access arrangements. Test the alarm code and the fob before closure. Confirm that any temporary staff or contractors have returned keys and that the access list has been updated.

Do not overlook digital access. If the finance director is the only administrator of the banking platform, or the operations manager is the sole owner of the supplier portal, the business is one forgotten password away from a stalled January. Record who holds administrator rights, where recovery details are stored, and how a backup approver can be reached. Keep that record secure; the point is resilience, not convenience.

Communicate with customers and suppliers before the silence

Customers tolerate a closure if they know about it. They are less tolerant if they discover it when an order fails. Send a short, specific notice to key customers and suppliers setting out the last despatch date, the first day of reopening, the emergency contact route and how urgent matters will be handled. For contractual customers, check whether the shutdown affects service levels or triggers a notification obligation. A generic out-of-office message is not a communication plan.

Where the business depends on a small number of large customers, consider a named contact for the closure period. That person does not need to solve every problem. They need to acknowledge, triage and escalate. The same applies to suppliers: confirm that deliveries are paused, that standing orders are appropriate, and that no goods will arrive at a locked gate.

The one-person dependency

Every SME has a person who knows how to reset the alarm, release a payment, find the insurance certificate or talk a key customer through a problem. The register should identify that person explicitly and ask a blunt question: if they are unavailable for the whole closure, what breaks? The answer becomes the priority for cross-training or documentation in the final week.

A simple risk register can look like this:

Risk	Trigger	Control	Owner	Evidence
Missed payroll	Bank holiday cut-off	Early submission; backup approver	Finance lead	Bank instruction
VAT payment late	Direct debit date	Confirm HMRC date; retain screenshot	Owner	Tax account record
Burst pipe	Unoccupied premises	Isolate water; inspect; notify insurer if required	Operations lead	Photographs and checklist
Alarm cannot be reset	Keyholder away	Second keyholder trained; code tested	Office manager	Test log
Customer order fails	No cover	Named contact and escalation route	Sales lead	Customer notice

Complete the register, circulate it to the people named in it, and hold a fifteen-minute review before closure. The objective is not to eliminate every risk. It is to ensure that the business can be reopened by someone who was not in the room when the decisions were made. A festive break should end with a rested team and a working business, not a January spent reconstructing what happened in December.