A construction business plan explains what work you will do, for whom, how you will win it, who will run it, and how the numbers work. The financial section matters most: revenue built from crew capacity and realistic margins, overhead, cash flow, and what you need from a bank or surety.
Plan reviews connect field conditions, drawings, and the next decisions on a job. AI-generated illustration.
To write a construction business plan, follow the standard sections the U.S. Small Business Administration lists for a traditional plan (executive summary, company description, market analysis, organization and management, services, marketing and sales, funding request, and financial projections) and fill each one with construction specifics: your trade and job types, licensing and bonding, the customers who hire you, crew capacity, typical job size, gross margin, overhead, and cash flow timing. Build the revenue forecast from the bottom up, from crews and jobs, not from a growth percentage. That one choice is what separates a plan a banker believes from one they skim.
Traditional plan or one-page plan?
The SBA describes two formats. A traditional plan is detailed and is what lenders and investors usually expect. A lean plan fits on about one page and covers key partnerships, activities, resources, value proposition, customer relationships, customer segments, channels, cost structure, and revenue streams. The SBA notes that some lenders and investors may still ask for more detail.
Use the one-page version to think and to align partners. Write the full version when you need a construction loan or line of credit, a U.S. Small Business Administration-backed loan, more bond capacity, or a partner's money.
How to write each section for a construction company
1. Executive summary
Write it last. In half a page: what you build, where, for whom, revenue now and target, the team, and what you are asking for. A reader should know in one minute whether you are a residential remodeler, a commercial concrete sub, or a public works GC.
2. Company description
Legal structure, location, years in business, license types and numbers, bonding status, insurance, and the specific work you self-perform versus subcontract. Name the job types and sizes: "tenant improvements from $150,000 to $1.5M" says far more than "commercial construction." Licensing rules vary by state, so point to the requirements that apply to you; see contractor license requirements by state.
3. Market analysis
Who buys your work: homeowners, developers, general contractors, property managers, school districts? What is driving demand in your area, and who else competes for it? List three to five real competitors and where you beat them (speed, a specialty, a service area, a delivery method). Keep any market figures tied to a source you can show.
4. Organization and management
An org chart and short bios. Lenders and sureties care who runs estimating, who manages jobs, and who handles the money. If the owner holds all three, say how that changes as you grow. The guide on how to build a construction company org chart helps here.
5. Services
Your scopes, delivery methods (hard bid, negotiated, design-build, service work), warranty approach, and any certifications or set-aside status for public work.
6. Marketing and sales
How work actually arrives: bid lists, repeat clients, referrals, plan rooms, public bid boards, your website. Include a bid volume target and your expected hit ratio. If you win one bid in five, a $3M revenue goal needs roughly $15M of bids. The guide on how to calculate a bid hit ratio shows the math.
7. Funding request
The SBA guidance says to state how much funding you need over the next five years, what it will be used for, and the type and terms you want. For contractors that is usually trucks and equipment, working capital to carry payroll until pay apps clear, and retainage that will sit unpaid for months.
8. Financial projections
Include past statements if you have them and a five-year forecast, per the U.S. Small Business Administration outline. For a contractor, the forecast should show revenue by job type, gross margin, overhead, net profit, a monthly cash flow for year one, and a balance sheet that shows working capital. Sureties look hard at working capital and how you recognize revenue, so be ready to explain your method; see percentage of completion vs completed contract accounting.
Worked example: building revenue from crews
Say a two-crew residential roofing company wants to add a third crew next year. The numbers below are an illustration of method, not industry benchmarks.
Example bottom-up revenue and break-even check (illustrative)
Line
Year 1 plan
Crews
3
Jobs per crew per week, average
2
Working weeks per year after weather and holidays
44
Total jobs
264
Average job value
$14,000
Revenue
$3,696,000
Gross margin on finished jobs
30%
Gross profit
$1,108,800
Overhead (office, sales, owner salary, insurance, trucks not charged to jobs)
$820,000
Operating profit before tax
$288,800
Now stress it. If weather costs four more weeks and margin slips to 27 percent, revenue drops to $3,360,000 and gross profit to $907,200, leaving about $87,200. The plan should say what you would do in that case (delay a hire, push service work in winter). Break-even revenue at a 30 percent margin is $820,000 divided by 0.30, or about $2,733,000. Showing that you know your floor is the most convincing line in the whole plan. More on the formula in how to calculate break-even for a contracting business.
