Business continuity planning for small businesses
Posted on: 05 May 2014
An interview with business continuity experts Glen Abbot.
Are you a business owner who thinks that fire, flood, theft, computer breakdown or illness won’t happen to you?
Or perhaps you’re one that hopes they won’t, because you don’t know enough about business continuity for it to be on your to do list, or just don’t know where to start.
Recently we spoke to Janet Beattie, Operations Director at Glen Abbot, an independent business continuity consultancy firm. Glen Abbot not only helps its large and small clients implement sound business continuity principles but the team has learnt the benefits of them from its own experiences too.
What is business continuity planning?
Business continuity planning identifies potential threats to your business and provides a simple framework for an effective response should an interruption happen.
“Your business continuity plan is relevant in more circumstances than following fire, theft or flood”, says Janet. “It helps you to continue to provide goods and services to your customers even in adversities such as chemical incidents, loss of suppliers and a police cordon that includes your premises.”
Small businesses often see business continuity as only being for large multinationals whose complex processes warrant planning and preparation. However, the number of small businesses affected by flooding recently and the impact on the country’s economic recovery is just one example of where business continuity planning could help mitigate the damage.
What difference does having a business continuity plan make?
Having a sound, relevant business continuity management system in place gets your business back up and running faster after an interruption. Since SMEs are the lifeblood of many communities in the UK this helps whole communities recover sooner too.
As well as ensuring you are aware of where your business is vulnerable and how you would recover if the worse should happen, Janet champions the benefit of doing your business continuity planning in improving your business overall. Even if you don’t ever have to implement it.
In thinking through ‘what would I do if a flu epidemic affected my key employees or my IT networks ceased to function?’, businesses are forced to think about what they could do better.
“For example,” Janet explains, “a manufacturing company might have frequent power cuts, which results in a need to identify key processes for keeping things going. Installing an uninterruptable power supply (UPS) and a standby generator could not only keep the business running day to day, but provide valuable support in maintaining productivity following an incident.”
Similarly, the act of writing a business continuity plan for a high street retailer might trigger concerns over the storage of stock and over-reliance on one supplier. Mitigating these risks up front by reorganising the storeroom and finding alternative supplier arrangements could mean improved stock performance and more competitively priced products, as well as being prepared for flooding or supplier liquidation in the future.
Where does insurance fit in?
According to Janet, business interruption insurance and business continuity planning go hand in hand. Your insurance gives you assistance through the difficult initial period of disruption while you get your business continuity plan into action. “Business continuity isn’t designed to make you think that you don’t need insurance”, says Janet. “It’s to make sure that when your insurance pays out, you use the funds in the most effective way possible and to support activities that are critical to returning you to business as usual.”
Having a business continuity plan in place can also help reduce your business insurance premiums, as Simon Kendall, Senior Underwriter at Premierline, explains: “Business continuity planning helps reassure all your stakeholders, from staff to financial backers, that an effective strategy is in place for managing the unexpected. As a result, overall confidence in your business is built and maintained, which can result in lower insurance premiums”.
Developing an effective business continuity plan
There are five steps to making a business continuity plan:
- Analyse your business
- Assess the risks
- Develop your strategy
- Create a plan
- Rehearse the plan
Analyse your business
Getting the buy in of top management and putting together a complete picture of your business allows you to identify the critical functions that are essential to the continuance of it. Risk Director, the free online risk management service for Premierline policyholders, suggests you examine each of these functions and consider:
- What support do you have within your own business?
- Who within the business would be best placed to review the issues?
The result of this critical functions analysis for Glen Abbot itself was to review its IT systems and transfer most of its operations to the cloud. “As a service business that relies on computers, we needed to be absolutely sure of the maintenance of our IT systems should there be a disaster”, says Janet. “Having made sure we had the appropriate fire walls and security software in place to protect us against cybercrime, we were able to remove servers from our office premises and become a paperless office.”
Assess the risks
Appreciating where your business is vulnerable means evaluating the knock on effects of incidents right through to the impact on your customers. Being located by a harbour, for Glen Abbot the most obvious risk was flooding, as Janet explains.
“Recently we were informed by the local emergency planning officer that there was a risk of flooding. By the following day waves were lapping at our front door. We unplugged what we could, took everything off the floor and with our laptops under our arms we waded out through the water. Because we relied on the Cloud for our server, software and document storage, we were immediately able to set ourselves up in our recovery centre – the Managing Director’s house. None of our customers were impacted, which was critical to us sustaining our reputation and competitive position.”
