According to a survey conducted for the Business Continuity Institute, nearly one-in-five businesses suffer some form of major disruption every year.
As if to prove the point, Aviva – in its bi-annual SME Pulse survey conducted late in 2010 – found that only 28% of those that took part in the survey had any form of business continuity plan in place.
Further, the Aviva survey found that, in general, business owners grossly underestimated the time it would take to get the business back on its feet following any kind of catastrophe.
Now while we don’t suffer from earthquakes and tsunamis here in the UK, we’re not immune from other threats. Cast your mind back to the Buncefield oil depot explosion in Hemel Hempstead, the terrorist attacks in London, the floods in Cumbria and the never ending snow falls over the last couple of years if you want proof of that statement.
In cold cash terms, you only need to understand that if your business is unable to serve the customer then another will… and there’s a fair chance that the customer may not return. The unlikely ‘once in a thousand years’ event could be coming your way, so how should you prepare?
Understanding the business: the potential threats
The first step is to understand your business in terms of the potential threats to its normal operation. This is something that needs contributions from all of your staff.
Look at every aspect of the business and think about the people you employ, the stock you need to work and how you provide the product or service.
The threats to your business are easily categorised and, while some of them seem improbable, it’s nevertheless good to consider them all:
- natural disasters: flooding caused by burst water pipes or heavy rain, or perhaps wind damage following violent storms
- theft or vandalism: theft of computer equipment could prove devastating (similarly, vandalism of machinery or vehicles could be costly and pose Health and Safety risks)
- fire: few other situations have such potential to physically destroy a business
- power cut: would you be able to operate without IT or telecoms systems, key machinery or equipment?
- fuel shortages: shortages in fuel could prevent staff from getting to work and affect your ability to make and receive deliveries
- IT or telecoms system failure: viruses, hackers or system failures could affect employees’ ability to work effectively, and what would happen if your telephones or broadband failed?
- restricted access to premises: how would your business function if you couldn’t access your workplace?
- loss or illness of key staff: how would your business cope if a key member of staff were to leave or be incapacitated?
- outbreak of disease or infection: an outbreak of an infectious disease among your staff could present serious Health and Safety risks
- crises affecting suppliers: could you source alternative supplies?
- crises affecting customers: will insurance or customer guarantees offset a client’s inability to take or pay for your goods or services?
- crises affecting your business’ reputation: how would you cope, for example, in the event of a product recall?
- terrorist attack: consider the risks to your employees and business operations from a terrorist strike
By thinking of all these issues as the start of a chain of events – with the worst case scenario – you will be able to build a survival plan.
Developing your strategy and planning
Once you’ve analysed the business you’ll find that some risks you accept and choose to ignore. Others you accept but you set up a mutual arrangement with another business so that, in case of disaster, they’ll help you out.
Alternatively, you may attempt to lower risks, attempt to lower risks and set-up a mutual help agreement or you could lower all risks and become self sufficient.
In reality, your plan will consist of a mix of these depending on the functions of the business that need to be up-and-running so that work can restart.
However you approach it, ensure that the plan that comes from the strategy is written in plain English so that all can understand it. Guidance on writing a plan can be had through a free piece of software that has been designed by several insurance companies. It’s called ROBUST and is accessible at the RISC Authority.
Contemplate where you can build redundancy into your business without adding too much extra cost. While there’s no point renting a spare building or equipment just in case, knowing where you can rent what you need in an emergency may just save the day. Similarly, think about where you would go to source agency staff in order to fill in for staff absences.
You know that equipment – especially IT – can fail. The hard drive in your computer, for example, has a ‘mean time before failure’ rating: in other words, how long it’s expected to operate before it fails. That doesn’t mean that it won’t fail much sooner.
Similarly, an (often automatic) update to the operating system on your computer may cause more problems that it cures. The key to both of these scenarios is to back-up your data regularly, at least once a day, and keep the back-up both offsite and accessible.
Telephones and broadband are now so critical to the running of a business. This is especially acute if your telephone system is based on VOIP (Internet) rather than the traditional hardwired BT phoneline. Plan to use alternatives. Is there someone with a wireless connection that you can agree a reciprocal piggy back arrangement?
If you rely upon other equipment, do you know where you can source repairs or replacements from should they also fail?
Can documents be scanned and filed electronically? There are plenty of fast, double-sided automatic scanners that will not only turn paper into PDF files that can be backed up, but which will give you a searchable archive on your computer.
Even better, you’ll be able to store the originals elsewhere at a less expensive location to further spread the risk of loss.
Insurance: what do you need to think about?
Despite rising costs never skip on your insurances. Indeed, make a point of recording when they are due and ensure that you check that they have been paid for.
Don’t forget to note down the policy details and keep them offsite. Apart from the obvious insurances – premises, stock, vehicles, public and employers liability – also look at:
- directors and officers’ insurance that covers negligence when running a firm
- business interruption insurance that pays to keep a business alive following a catastrophe (unlike premises and contents which just pays to replace the physical)
- key man insurance that provides a sum of money following the death of a key person – ie a co-owner or shareholder – to the surviving business partner(s) to keep the business afloat or to buy out the estate of the deceased
- citical illness cover that pays out following the diagnosis of defined serious illness that invariably is terminal or life threatening – especially important for small businesses or sole traders
- permanent health insurance that pays an income where the insured can no longer work (this too is vital for the sole trader)
It would be a mistake not to mention the regulatory threat of changing legislation, case law and tax policy, any combination of which could impact a business.
Employment law is great example. Employees have become more litigious and, as discrimination awards have no limit, a good case proven against the employer could cost thousands.
Similarly, ignoring a tax demand from HMRC – even though you consider it pure fantasy – could lead to bankruptcy. You need to keep abreast of all legal changes that may affect the business.
Write policies and risk assess
Having good polices and also risk assessing threats will mean not only will you be able to forestall any obvious threats such as simple fire risks, but they may help you lower your insurance premiums on the basis that you present a lower risk to the insurer.
Further, everyone will know what to do. For example, by writing a bad weather policy both you and your staff know the effort level that’s expected when trying to get into work and the pay/leave arrangements for when they fail to make it.
You may consider employee issues such as discrimination, bullying and sickness absence a threat in which case you should develop policies for those too. The same applies to Health and Safety issues.
A good policy will not necessarily get you out of trouble if an incident occurs, but it will help mitigate any penalties heading your way following an investigation.
Do take legal advice before you put your thoughts into policies that are available for all to read.
Emergency contacts and testing procedures
Draw up a list of emergency contacts that includes key staff, the utilities (water, gas, electricity, telephone and broadband), employment agencies and key suppliers.
Work out how you can divert your calls if you cannot access the building to do so.
Remember also details of your accountant, solicitor and the tax/VAT office (with your references). Don’t leave out neighbouring businesses in case they need to be informed.
Also ensure that you are still able to contact your customers – they need to know that you are still in business, especially if you have moved.
Finally, having spent time, effort and money in creating a disaster recovery plan, you need to both test it and keep it up-to-date. Carry out a test without telling anyone that it’s a test. See where – if anywhere – the plan falls over.
Ultimately, the threats affecting one business might be quite different for another, but the threats are real. Statistically, as stated your business runs a one-in-five chance of something serious going wrong. Make sure you’ve planned for any such occurrence.
Additional sources of advice