What a banker or surety reads first
Most readers skip straight to three things. First, the gap between what you plan to bill and the working capital you have to carry it, because a contractor who doubles volume usually needs far more cash on hand before the first pay app clears. Second, your track record on finished jobs: did projects close at the margin they were bid at, or did they fade? Third, who besides the owner can estimate, run a job, and close the books. If the plan answers those three questions clearly, with numbers that tie to your financial statements and WIP report, the rest of the document gets a fair reading. If it does not, polish elsewhere will not save it.
Mistakes to avoid
Top-down revenue. "We will grow 40 percent" without crews, jobs, and bids behind it is not a forecast.
Using bid margin instead of finished-job margin. Plans built on bid margins overstate profit when jobs fade.
Ignoring cash timing. Profit on paper while payroll goes out weekly and pay apps clear weeks later is how growing contractors run out of cash. Model it monthly; see how to forecast cash flow for a construction business.
Leaving out the owner's salary. A business that only works if the owner is unpaid is not yet a business plan.
No downside case. Lenders assume you thought about a slow year. Show it.
Writing it once and filing it. Update the numbers at least yearly against actual results.
A plan is only as good as the job data behind the margins. Smart Business Automator tracks job costs and WIP across projects, so next year's plan starts from actual finished-job margins. See job costing and WIP automation.
Frequently asked questions
What should a construction business plan include?+
The standard sections (executive summary, company description, market analysis, organization, services, marketing and sales, funding request, financial projections) filled with construction detail: licenses, bonding, job types and sizes, crew capacity, margins, overhead, and monthly cash flow.
How long should a construction business plan be?+
A one-page lean plan works for internal planning. A plan for a lender or investor is usually several pages longer and comes with financial statements; let the reader's requirements set the length.
Do I need a business plan to get bonded?+
Sureties focus on financial statements, work in progress, experience, and character. A plan is not always required, but a clear plan with realistic projections helps make the case for more capacity.
How do I forecast revenue for a new construction company?+
Build it from capacity: crews, jobs per crew, working weeks, and average job value. Cross-check it against how many bids you can produce and your expected win rate.
A Texas steel erector lost $870,000 in two electronic payments after a dual email and telephone fraud attack. Cyber insurance covered only $250,000. BEC losses hit $2.77 billion in 2024 with construction as the #1 target. This episode breaks down the attack and 6 prevention steps.
Starts muted when the player comes into view.
Read the full episode transcript
Published transcript from Scaling Legends. It may contain transcription errors. View the source transcript.
You know, usually when we think about a massive financial heist, there is this expectation of physical force. Right, like a movie. Exactly, like you imagine the ski masks and, you know, a screeching getaway car. The adrenaline. Yeah, the adrenaline of someone just vaulting over a bank counter and demanding the cash. It's dramatic. It's loud. And... crucially, it's immediately obvious to everyone in the room that a crime is taking place, right? The alarms are ringing. But then you step into the world of modern commercial construction and accounts payable, and suddenly that... That screeching getaway car is just, it's a quiet office. Yeah. A cup of coffee, a mouse click. We're looking at a landscape of financial theft that is just terrifyingly silent.