Other risks that are worth considering include:
- Vehicles being unable to gain access to your buildings due to demonstrations which could jeopardise critical deliveries
- The loss of premises due to arson interrupting the ability to continue the current workload
- Your customers not paying, resulting in cash flow problems that make it difficult to pay staff
- The loss of staff due to bad weather leaving a gap in skills to perform vital duties
- Adverse publicity following an incident that threatens key customer relationships
Develop your strategy
Once the risks have been identified, each exposure can be addressed in order to:
- Eliminate the hazard all together
- Avoid the hazard by doing things differently
- Control the hazard in order to reduce its impact
- Plan for the occurrence
One of Janet’s clients, a car show room, arranged for the use of neighbouring land should the nearby river burst its banks. By pre-arranging this alternative location, working out which cars to move first and where to get facilities that would be needed on the temporary site (such as portakabins), her client was able to reduce the impact on their business operations if a flood actually happened.
“When you get that call in the middle of the night, it can be difficult to quickly make informed decisions about what’s important” Janet says. “Planning on the spot causes errors and costs you valuable time. But if you have already worked out what you are going to do when something happens, you can significantly reduce the impact the disaster has on your business and your customers.”
Create a plan
Every business continuity plan is different, but it should:
- Plan for the worst case scenario. This helps you deal more easily with smaller scale emergencies
- Show who needs to do what. Depending on the size of your business, this might include appointing a business continuity team, an incident manager and coordinators for the likes of IT, HR and for each business location
- Use checklists and include clear, direct instructions for the crucial first hour after an incident. For example, detailed plans of how key activities would be sustained and by whom
- Be kept up to date
- Be readily available if there is a disaster
It is the final point that is pivotal to your business realising the benefits of producing a business continuity plan in the first place. Because if you can’t find a copy of it when you need it, you are not giving yourselves the best chance of a quick recovery.
Janet advocates a few copies in multiple formats that are easily visible when you need them. “Put a password protected copy of your business continuity plan on your smart phone, securely file a paper copy in a uniquely coloured folder at home and put one in a suitably located bright bag labelled ‘Instant grab bag’ at work”, she suggests. There are also other useful items that can go in the grab bag such as:
- First aid kit
- Wind up torch
- Encrypted USB stick with key documents and templates
- Emergency blanket
- Mobile phone wind up charger
- Reflective vests
Rehearse the plan
An annual health check and test of your business continuity plan will help highlight any weaknesses and allow you to make any changes. During this process, the importance of communication in dealing with an emergency is often revealed.
As well as a telephone cascade list, a system Janet suggests to clients concerned about staff not having the information they need is to print cards showing the first five steps they should follow immediately after an incident. Fitting this behind personnel passes so that information like the details of the first person to call is always accessible helps make sure the right people are kept informed as soon as something goes wrong.
Not only do all staff need to be kept up to date with developments, but so do suppliers and customers. Janet’s advice for retailers is to maintain a database of regular customers so that you can quickly let them know your temporary location and that you are still open for business.
Rehearsals can also highlight over dependence on certain key members of staff. This is not only a risk during disaster recovery but it is also an area that many owner-managed businesses are particularly vulnerable day to day.
“Whilst working on a year long contract for our biggest client, one Friday afternoon our Managing Director was suddenly taken seriously ill”, says Janet. “Because of regular team meetings to discuss what we were all doing, we had a replacement ready by the Monday morning. So our customer was not adversely affected even though they were aware of the situation. Thankfully David returned to the project three months later having made a full recovery.”
In addition to regular team meetings, constructing a skills matrix that shows who can cover which business critical activity should the key person be unavailable means that alternative staffing strategies can swiftly be implemented if necessary.
Why some businesses emerge from disaster better than they went in
There’s no doubt that an unexpected event can destroy a business. But some business owners will tell you that having to rethink how they operated while they returned to business as usual uncovered unexpected long term improvements.
“During the process of getting back up and running, businesses learn what is critical and what isn’t”, says Janet. By focusing on the essentials of saving resources, time and money, they pinpoint how things can be done differently because they don’t have the equipment, materials or staff to do things how they normally do. “When these businesses are back in situ, they often find that they prefer the new ways of working. As do their customers”, says Janet. “It also makes them better prepared for any other unforeseen events lurking around the corner.”
Compare business insurance
The information and tools contained in this guide are of a general informational nature and should not be relied upon as being suitable for any specific set of circumstances. We have used reasonable endeavours to ensure the accuracy and completeness of the contents but the information and tools do not constitute professional advice and must not be relied upon as such. To the extent permitted by law, we do not accept responsibility for any loss which may arise from reliance on the information or tools in our Knowledge Centre.