Holiday and Peak Season Operations Readiness Checklist: A 14-Day Plan Before the Rush

Peak season does not create new problems. It finds the old ones faster. A supplier that is usually a few days late becomes a week late. A support macro that is a little vague becomes a thousand confused customers. A workflow that fails once a week fails every hour. Everything you have been meaning to tidy up gets tested by the busiest days of the year.

The good news is that peak season is predictable. You know roughly when it starts, what kinds of problems it brings and who will be affected. This guide gives you a practical readiness plan: a 14-day version if you are starting late, a full set of steps, a copy-ready checklist with owners and a list of mistakes to avoid.

It is written for operations leads in online retail, services and small businesses, including teams that sell products fulfilled by suppliers. A note on scope: this is an operating guide, not legal advice. Rules on shipping, refunds and consumer protection vary by country and state, so confirm the specifics for your market.

Where peak season breaks things

Area	What goes wrong	What to prepare
Demand	Orders arrive faster than you planned for	A forecast with a base case and a high case
Promises	Delivery dates on the site are too optimistic	Honest shipping times and delay messaging
Suppliers	Lead times stretch and stock runs out	Written lead times, safety stock, a backup source
Systems	A late change breaks checkout, sync or tracking	A change freeze and monitoring
People	Key people are away and nobody covers	Named owners, backups and a coverage rota
Support	Ticket volume doubles and answers are inconsistent	Prepared answers, triage and self-service status
Security	Attackers target thin holiday staffing	On-call contacts, tested backups and strong logins
Money	Payments and approvals stall during time off	Delegated approvals and a holiday payment calendar

The 14-day plan if you are starting late

If you have two weeks, do these first. They give the most protection for the least effort.

Days 1 to 3: Promises and suppliers.

• Review the delivery times shown on your site, in emails and in ads. Replace anything you cannot support.
• Contact your top suppliers, confirm current lead times in writing and ask about cutoff dates.
• Identify the products most likely to run short and decide what to do if they do.

Days 4 to 7: Coverage and freeze.

• Build a coverage rota for the peak weeks with a named backup for each role.
• Announce a change freeze date and list what is allowed during it.
• Write down who can approve what if the usual approver is away.

Days 8 to 11: Support and security.

• Prepare answers for the ten questions you expect most, plus delay and refund messages.
• Check that status information is easy for customers to find.
• Confirm multi-factor authentication on critical accounts, test a backup restore and share an emergency contact list.

Days 12 to 14: Dry run.

• Walk through a bad day: a supplier delay, a payment issue, a system alert and a spike in tickets. Who does what?
• Fix the gaps you find and set the date of your first daily check-in.

If you have more time, the sections below expand each area.

Step 1: Forecast demand and capacity

Start with last year's data: orders per day, support tickets per order, shipping times, returns and any incidents. Then build two cases:

• Base case: what you expect, using last year's pattern adjusted for growth.
• High case: a stronger surge than you expect, which you are prepared to cope with even if it is uncomfortable.

For each case, estimate what you need: stock, packing or fulfillment capacity, support hours, payment processing limits and system load. Write down the first bottleneck in each case. You do not need an advanced model. A spreadsheet with clear assumptions is enough, as long as someone can explain it.

If you sell through suppliers, include their capacity. Your promise to a customer depends on the slowest link in the chain.

Step 2: Make promises you can keep

This is the step with the biggest effect on complaints and chargebacks. In the United States, the FTC's guide to the Mail, Internet, or Telephone Order Merchandise Rule sets out what sellers must do. As described on the FTC's business guidance page, the main points are:

• If you state a shipping time, you must have a reasonable basis to ship within that time.
• If you state no time, you must have a reasonable basis to believe you can ship within 30 days of receiving a properly completed order.
• A reasonable basis is information that would satisfy a reasonable and prudent businessperson acting in good faith. The FTC points to anticipated demand, supply, fulfillment capacity and recordkeeping.
• If you cannot ship on time, you must decide whether you can ship at all. If you can ship later, you must seek the customer's consent to the delay and notify them reasonably quickly. If you cannot ship, you must cancel and refund.
• A delay notice must give a definite revised date, or say that you cannot give one and explain why, and it must tell the customer they can cancel for a full and prompt refund.
• Refunds for cash, check or third-party credit must be made within seven working days after the order is cancelled, and refunds cannot be replaced with store credit.
• The FTC states that the seller bears the burden of proving compliance, so keep records.

The FTC page also notes that civil penalties can apply, and the amounts are adjusted over time. Read the current guide before you rely on this summary, and check local rules in other countries.

What this means in practice:

1. Use realistic dates. If supplier lead time is seven to ten days and carrier time is three to five, do not promise five days in total.
2. Show a range, not a single optimistic date. "Ships in 5 to 8 days" is easier to meet than "ships in 5."
3. Keep your evidence. Save supplier lead-time confirmations and the forecast you used when you set the promise.
4. Prepare the delay notice before you need it. Draft it, review it with whoever handles compliance, and store it where support can use it.