It is the absolute definition of an invisible disaster. I mean, by the time you realize the vault is empty, the thieves are already a ghost in the machine. Wow. And the money is sitting in an offshore account somewhere. Well, welcome to this deep dive aimed directly at all you scaling legends out there. You know, the construction business owners, the general contractors, project managers, and really just the insanely curious. learners who are looking to protect their livelihoods. Definitely. Today, we are pulling from a fascinating stack of sources. We have a recent, really comprehensive piece of DataSmart Business Automator's Market Intelligence Report, alongside some highly revealing federal court documents. That's a lot to get through. It is. But our mission is to unpack the terrifying mechanics of business email compromise,
or BEC, and payment fraud. We're going to examine a specific devastating case study of an $870 ,000 loss in Texas. Just a massive hit. Yeah. We'll break down why your traditional safety nets are completely failing and exactly how to armor your business against this today. It's a critical conversation for anyone moving capital right now. I mean, the rules of engagement have completely shifted. They really have. The very trust that built the construction industry. is now the exact weapon being used to dismantle it. OK, let's unpack this because I want to start with the inciting incident. You know, the nightmare scenario. Walk us through. So it's December 19th, 2023. We are looking at a Texas steel erector named Perry and Perry, a real company doing real
work, building real infrastructure. Right. And on this random Tuesday in December, their office manager sits down and sends two electronic payments in a matter of minutes total. $870 ,000. Wow. And they fully believed, like completely believed they were paying their fabricator, a company called Alamo Structural Steel. But they weren't. No, they weren't. They were paying a criminal. The money just vanished. What's fascinating here is, and, you know, I use fascinating in the darkest possible sense of the word. This was not a typo. Right. It wasn't a glitch in their accounting software or anything like that. It was a highly calculated, surgically precise interception. This type of crime preys entirely on the routine day -to -day operations of the business. And
we have to talk about the mechanics of how this actually happened, because this is where, honestly, my stomach just dropped reading the background on this case. Because the office manager at Perry & Perry didn't just blindly wire almost a million dollars because of a random suspicious email. They actually tried to do the right thing. They followed their instincts. Yeah. They received an email from someone claiming to be the CFO of Alamo Structural Steel, requesting a change in their banking routing details for this massive payment. And the office manager saw that, paused, and decided to verify it over the phone. Which, you know, is the standard operating procedure we've all been taught for decades. If you see a change, you call to verify. But they made one critical error, just one tiny misstep that cost
the business $870 ,000. They called the phone number located inside the scam email. I mean, that is like asking the FOTS to verify if he is the officially assigned security guard for the hen hats. You are literally calling the criminal to ask if the criminal is legitimate. You're hitting on the absolute core vulnerability of human habit here. When they made that call, the scammer on the other end Calmed and confidently posed as the CFO of Alamo Structural Steel. Just played the part perfectly. Exactly. They confirmed the banking changes. They sounded professional. And here's the kicker. They knew the exact context of the payment, the project name, the invoice numbers. Which is terrifying. It is. And that
level of context is what we really need to dissect. Because these criminals are not just sending out thousands of blind, generic emails, hoping a random contractor bites. they're already inside the house. Wait, I want to clarify the mechanics of that, because how are they inside the house without the company's IT department noticing a massive breach? Like, do they just guess a password and start firing off messages? No, no, it's much more insidious than that. If we look at Smart Business Automator's market intelligence report, we see that 50 % of these BEC incidents compromise more than one mailbox. Half of them. Right. The attackers don't just hack an account and immediately send a fake invoice. They lurk. Lurk. So they're just, what? They're just watching. Yeah, think of it like a burglar breaking into your house, but instead of stealing your TV, they quietly climb into your attic and just live
there for two months. Oh, man. They don't make a sound. Every day, they read your mail before you even get home. They learn your schedule. They learn who your friends are. They learn how you speak. That is so creepy. In a digital sense, these criminals... compromise an email account, maybe through like a clever phishing link an employee clicked weeks ago, and then they set up hidden email forwarding rules. Oh, so the actual user has no idea. If I'm the CFO, I'm just typing away, totally unaware that every single email containing the word invoice or wire transfer is being silently blind copied to a server in Eastern Europe. Precisely. They sit silently in the system, absorbing everything. They learn the tone of voice your vendors use. They learn the exact billing cycles, the project milestones, and specific names of the foreman
