Business continuity planning: Should I bother?
Most big businesses are well prepared for any incident which could impact on their operations. Small firms on the other hand are generally not ready for the unexpected. Dan Martin examines why small businesses should place business continuity planning higher up their agenda.
The UK's large corporates have complex plans in place for how they would deal with unexpected events. Be it floods, terrorist attacks or employee illness, the big guys are ready to deal with the potential impact on their IT operations, workforce and premises.
Of course, given the huge employee numbers and the amount of money at stake it's unsurprising that big businesses have such plans in place. But what about small businesses? If research is anything to go by, it appears that most are far less than prepared.
According to a recent study by the British Insurance Brokers Association (BIBA), only half of SMEs have a formal written Business Continuity plan in place even though the same number believed it would take less than a day for a serious disruption or disaster to have a significant impact on their business.
So are small firms wrong to bury their heads in the sand?
We're too small to care
Despite the amount of money large corporates plough into business continuity planning, it's actually their small counterparts that are often the most vulnerable when incidents occur as they are usually the ones left facing ruin and struggling to cope.
Steve Foulsham, technical services director at BIBA, says most small businesses point to terrorist attacks as the most likely major disaster that might affect their business and if they are not based in a big city they often rule out business continuity altogether. But they are wrong to do so, he argues.
"The Buncefield fire was unexpected and affected over 400 businesses. The Carlisle and Boscastle floods devastated their local communities, and we all have the 2007 summer floods clearly in our minds which have wreaked havoc in many business communities," Foulsham warns. "Workable business continuity plans can make the difference between survival and business failure."
Ralph Holtom, business director at trauma specialist CiC, agrees. He argues that it would be unwise for small businesses to ignore preparing for the unexpected. "Your cash flow will kill you very quickly if you're not producing anything for a couple of months," he says. "If your factory is denied you and your processes are wiped out or you run an office and people can't come into work because your server has blown up and files have been lost, what are you going to do?"
Not all the of UK's small businesses are ignoring the issue however. Several have recognised that planning for a potentially crippling impact on their operations is important. Gloucester-based PR company 10 Yetis is an example.
Despite being a two person company, the owners recently took the decision to formulate a plan. As well as pressure from their business mentor to take action, 10 Yeti's Jilly Tovey says there were other reasons involved. "One, having worked for big organisations in the past you have it drilled into you that planning is essential," she explains. "Two, for us there came a time when we began to worry that should something bad happen to key individuals, our offices and alike it would mean the end to something we have spent years carefully growing."
An opportunity to test the plan occurred much quicker than 10 Yetis expected. Two months after drawing it up, floods struck Gloucestershire earlier this summer. "Without the plan in place there is no doubt we would have struggled," Tovey says. "I am not saying we would not have survived but we would have had to spend wasted time getting things agreed and signed before moving work on and this would have undoubtedly meant losing clients."
Isn't it expensive?
Big businesses spend millions on business continuity management with experts talking of drawing up long, complicated documents and instigating regular, drawn out testing. It is this fact which puts off many small business owners from addressing the issue. But that needn't be the case. The principles involved are the same for firms of all sizes but for small businesses it can be done in a much less complex and cheaper way.
Holtom says it's all about thinking cleverly and practically. He believes that there's very little involved in business continuity planning that you can't do yourself. "If disaster strikes and your site is denied, could you and your staff work at home and log in remotely?," he says. "If they can't, get it put in place, it's not that expensive. You may not be able to do everything from home but you can probably do quite a lot."
Working from home may not be an option for all types of businesses, particularly manufacturing firms, but even then there are cheap and effective methods that can be implemented. Consider reciprocal agreements with other businesses for use of their premises while yours is being fixed. "Ask fellow business owners if you can put your stuff in their warehouse for a month while your building's being put back together," Holtom continues. "Suggest you'll do the same for them if an incident occurs."
One of the most valuable areas that is worth spending money on is backing up vital data. Small businesses are much more likely to neglect this issue so if you don't fully understand how to ensure everything that needs to be is backed up, consider taking on the services of someone that does. "I can think of one small business which thought it was backing up everything but was actually only backing up the directory structure and none of its crucial data," Holtom warns.
So now you've decided business continuity is important, how do you go about getting prepared?
Drawing up a formal, complex document is not necessary but sitting down and understanding your business is vitally important. Company owners should know this already but thinking about it in detail is advisable.
"The crucial factor to consider is 'how will I continue to deal with my customers and maintain their confidence in the wake of a disaster?'," says Foulsham. "They may well need to consider, for example, plans to activate alternative accommodation, keep lists of contacts for customers and suppliers, should electronic records be affected, consider transport difficulties and the possible use of sub contract transport."
When 10 Yetis drew up its plan, the owners examined the key day-to-day supply and demand issues and then identified options in terms of a realistic budget to spend on planning. Who the company could trust and rely on should something happen was another element involved.
Tovey says that a key part of disaster recovery planning is looking at current work processes and making sure should an incident occur, someone else can come in and understand how things work and get operations up and running straight away. She adds: "This goes down to a very basic level such as regularly backing up data, storing it off site and documenting the process for carrying out business critical areas of work."
Getting a formal plan written down is important but for small businesses in particular scope for fluidity as events unfold is crucial. "The key thing for us was to get a set of none disclosure agreements with third party providers in place to pick up existing and potential client work and also get agreements signed so that we could hot-desk out of other companies offices should the need arise," Tovey explains.
Testing the plan is the next step which for 10 Yetis came in the form of a real natural disaster. Tovey says: "We had to use phone battery power wisely and several phone calls later we had the most pressing work issues addressed via our reciprocal third party agreements and messages sent to affected clients letting them know we were still up and running."
For most companies, a real incident so close to drawing up a plan will not occur but testing is still vital. Lyndon Bird, from the Business Continuity Institute, advises testing areas of your plan systematically rather than a full test which could put your business at risk. "Test your IT backups and recovery procedures not just on your own computers and networks but elsewhere," he says.
"Test your staff understanding by a scenario walk-through, perhaps have an unannounced out of hours staff/supplier contact test, if you have an alternate building test its suitability and accessibility at a weekend or evening."
Another key point to bear in mind if you employ staff, is how will they cope. People are often the most overlooked area of business continuity planning but being prepared for their reaction to an incident is vital. Think about how you will cope without key personnel and how will you deal with traumatised workers. Companies like CiC can help with such issues. "If your building has fallen down and people are injured the last thing you want to be doing is rummaging around trying to find out where to ring," says Holtom. "If you have any employee assistance programmes use them as most can do critical incident support. If not, find a company that can provide such services. Make links to that company, ring them up, talk to them, ask what you can do to prepare."
Business continuity planning is all about being realistic and thinking sensibly about how you will cope with an incident. Resisting the temptation to think about recovering your entire company is key. The driving factor is to analyse what's most important to keep your company operating until the worst is over.
Entrepreneurs would do well to adopt the attitude of 10 Yetis' Jilly Tovey: "At the end of the day we are a tiny company in the grand scheme of things but we are fiercely proud of what we have created and we are not willing to risk losing everything because we could not be bothered to take time out to plan."