A recent survey undertaken in New Zealand by Massey University reveals that less than 10 percent of small and medium enterprise (SMEs) have a business continuity plan in place, despite that over 40 percent of them have experienced a crisis in the last five years. The survey finds a high degree of vulnerability in SMEs across New Zealand and concludes with a recommendation for a national program to address this gap.
See Also: Data Center Security Study - The Results
But it is not just SMEs in New Zealand that need to consider business continuity planning.
The costs of not doing Business Continuity Management are far greater than the costs of implementing good BCM arrangements.
If we widen our perspective and take a look at the global picture, we discover that despite that more than 60 percent of all organizations experience up to 10 disruptions every year (BCI Global Survey 2011: the business case for BCM), less than 50 percent have solid business continuity arrangements in place. And when you consider the potential financial implications of disruptions - on average, 38 percent of businesses stand to lose more than $1M USD if a disruption causes a downtime exceeding 72 hours - then you start to appreciate the potential costs of not practicing good BCM.
In fact, it is precisely the envisaged costs of BCM that are often cited as a reason for not doing BCM, particularly by busy SMEs whose main focus is day-to-day survival. And yet the costs of not doing BCM are far greater than the costs of implementing good BCM arrangements. The consequences of not having measures in place to deal with disruptions or disasters in terms of organizational impact include loss of productivity, revenue, customers and potentially the loss of your business - a fairly high price.
In fact, the value of an effective and properly tested Business Continuity Plan to a business is almost directly proportional to the percentage of company operations that could be lost in a single incident. In the case of your big global corporates, that might only mean a small percentage, but for an SME that could mean that your whole company is wiped out, literally bringing your business to its knees and unemployment to your staff.
The problem is often the definition of what a disaster is, and then the next bit is weighing up the odds about the likelihood of it happening to you. When you consider that the top three threats to any business are power outage, disruptions caused by the weather and IT failure, and that these could all spell disaster to any firm, but especially small firms, then viewpoints start to change.
When you turn your focus to the impacts of the 2011 tsunami, you come to understand that you don't have to be physically affected by a disaster to be affected by one. After the 2011 tsunami, 337 companies went bankrupt, and yet only 46 were located in the region. The rest went bankrupt as a result of the impacts of this major disruption on their supply chains. If we turn our attention to 9/11, the event that shocked the world, 70 percent of small businesses located in or around the twin towers went out of business. You don't have to be in it to feel it!
These are all very powerful statistics, and at first glance deliver (you would think) an infallible business case for business continuity. So why do so many SMEs continue to believe that business continuity planning is just for the big guys? How do we go about convincing them otherwise?
The key message to get across is that having good BCM arrangements in place helps small businesses (and large) to better understand their business vulnerabilities and dependencies.
Understanding critical activities and key functions and knowing your supply chain allows small businesses to put measures in place that will protect them in the event of a disaster or disruption. Without this knowledge, your chances of recovery are severely impeded, if not completely diminished.
BCM provides businesses with a method to deal with any disruption, no matter what the scale or the source and above all, BCM applies to every part of your business. BCM covers so much more than an IT outage - it considers disruption to your people, your premises and your supply chain. It provides a proper focus and gives assurance that all critical assets and processes have been identified and protected as far as possible. It gives peace of mind and delivers the right message to all your stakeholders. BCM protects you and your business.
A Small Plan is Better Than No Plan at All
Often all it takes is a simple plan that will allow small businesses to continue to do whatever is considered to be time or output critical in order to keep the cash flowing. The trick is to understand what makes your business vulnerable; what disruptions are likely to cause the biggest impact; and then to put measures into place that minimise the impact. It is all about being prepared. Don't wait until disaster strikes. Remember, when disaster strikes, the clock is ticking ,and when the clock is ticking there is little time to start to think about how to respond; it is time to respond now!
Bird is the technical development director at the Business Continuity Institute in U.K. The BCI currently has over 7000 members in 100+ countries.