on the job site. So they have the whole playbook. Exactly. They wait for the perfect moment of vulnerability, usually right when a large, legitimate payment is due. And they seamlessly insert themselves into the email chain. So when that office manager called the number in the email, the person answering didn't have to guess. They already had the entire script. Here's where it gets really interesting and honestly a bit overhauling. Because my first instinct is to say, OK, well, if the emails are perfectly written without those obvious typos and they know our billing cycles and the phone calls sound exactly like the real person, are we just completely outmatched by robots? It's a fair question. Like how is a busy accounts payable clerk supposed to spot this? It is a highly valid question because we are looking at a massive technology driven escalation. The
deception in the Perry & Perry case is just the tip of the spear. We are in the middle of a full -blown AI epidemic. Since artificial intelligence tools went mainstream, there has been a 1 ,760 % increase in business email compromise attacks. 1 ,760%. I mean, that's not a shred. That's a tidal wave. And the composition of that wave is shifting rapidly. Right now, 40 % of all BEC emails are entirely AI -generated. Wow. You remember how phishing emails used to be somewhat easy to spot? Bad grammar, weird spelling, awkward formatting. Yeah, the classic, dear sir or madam, kindly send funds emails. The ones that felt like they were run through a bad translation app three times. Right, well, AI wiped that defense out overnight. Large language models can now
ingest months of a compromised inbox's history and generate flawless, context -aware corporate emails in seconds. Unbelievable. They perfectly mimic the specific cadence, the industry jargon, even the specific sign -off the real CFO uses. But, and this is the scary part, the escalation goes far beyond text. AI voice cloning means that phone verification is no longer a reliable single line of defense. I really want to dig into that because it sounds like science fiction. Explain how that works practically. Like how easy is it for a criminal to clone the voice of a trusted vendor? It takes seconds, literally seconds. If a criminal has a three second audio clip of your fabricator's voice. maybe from a company voicemail greeting, a webinar they hosted, or just a quick video they posted on LinkedIn
from a job site, they can feed that into an AI audio synthesizer. From just three seconds. That's all it takes. The software isolates the timbre, the pitch, the unique vocal patterns. So when your office manager calls to verify a payment routing change, the criminal types responses into a keyboard, and the software speaks those words in real time. It sounds absolutely identical to the trusted vendor. That is deeply unsettling. You're talking to a machine, essentially, that sounds exactly like your friend Bob, who you have done business with for 10 years, who you play golf with. And Bob is telling you to send the money to a new routing number. And you do it because it's Bob. Now, if we connect this to the bigger picture, we have to ask, why is the construction industry bearing the absolute brunt of this technological assault? Smart Business
Automator's Market Intelligence Report reveals the sheer scale of the epidemic. There were 2 .5 $7 billion lost across 21 ,442 incidents in 2024. 2 .7 billion. Yes. This represents 73 % of all cyber incidents. And the financial stakes are only accelerating. The average wire transfer stolen jumped to $24 ,586 in January 2025 alone. That is a 46 % increase from just the prior month. So why construction? I mean, obviously the dollar amounts are high and you're paying for tons of steel, concrete, massive labor forces. Is it just the size of the price? The capital volume is a huge magnet, yes. But it's really about the operational culture and the complexity of
the supply chain. Okay. Construction offices are incredibly busy, chaotic, fast -paced environments. You have multiple tiers of subcontractors constantly shifting project timelines, weather delays, and really high pressure deadlines. Right. If a supplier calls and says, we need this payment routed to our new materials account today or we can't ship the structural steel, the instinct of any good project manager is to push it through to keep the project on schedule. You don't want to be the reason the whole site shuts down. Add to that the fact that construction is fundamentally a relationship -driven industry. It runs on handshakes, familiar voices, and trust. Criminals understand the psychology of that. They weaponize the chaos and they weaponize the trust. They know that in a busy trailer on a Tuesday morning, speed
usually overrides security. But this is where my brain goes to the safety net. If the technology is stacked against us and the criminals have AI perfectly cloning voices and they're lurking in our inboxes reading our mail, sure. Surely this is exactly what insurance is for. You'd think. I mean, you buy a massive cyber insurance policy, assuming it covers cyber theft. It is literally in the name. You would think so. But this brings us to perhaps the most dangerous illusion in the entire commercial business landscape today. Let's go back to our Texas case study and look at the legal mechanics of what happened next. Perry and Perry realized they lost $870 ,000. They did what any rational business would do. They filed a claim with their cyber insurance provider, Cowbell Cyber Inc. Let me guess, the
insurance adjuster showed up, opened a massive binder, and found a loophole. It wasn't even a loophole. It was a completely standard, plainly written clause in the contract. Cowbell paid out $250 ,000 and flatly denied the remaining loss. Oh, wow. Perry and Perry was outraged. So they took him to court. They sued. And on March 9th, 2026, Judge Scheidlauer ruled in the Waco federal court. What was the legal argument? Like, why did the judge rule against the contractor who was clearly the victim of a massive cybercrime? The judge ruled entirely in favor of the insurance company because of a fundamental legal distinction between a hack. and social engineering. Okay, what's the difference? The court looked at the facts. Did a hacker forcefully breach Perry and Perry's bank account and steal the funds? No.
