Crisis management and business continuity planning
Introduction
Crises such as foot and mouth outbreaks, fire damage, illness of key staff or computer failure could make it logistically very difficult to carry on “business as usual”, especially for small businesses. With a little forethought, you can minimise the potential impact of a disaster - and sometimes prevent it from happening in the first place.
This guide helps you to identify potential risks, make preparations for emergencies and test how your business is likely to cope should the worst happen.
Why you need to plan for possible crises
The smaller your business, the more essential planning is – simple because small businesses often lack the resources to cope easily in a crisis. Failure to plan could therefore be a disaster. At best you risk losing customers while you're getting your business back to normal, however, the worst is that your business may never fight back and may have to cease trading.
Your planning process should include:
Identification of potential risks;
How you intend to minimise the risks;
How key individuals will react if a disaster occurs;
Testing of the plan.
Simply, this means if you're reliant on computer information, identify it as a risk, think about how to minimise the risk – i.e. it would be a good idea to install a back-up system so you have a copy of key data in the event of disaster. Lastly, back up frequently and check the backups.
Benefits of a business continuity plan
It sounds a little over the top right now, however, come disaster time, you’ll be glad you made a plan. A continuity plan will make coping in a crisis easier and enable you to minimise disruption to the business and its customers.
If you work with the plan and stay calm it will also prove to customers, insurers and investors that your business is tough enough to cope with anything - possibly giving you the edge over your competitors.
Crises that could affect your business
Depending on your location, line of work etc, here are some possibilities:
Natural disasters;
Theft or vandalism - vandalism of machinery or vehicles could not only be costly but also pose health and safety risks;
Fire;
Power cut;
IT system failure - computer viruses, attacks by hackers or system failures could affect employees' ability to work effectively;
Restricted access to premises - how would your business function if you couldn't access your workplace - for example, due to a gas leak?
Loss or illness of key staff - if any of your staff is central to the running of your business, consider how you would cope if they were to leave or be incapacitated by illness;
Outbreak of disease or infection;
Terrorist attack - consider the risks to your employees and your business operations if there is a terrorist strike, either where your business is based or in locations to which you and your employees travel. Also consider whether an attack may have a longer-term effect on your particular market or sector;
Crises affecting suppliers - how would you source alternative supplies?
Crises affecting customers - will insurance or customer guarantees offset a client's inability to take your goods or services?·Crises affecting your business' reputation - how would you cope, for example, in the event of a product recall?
Assess the possible impact of risks on your business You should analyse the probability and consequences of crises that could affect your business. You're likely to conclude that certain roles within the business - while necessary in normal circumstances - aren't absolutely critical in a disaster scenario.
Grade the risks so you can prioritise
It is a good idea to grade the probability of a particular crisis occurring, perhaps on a numerical scale or as high, medium or low.
This will help you to decide your business' attitude towards each risk. You may decide to do nothing about a low-probability crisis - although remember that it could still be highly damaging to your business if it occurred, e.g. a terrorist attack.
Potential impact of a crisis
To determine the possible impact of a crisis on your business, it can be helpful to think of some of the worst possible scenarios and how they might prove debilitating for the business.
For instance, how could you access data on your customers and suppliers if computer equipment was stolen or damaged by a flood? Where would the business operate from if your premises were destroyed by fire?
It's essential to look at risks from the perspective of your customers. Consider how they'd be affected by each potential crisis. Would they be likely to look for alternative suppliers?
Minimise the potential impact of crises
Once you've identified the key risks your business faces, you need to take steps to protect against them:
Premises - good electrical and gas safety could help protect premises against fire. Installing fire and burglar alarms makes sense;
Think what you would do in an emergency if your premises couldn't be used. For example, you might suggest an arrangement with another local business to share premises temporarily if a crisis affected either of you. An alternative would be to use a business continuity supplier, which can make alternative premises available at short notice, however, this is costly;
Equipment/machinery - If you use key pieces of equipment, you may want to cover them with maintenance plans guaranteeing a fast emergency call-out and specialised insurance;
IT and communications - Installing anti-virus software, backing up data and ensuring the right maintenance agreements are in place can all help protect your IT systems. You might also consider paying an IT company to regularly back up your data offsite on a secure server;
People - ensure you're not dependent on a few staff for key skills by getting them to train other people. Perhaps you could get temporary cover from a recruitment agency if illness left you without several key members of staff;
Insurance - Insurance forms a central part of an effective risk-management strategy. Think about how to insure your business - people, life and health;
Plan how you'll deal with an emergency
You should draw up a business continuity plan setting out in writing how you will cope if a crisis does occur.
It should detail:
The key business functions you need to get operating as quickly as possible and the resources you'll need to do so;
The roles of individuals in the emergency.
Making the most of the first hour after an emergency occurs is essential in minimising the impact. As a result, your plan needs to explain the immediate actions to be taken.
Consider whether you'll need to give staff specific training to enable them to fulfil their responsibilities in an emergency situation. Ensure all employees are aware of what they have to do.
Arranging the plan in the form of checklists can be a good way to make sure that key steps are followed.
Include contact details for those you're likely to have to notify in an emergency such as the emergency services, insurers, the local council, customers, suppliers, utility companies and neighbouring businesses.
It's also worth including details of service-providers such as glaziers, locksmiths, plumbers, electricians, and IT specialists. Include maps of your premises' layout to help emergency services, showing fire escapes, sprinklers and other safety equipment.
Set out how you'll deal with possible media interest in an incident. Appoint a single company spokesperson to handle questions and try to be positive in any statements you issue. Ensure staff, customers and suppliers are informed before they find out in the media.
Finally, make sure hard copies of your business continuity plan are lodged at your home and with your bank and at the homes of other key members of staff.
Test your business continuity plan
Think about the things that would cause most disruption and that are most likely to happen to your business. Then make sure that your plan covers each of the risks. Ask yourself the following key questions:
Does it set out each employee's role in the event of each emergency? Have you set out the right steps to take?
Is the order of the plan correct so that priority actions to minimise damage will take place immediately after the incident?
Make some telephone calls to check that the key contacts and phone numbers that you have given are correct. Having to find the right number after a crisis could use up valuable time.
Keep your plan updated
Remember to update your plan regularly to take into account your business' changing circumstances. If you move into new premises, for example, you could face an entirely new set of risks. You'd need to draw up new maps for the emergency services and amend any contact numbers necessary.
If by chance you find some error of law or fact in any Net Lawman information page, do please tell us. We should also welcome your suggestions for new subjects for information pages. These notes:
Do not provide a complete or authoritative statement of the law;
Do not constitute legal advice by Net Lawman;
Do not create a contractual relationship;
Do not form part of any other advice, whether paid or free.
