It is time to shake up SMEs on business continuity planning before a disaster strikes, argues Judith Little
New surveys seem to be produced all the time which show that many small and medium sized businesses have no contingency plan to cope with an incident which results in them either being unable to access their office, or in the majority of their staff being unable to get to the office, for instance following a major public transport disruption.
The latest survey from Cable & Wireless and the Institute of Directors is no different, confirming that little has changed since the London Chamber of Commerce and Industry survey in 2003.
Why is this? Most of these companies understand that their business will be affected in these circumstances and the same surveys point to the fact that as a result many of them will go out of business.
Frightening statistics, so what is it that makes them play Russian roulette in this way?
"It won't happen to us", "we'll cope, we always do", and "we're not a terrorist target" are frequent responses from companies when they are asked about their lack of preparation for disaster. Others believe their insurance company will 'pay for everything'.
The figures above would suggest that these responses are based on false assumptions and that these companies are deceiving themselves into complacency.
A lot of companies think they don't have the time to prepare for something that 'will never happen' to them. While it is true that bombs, major fires and floods capture the headlines, and happen to only a fraction of the UK business community, almost 90% of business-threatening incidents are 'quiet catastrophes' which go unreported in the media but which have a devastating impact on a company's ability to function.
Take the case of a building affected by a burst water main. Following the burst the roadway outside the building quickly began to flood, as the drains were unable to cope with the volume of water.
In a short time the water reached the entrance level to the building and down into the basement, which was used for storage and contained the electrical power supply.
The power shorted out due to the water, which meant that none of the electrical equipment in the building worked. Lifts consequently were out of use and the stairwells had no natural lighting. Standby batteries provided two hours' electrical back-up cover only.
This meant that, although the building was undamaged above ground level, it was unusable on health and safety grounds for over a week while the power was restored.
One of the tenants with the help of its business continuity plan was able to transfer its essential activities elsewhere within a few hours. Unfortunately, others were less well prepared.
What about those small companies who have prepared for incidents? What is their experience of using their plan?
After arsonists destroyed its office, one such company managed to relocate its entire operation, including 75 employees, within three working days.
The lessons it learned included the fact that having the plan (which included robust IT procedures requiring data to be regularly backed up and kept off site) and managing to relocate within days sent a very strong positive signal to its customers.
It reassured clients that it was back in business with a fully functional office which could still deliver the service they demanded.
Of course ,many of the causes of an incident are outside a company's control and it will often find itself at the mercy of the emergency services making all the decisions.
Suppliers problem
It may not even be the company itself that suffers the disaster. Often the suppliers are the primary problem and it is they who define the timescale of the interruption.
However, even if they do recognise that they should have some kind of continuity plan in place, most small or medium size companies by their very nature spend their time actually running their business.
They have neither the resource nor capacity to put together the information that goes towards creating a successful and ultimately useful document.
Given this, what can they do? Well there's any number of companies offering their services to produce a business continuity plan. A quick look on the internet will confirm that.
But that same look will also confirm that their main aim is to give you a full 'bells and whistles' document, something a major UK or global company would require. That's simply not what the small company needs or wants, besides which, it will be far outside the price range that they are prepared to pay.
What they want is a basic document which tells them what they need to prepare for, what they do when the worst happens, and the contact details of everyone they need to get in touch with to get themselves up and running as quickly as possible following any kind of incident.
They want it in a small, easy to read document that can be reproduced and copies given to appropriate staff. And they want to pay no more than a few hundred pounds for it.
This is not an unrealistic demand on our industry and by applying our skills to 'think small' the objective can be achieved. The question will then be, can the insurance industry shake small and medium enterprises out of their business continuity denial? IT
' Judith Little is a senior consultant with FitzGerald Consulting