An authorized employee of Perry and Perry voluntarily logged into the banking portal, typed in the amount, and clicked send. Wow. They were tricked, yes, but they voluntarily parted with the funds. Ah. So because the office manager physically authorized the wire, the liability shifts away from a direct network breach. Exactly. In the insurance world, that is classified under social engineering fraud, not general cyber liability. And because of that classification, it fell under a specific sublimin in the policy. The contract clearly capped all social engineering losses at $250 ,000 for the entire policy period. This is so crucial. Think about the general liability policy sitting in your office right now. For everyone listening, you might think you have
a $5 million umbrella policy, but buried on page 47 of the fine print, the specific bucket of money dedicated to getting tricked into wiring funds to a criminal is capped at a tiny, tiny fraction of that total amount. It's like having a million dollar health insurance policy. But if you actually read the scale, schedule of benefits the absolute maximum they will pay for an emergency ambulance ride is 50 bucks right if you need that ambulance to save your life you are paying the difference out of pocket foreign In this case, the net loss for Perry & Perry wasn't just the remaining $620 ,000. It was $620 ,000 out of pocket, plus the exorbitant legal costs of fighting a multi -year federal lawsuit that they ultimately lost. That is a company -ending event for a huge percentage of midsize contractors.
That's payroll. That's operating capital. wiped out. It absolutely is. And this is the harsh reality. The average social engineering sublimit across the entire commercial insurance industry right now is exactly $250 ,000. If you are a general contractor processing over $1 million monthly in vendor payments, and you have never personally read the sublimits in your policy, you are walking a tightrope without a net completely blindfolded. So what does this all mean? We can't trust our emails because they are being monitored by lurkers. We can't trust the voices on the phone because of AI cloning. And we definitively cannot assume our insurance policy is going to ride in like the cavalry to save us when the worst happens. No, we can't. We need a hard hat for our accounts payable department. What do
we actually do today to build a defense? We have to completely shift our operational mindset. Since the technology can be perfectly faked. and the insurance safety nets are highly conditional, internal process is your only armor. Process, okay. A rigorous defense -in -depth strategy must replace blind trust. It's about layering your internal workflows, your banking tools, and your administrative training. We have six vital steps here. Okay, let's start with the internal workflows. Because I was looking through the source material, specifically the recommended protocols, and the concept of the two -person rule stood out to me. It sounds like the protocol on a nuclear submarine where two different officers have to turn their keys at the exact same time to launch. That's a perfect analogy. That's step two on our list. The two -person rule mandates that for any payment over a certain threshold,
say $10 ,000, one person initiates the payment in the accounting system and a completely different person verifies it via a separate communication channel. Okay. You physically break the chain so no single point of failure can authorize a massive wire. And crucially, and this is step one. If you are verifying a vendor banking change, you never use the contact info provided in the request. Right. Going back to the fox in the hen house, you don't call the number in the email. You pull up the original master subcontract agreement from your own filing cabinet, and you call the phone number listed on that original legal document. You verify with the source data you established before the project even began. Exactly. Now, alongside that two -person rule, step four is that you must implement a mandatory 48 -hour cooling period for any vendor banking change.
Now, I have to put... back on this one. Because I am putting myself in the shoes of a GC right now. Construction runs on razor -thin timelines. If my concrete supplier says, wire the funds to this new account right now or the trucks don't roll, I don't have 48 hours. I might not even have 48 minutes. I hear that all the time. Right. The project schedule dictates everything. If I halt a pour for two days, I am bleeding thousands of dollars in delays. Doesn't a 48 -hour hold completely sabotage the operation? That exact panic you were describing, that adrenaline. That is the primary weapon the criminal is using against you. Scammers will always manufacture a false sense of extreme urgency to bypass your logic. By instituting a rigid corporate policy, you take the pressure off the individual employee.
