Business continuity

Coping with the unexpected

Managing a small business can be challenging and exciting. Everyday is different bringing new challenges from ever demanding customers. But there are some events which you cannot plan for, or can you?

Businesses are now even more reliant on computers and specialist plant which, when they fail, cause great heartache and pain. Even if not destroyed, access to the business may be restricted by police cordons preventing normal business operations. For example, an exclusion zone of four miles was placed around the Buncefield Depot Site at the height of the fire in December 2005, with access denied to buildings within 400 metres of the site for three days.

Some questions to ask of your organisation are:

  • what would you do if you lost access to your premises, plant and machinery through flood or fire?
  • how would you cope if your computers or phone systems failed?
  • where would you get alternative supplies if your key supplier closed up shop?
  • will you hold on to your customers if key staff fall ill or leave overnight to work for a competitor?

How well you deal with the effects of a disruption to your business, may determine your future.

There is a way of working that you can introduce, which helps you to prepare for such major disruptions and which may also help you cope with your day-to-day challenges - business continuity management.

Business continuity management has been employed by large businesses around the world to enable them to cope with major disruptions, whether caused by nature or man. The techniques employed can be scaled to any size of business in any sector, without costing a fortune.

There are five simple steps to the business continuity management process:

Stage 1 - understanding your business

The first stage is to understand how and what you need to make your business work and who has an interest in how well you perform.

Do you know who your stakeholders are - ie those who have an interest in how you run your business?

These will include your customers, employees, sub contractors, service providers, suppliers, banks and other investors, insurers and auditors.

Why do you need to identify them?

At the time of a major disruption these stakeholders will want to know how soon you will be back in business and what the effect of your disruption will be on their operations and investments.

Do you know which of your activities are most critical and if you could not continue them for any reason what would have the greatest impact on your business?

The impact may not initially be financial; it may be your reputation that is damaged, which in turn could cause new business to be reduced. It may be your standing as an employer is diminished and recruitment becomes a problem.

Consider how soon the disruption will impact your business; some activities can have immediate effect, e.g. loss of telephone service, whilst others will take several days to impact the business. This will help you decide what activities you need to restore first if you do face a disruption.

Do you know what you need to undertake these activities?

Identify the people and skills involved, what computers, software and information (data) you require.

Are there key drawings and specifications that you need access to?

What communications do you need, both fixed and mobile.

Where do you undertake these activities and what plant and machinery is used, including office equipment?

Who are your key suppliers?

A failure by a supplier may have serious consequences for you, preventing you delivering to your customer. The customer will hold you responsible, not your supplier.

At this point you will be able to identify the ‘single points of failure’. You may have a reliance on one supplier for key components or services, a single PC that holds the critical data on customers or projects, or even a key member of staff.

Stage 2 - business continuity management strategies

The next stage is to determine what you will have to do restore the critical activities. In the initial stage you will have identified what you need to get up and running first and what resources you need. There are several choices that you can make at this point.

The activity may be seen as so important that you may decide to provide a duplicate to avoid the failure occurring, eg find a second supplier for that critical product; back-up critical data off site. Alternatively you may decide that you will provide a partial level of service, perhaps to your most important customers, within a specified timescale, restoring full service as and when you are able.

Finally you may decide to do nothing in the short term, waiting until full business recovery has been completed.

Any strategy must recognise the internal and external dependencies of the organisation and must have general acceptance by management functions involved.

Stage 3 - developing and implementing a business continuity management response

Having decided what it is you need to restore and how soon you will do this, create the business continuity plans that will enable you to quickly recover what is critical to your business.

The business continuity plan is at the heart of the business continuity management process and sets out what is to be done, who will do it and how to contact them in an emergency, where you will work from if the normal business location is unavailable, key suppliers for the essential services you need and where the critical data is stored. The plan will also detail who should be informed about the disruption.

The structure, content and detail of the plan will depend on the nature of the organisation and the risk and environment in which it operates. In particularly large or complex organisations, it may be necessary to have departmental plans which integrate into one high-level plan.

Stage 4 - building and embedding a business continuity management culture

Documenting the business continuity plan is one element of developing a business continuity management strategy. Its success, however, depends upon implementation of the recommendations made across the entire organisation; a programme of training for those directly involved in the execution of the plan; and an education and awareness programme to ensure understanding and adoption of the plan in relevant parts of the organisation - this applies to both staff and suppliers.

All stakeholders should be informed that you have introduced business continuity management and what to expect if your business suffers a disruption, as this may give you a competitive advantage over others and customers will have more confidence in your reliability. It may even pre-empt their own demands for you to install business continuity management as part of future contracts.

Stage 5 - maintaining and auditing business continuity management

Business continuity management does not end when the plans are written. They must be tested to see if they will work when you really need them. It is too late to find out the errors and omissions when you have to use the plan in earnest. Plans must be kept up to date as the business structure, suppliers and customers may change, as may contact details for key employees.

Three good reasons why you should have a plan:

  • 80 per cent of businesses affected by a major incident, close within 18 months
  • 90 per cent of businesses that lose data from a disaster are forced to shut within two years
  • 58 per cent of UK organisations were disrupted by the events of 11 September 2001 - one in eight was seriously affected

Source: London Prepared

Disruption can happen at anytime, not always from major emergencies, but just as likely from local fires, accidents, breaches in security and theft. We all operate in a competitive world and reputation can easily be lost.

Be prepared to deal with any disruption, whether large or small, that would prevent you from satisfying your customers needs. Remember there is always someone waiting to take your business away from you.