Dropshipping and marketplace sellers are not exempt. If the customer ordered from you, the promise is yours, even when someone else ships the item.

Step 3: Confirm suppliers and inventory

• Get lead times in writing. An email confirming current production and shipping times is better than an assumption.
• Ask about cutoff dates. Many suppliers have a last date for orders to arrive before a holiday.
• Set safety stock for your top items. Use last year's sell-through to pick a level and write down how you chose it.
• Name a backup. For key products, identify an alternative supplier or a substitute you can offer.
• Check onboarding paperwork. If you plan to add a supplier fast, follow your vendor onboarding procedure so urgency does not become a fraud risk.
• Count stock. A quick count of fast movers before the surge prevents overselling. The SOP examples guide includes an inventory count procedure you can adapt.

Step 4: Freeze risky changes and watch your systems

Late changes cause late incidents. Agree a freeze date after which only essential changes go live, and write down what counts as essential.

Platform guidance often follows the same pattern. For example, Salesforce's holiday readiness guide for its commerce platform describes a month-by-month plan, with load planning in the summer and a code freeze at the start of November in the US. Your platform and date may differ, but the idea is the same: finish risky work early.

During the freeze:

• Allow urgent fixes, but require a second person to review and a note in the log. The change management checklist covers the pre-flight and post-deploy checks.
• Review alerts so that the ones that matter reach a person quickly. See monitoring and alerting for automations and the alert review cadence.
• Check integrations that move orders, inventory and tracking. Silent failures are the most expensive kind. The guide on webhook failures lists the common causes.
• Check usage limits on your tools. If you use an automation platform that bills by usage, a surge can hit your plan limit and hold new runs until the next billing cycle.

Step 5: Plan people and coverage

Most peak season failures are coverage failures: the one person who knew the process was away.

• List critical roles and name an owner and a backup for each.
• Build a rota for evenings, weekends and holidays, with clear escalation contacts.
• Write quick-reference cards for tasks seasonal or backup staff will do, such as refund approvals, order changes and escalation. Short SOPs beat long manuals. See how to write an SOP people follow.
• Agree handoffs. At the end of every shift, record open issues in a shared place.
• Set out-of-office rules. People who are away should name a backup and say when they will be back.

Step 6: Prepare customer support

Support volume rises with orders, and delays raise it further. Prepare before the surge.

1. Draft answers for your top questions: order status, shipping times, delays, returns, damaged items and payment problems.
2. Make status easy to find. Tracking links and a clear order status page reduce tickets more than any macro.
3. Prepare delay messaging that follows the rules above: a clear revised date or an honest explanation, and the option to cancel for a refund.
4. Triage first. Urgent and high-value issues should be seen quickly. AI ticket triage can help sort and route tickets, but keep a person in charge of replies involving money, safety or complaints.
5. Set response targets you can meet, and tell customers what to expect.

Step 7: Tighten security for holidays and weekends

Attackers know when teams are thin. The FBI and CISA's advisory on ransomware awareness for holidays and weekends says criminals may view holidays and weekends, especially holiday weekends, as attractive timeframes, because network defenders and IT support are at limited capacity. The advisory is from 2021, but its recommendations remain sensible. Among them:

• Identify IT or security staff who will be on call, and keep monitoring running.
• Keep offline, encrypted backups, test them regularly and make sure backup schedules account for holiday disruptions.
• Require multi-factor authentication for remote access and accounts that reach critical systems.
• Prioritize patching of internet-facing systems.
• Audit administrator accounts and apply least privilege.
• Keep an incident response plan that covers critical systems being unavailable for a time.

Add two business-process checks:

• Payment and supplier changes. Fraudsters time requests for busy periods. Verify any change to bank details through a separate, known channel, as the FBI's business email compromise guidance advises.
• Incident roles. Make sure the people on call know the plan. Our incident response runbook gives you severity levels, roles and a communication flow you can copy.

Step 8: Plan money and approvals

• Holiday payment calendar. Know when payment runs happen and what the bank cutoffs are around holidays.
• Delegated approvals. If a finance approver is away, who approves and up to what limit? Write it into your approval thresholds.
• Cash buffer. Peak season can tie up cash in stock and refunds. Check your cash forecast against the high case.
• Refund readiness. Make sure refunds can be processed within the time you promise.
• Year-end link. Peak season sits right before year-end. Note which transactions and cutoffs will matter for your year-end close.

Step 9: Run a daily check-in during the peak

A short daily meeting beats a long weekly one. Keep it to fifteen minutes with a fixed agenda:

1. Numbers: orders, backlog, shipping delays, support backlog, refunds, errors.
2. Risks: supplier issues, system alerts, staffing gaps.
3. Decisions: what needs a call today.
4. Owners: who is doing what before the next check-in.