The AP clerk doesn't have to argue. They simply state, as a matter of strict corporate protocol, our system requires a 48 -hour authentication hold to process any routing number changes. We cannot override it. Ah, so it gives you an institutional shield, it breaks the attacker's momentum, and it gives your team the necessary time to breathe, verify the original documents, and realize they are being played. It completely neutralizes the emotional manipulation. Now, moving to step three, beyond internal workflows, we have to look at external banking tools. I was reading about this in the sources as well, specifically a tool called Positive Pay. If I understand this correctly, it essentially acts like a VIP bouncer for your corporate bank account. You send your bank a daily, highly specific guest list of the checks
and electronic payments you have actually approved, including the exact dollar amounts and the exact account numbers they're supposed to go to. Am I getting that right? You're spot on. If anyone tries to cash a check or pull a wire that does not match your VIP list down to the penny, the bank's automated system flags it. and refuses the transaction until you manually log in and review it. That's brilliant. So even if a criminal somehow gets an invoice pushed through the initial layers, the bank's automated bouncer stops it at the door. It is an incredibly powerful final layer of defense. But all of these workflows and tools require administrative vigilance, which brings us to step five. You have to conduct quarterly staff training specifically on BEC tactics. Right. And I don't mean a boring once a year compliance
slideshow that everyone sleeps through. Show them the Perry and Perry case. Play them an example of AI voice cloning. Your account's payable team needs to be treated like the frontline security personnel they actually are. Because they literally hold the keys to the vault. And as we established, step six, you also need to pull your cyber insurance policy today and review those sublimits. Do not wait for your annual renewal period. Go into your policy right now. Find the specific line item for social engineering fraud and look at the sublimit. If it's only $250 ,000 and you're moving millions, call your broker immediately to negotiate higher caps or purchase a sublimit. You know, all of these processes make complete sense, but fighting AI with manual phone calls and 48 -hour holds feels a bit exhausting. Like
bringing a clipboard to a drone fight. Can technology actually help us enforce these processes without grinding the business to a halt? Absolutely. You cannot fight automated attacks purely with manual labor. Human beings get tired, we get rushed, we make mistakes. This is where Smart Business Automator's Market Intelligence Report highlights that modern platforms designed specifically for the construction industry are stepping in to protect companies. Okay, how so? These systems automatically flag banking change requests and enforce the manual verification protocols. So the software itself acts as that mandatory pause button. It won't let you process the payment until the two -person verification is logged. Exactly. The software pushes real -time alerts on the newest BEC tactics, and it organizes your
vendor data securely so that your teams can scale their operations without drowning in administrative chaos. Which is huge. Because that chaos, you know, the messy paperwork on a desk, the rushed emails in the job site trailer, the disorganized vendor files, that fog of war is exactly where these criminals hide and where these catastrophic mistakes happen. Structure and process defeat chaos and deception. This has been incredibly eye -opening. To recap everything we've covered today, we are looking at a fundamental shift in the reality of the construction industry. We are no longer just building physical structures. We are defending digital fortresses. Very true. The days where you could rely purely on a familiar voice on the phone or assume your basic insurance policy would act as a safety net for cyber theft, those days are completely over. They are entirely
behind us. The threat is sophisticated, it is incredibly patient, and it is targeting your specific workflows. So, to everyone listening... Here is your direct call to action. Do not let this just be an interesting deep dive you passively listen to on your commute to the site. Take action today. Pull out that insurance binder and check your sublimits. Implement that two -person rule for your outgoing wires. And please, share this deep dive with your office manager, your AP team, your CFO. Let's protect the hard capital you work so tirelessly to build every day. Please subscribe, rate, review, share this with your colleagues, and visit smartbusinessautomator .com to get equipped. And, you know, this raises an important question, something we all really need to sit with. We've talked about how insurance
companies are fiercely denying these claims, arguing that employees voluntarily parted with the funds. If AI can perfectly spoof an executive's voice in email and the corporate insurance policy refuses to cover the multimillion dollar loss, how long until the courts start piercing the corporate veil? How long until they start holding the individual employees, the accounts payable clerks, the project managers who clicked send personally? financially liable for that missing money?
