Business continuity planning sounds like a terribly dry subject, unless of course, you have a business that needs to stay in business.
A gray area where the obsessive compulsive meets pure, unadulterated, rational thinking—a self-insurance policy that cannot be matched because only YOU know what is needed to continue operations in the event of a catastrophe.
Ranging from simple measures like a backup generator for keeping your ice cream freezers running to the incredibly complex; executive succession, bank funding, disaster recovery sites and a communication strategy. One of the best known examples of BCP in action was during the 9/11 attacks where Cantor Fitzgerald, despite the huge loss of life and facility, was able to resume operations in just two days.
The probability of a terrorist attack of this magnitude was seen as low at the time and many were caught flatfooted—there is a balance to be considered when looking at the likelihood of a bad thing occurring, its impact and the investment required to provide full-proof contingent operations in its wake.
Here are few things to think about to keep your business up and running when the unexpected happens. Just because you have insurance doesn’t mean you will stay in business after a major disruption occurs. Weigh the odds and have contingency options ready to go.
Related Article: How to Create a Comprehensive Emergency Plan for Your Business
What could possibly disrupt my business?
Identify the Threat
A little analysis goes a long way, and part of that is to identify threats that could impair or halt business operations. Earthquakes, hurricanes, terrorist incidents and floods might immediately come to mind, but there are many less severe risks that you should consider.
Loss of a critical employee or principal can have debilitating effect on daily operations for many reasons. Single employees may have sole knowledge of specific processes and systems that might be critical to the business’s operations. A principal owner or employee may have close relationships with customers, specific undocumented knowledge of trade secrets, and information important to ongoing deals and partnerships.
Make sure you have a backup for these important individuals. Cross-training, job sharing and reasonable documentation can go a long way to eliminating disruptions.
Loss or temporary loss of use of a facility is usually the outcome of a natural or manmade disaster, fire, transportation strike or some other unforeseen circumstance beyond your control. This could be an office, a warehouse or any property required to support the ongoing operations of your business. Depending on your industry, moves such as a “work at home” program for employees can smooth the transition to temporary quarters so that work can continue uninterrupted.
Consider multiple warehouse facilities or offices that would, likely, not be subject to the same disruption, allowing you to keep working and producing. Also consider alternate supply chains. If one of your vendors loses their facility or closes its doors, do you have a back-up supplier?
Prolonged power outages are probably the most common of threats and the solution is simple. Battery backup or power generation equipment is the norm these days and has become infinitely more affordable. Battery backup is usually intended to support computer systems for short periods of operation or allow a graceful shut down as to not damage equipment.
If your inventory relies on refrigeration facilities or other power intensive equipment (e.g. manufacturing) it is important to have sustained power which would point you to more sophisticated power generation facilities. Yes, insurance will cover lost inventory, but you may not be able to regain lost business if you are unable to provide product and service for a sustained period of time.
Loss of critical information systems is the most well-known issue we face and, unfortunately, is the only threat that many businesses consider a very important one. Our computer systems generally represent the life blood of most business and are critical in supporting communications, finance, procurement, order entry and the list goes on.
Most businesses would be dead in the water without their information systems, and an entire industry has sprung up around providing contingent services in the event of a disaster. However, if you have simple data processing needs consider what it would take to create manual processes that would keep the business moving.
Getting back on your feet after the loss of a facility or critical employee can take some time, but total loss of a computer system could represent years of lost effort and information that is critical to daily operations. There are several approaches to disaster solutions for information systems; hot, warm and cold backup sites, each requiring varying levels of investment and each having a different recovery time objective (RTO).
With the advent of cloud services such as Amazon (AWS) and Microsoft (Azure) there are much better, affordable, options for providing information system contingency. In fact a WARM strategy using cloud services is almost cost free and can have a rather quick turn-around time.
Related Article: Cyber Attacks & Data Leaks: Do You Need Data Breach Insurance?
Prepare for Impact
The best way to determine whether it is worth the investment and effort for any contingency plan is to perform an Impact and Risk Analysis. Try to model the business if the sales manager goes missing in the Caribbean, the order entry system is offline for two weeks, an employee skips town with all the cash on hand, or there is a power outage. These are all disasters, though, some more probable than others.
The formula can be simple to determine whether or not to move forward with a particular contingency—Cost Risk Analysis. There are complicated models like the Monte Carlo Simulation (yes, it is all a crap shoot) but there are some obvious strategies that do not require a lot of investment and do not require too much math.
Let’s say you determine there is 1-in-2 chance that you will lose power for an extended duration in any given year—that’s a 50 percent chance of seeing that risk realized. Your cold storage produce inventory represents a potential gross profit of $15K (insurance covers the basis). A propane generator costs $2500.
Risk Probability (.5) x Risk Loss ($15K) should be greater than Cost of Contingency ($2500) with a reasonable return on investment; $7500 > $2500 (a four month ROI). Therefore, buy the generator. This example may over-simplify the subject, but you get the idea.
Test, Maintain and Communicate
Finally, you have implemented a number of measures to insure the ongoing operations of your business in the event of disaster or disruption. It’s time to test them periodically—make sure that back-up generator is still working. It’s time to maintain them—did you add another freezer requiring more wattage? It’s time to communicate to the organization how to use these contingencies when things are not on the “happy path."
Business Continuity Planning isn’t just for the big boys. Sure, big organizations have some very complicated analysis to do, must comply with federal and state regulations, and have extremely large and complex computer systems, but they have simple considerations as well. No matter how simple, a BCP can save your skin in the event of a disaster, and when courting potential investors or financing it demonstrates a very mature business strategy.