Use a small set of measures that everyone understands. Too many numbers hide the important ones.

Step 10: Hold a post-peak review

When the rush ends, hold a short, blameless review within two weeks. Google's site reliability engineering book describes the value of a blameless postmortem culture in learning from incidents without assigning fault to individuals. Use the same principle for the season:

• What happened compared with the forecast?
• Where did we make promises we could not keep?
• Which processes depended on one person?
• What did customers ask that we did not expect?
• What will we change in our SOPs, supplier terms and staffing next year?

Write the answers into your checklists while memories are fresh.

A copy-ready readiness checklist

Copy this into a spreadsheet or task tool, then set owners and dates.

#	Task	Owner	Due	Evidence
1	Forecast base and high demand cases	Operations lead	2 weeks before	Forecast sheet with assumptions
2	Review delivery promises on site, email and ads	Marketing and ops	2 weeks before	Updated copy
3	Confirm supplier lead times and cutoffs in writing	Procurement	2 weeks before	Saved supplier confirmations
4	Set safety stock for top items	Inventory owner	2 weeks before	Stock levels with rationale
5	Name a backup supplier for key items	Procurement	10 days before	Supplier list
6	Announce change freeze and allowed exceptions	Technical owner	10 days before	Freeze notice
7	Check alerts and integration health	Technical owner	7 days before	Alert review notes
8	Build coverage rota with backups	Operations lead	7 days before	Published rota
9	Write quick-reference cards for backup staff	Process owner	7 days before	Cards in shared folder
10	Draft support answers and delay notices	Support lead	7 days before	Approved macros
11	Confirm MFA, test backup restore, share on-call contacts	Security owner	7 days before	Test record
12	Set delegated approval limits	Finance lead	5 days before	Approval table
13	Dry run of a bad day	Operations lead	3 days before	Notes and fixes
14	Start daily check-ins	Operations lead	Peak start	Agenda and log
15	Post-peak blameless review	Operations lead	Within 2 weeks after	Review notes and updated SOPs

A worked example (illustrative)

Imagine a small online shop that sells through suppliers. Last year it processed roughly twice its normal daily orders in the peak week and had many tickets asking where orders were. This year it writes down a plan: it changes its shipping promise from a single optimistic date to a range, confirms with its three main suppliers that lead times are stable, sets a backup supplier for its two best sellers, freezes site changes ten days before the rush, prepares a delay notice that gives a revised date and a cancel option, and names a backup for each role. The numbers here are invented to show the method. Your own data, suppliers and obligations will differ.

Common mistakes

• Optimistic promises. Short delivery dates win clicks and lose trust.
• No evidence for the promise. If you cannot show why you believed a date was achievable, you are exposed.
• Late changes. A new feature in the busiest week is a gamble.
• One-person processes. If one person is the only one who can do something, plan for them being away.
• Untested backups. A backup you have never restored is a hope.
• Vague delay messages. Customers want a date, an apology and an option.
• Too many metrics. Pick a handful and watch them.
• No review afterwards. The same problems come back next year.

Key takeaways

• Peak season is predictable, so prepare with a forecast, a freeze date and a coverage plan.
• Make delivery promises you have a reasonable basis to keep, and keep records. Prepare delay notices before you need them.
• Confirm supplier lead times in writing and name a backup for key items.
• Freeze risky changes before the rush and watch alerts and integrations.
• Name owners and backups for every role and shift, and write short reference cards for them.
• Tighten security for holidays and weekends, and verify payment detail changes through a separate channel.
• Hold a daily fifteen-minute check-in during the peak and a blameless review afterwards.

Sources and further reading

The pages below are where we checked the rules and guidance mentioned here. Rules and recommendations change, so confirm on the source before you act. Written by Sam at OpsGrit with AI assistance and an automated editorial review. If you spot something wrong, tell us.

• FTC: Business Guide to the Mail, Internet, or Telephone Order Merchandise Rule. Shipping promises, delay notices and refunds for US orders.
• CISA and FBI: Ransomware Awareness for Holidays and Weekends (AA21-243A). Holiday and weekend risk and recommended mitigations. Published in 2021.
• FBI Internet Crime Complaint Center: Business Email Compromise PSA. Verifying changes to payment details.
• Salesforce Trailhead: B2C holiday ready plan. One platform's month-by-month holiday plan, used here as an example of a freeze schedule. It is specific to that product.
• Google SRE book: Postmortem culture. Blameless reviews.

The plan, checklist and example in this guide are OpsGrit's own and are starting points. Adapt them to your products, market and legal obligations.

Related guides

• Incident Response Runbook: A Template for Operations Teams
• Change Management Checklist for Operations Workflows
• Year-End Close Checklist: A 30-Day Plan for Small Businesses and Operations Teams
• AI Ticket Triage: Routing, Prioritization and Safe Draft Replies for Support Operations