Why business continuity planning is not one and done

When the COVID-19 pandemic struck it affected almost every aspect of normal business operations – it tested SMEs’ ability to adapt and overcome significant disruption more than ever before.

The good news, according to our UK SME Risk Report, which draws on responses from 1,300 SMEs across the UK, is that many appear to have weathered the storm remarkably well, citing business continuity plans as playing a key role.

In fact, overall, nearly three quarters (71%) of UK SMEs feel that their business continuity plans responded well to the COVID-19 pandemic, while fewer than one in ten (7%) reported that the company did not have a business continuity plan in place.

However, as we emerge into a new, post-pandemic reality the relative success of business continuity planning is no reason to relax – because even the most comprehensive business continuity plan must adapt and move with the times.

What is Business Continuity Planning?

In simple terms a business continuity plan is a document that sets out in detail how a business will continue to operate in the face of disruption to normal working practices. It will look at every aspect of the business – from people and human resources to facilities, equipment, IT, partners, and suppliers – anticipate potential issues and set out a clear plan to overcome them.¹

Clearly however, businesses change over time, as do the risks and threats that could bring disruption, so business continuity plans must adapt too if they are to remain relevant and effective over time.1 Quite simply, business continuity planning is not a one and done – it is an ongoing process.

SMEs’ Top Business Continuity Risks

The fact that risks to business continuity are ever-changing has not escaped the attention of many UK SMEs, according to the UK SME Risk Report.

They identified three key risks that related directly to the fall-out from the COVID-19 pandemic, each of which comprehensive business continuity planning should address. Almost half of SMEs (43%) indicated that financial uncertainty and cash flow concerns represented a significant business risk, while ‘failure to innovate’ in response to changing client demands is a concern for around a quarter (24%).

Meanwhile, perhaps recognising the crucial importance of updating and adapting business continuity plans, 21% pointed to a failure of business operations, including continuity plans and operational resilience, as a key risk for 2021.

Adapted Operations Demand Updated Business Continuity Plans

On top of those risks identified by respondents, over a third of SMEs have modified or plan to modify their day-to-day operations to meet the needs of the ‘new normal’, post-COVID – which could in itself create new risks that must be reflected in updated business continuity planning.

That has not escaped the attention of some SMEs. Around a third (30%) plan to create or have already created business continuity plans in light of COVID-19. Worryingly, however, that leaves the vast majority (70%) potentially exposed to unforeseen disruption, without the safety net of an updated business continuity plan to help them adapt and maintain operations if the worst should happen.

Meanwhile, those without continuity plans in place at all (7% during 2020) could be even more exposed at a time when defending against the unexpected is more important than ever.

How to Write and Update Your Business Continuity Plans

Writing an effective business continuity plan requires an organised, systematic approach – in essence it is about understanding risks to normal business operations, in each case taking steps to make the business better able to withstand those risks (resilience), and putting in place detailed plans to recover and return to normal quickly, in the event that operations are disrupted.²

Allocate Roles

Given that, if the worst should happen, business continuity plans must be enacted by people – quickly, accurately sand efficiently – identifying those key people and teams is a crucial starting point for every business continuity plan.²

In fact, allocating business continuity roles to named people and teams plays two roles. First it identifies the right people to assess continuity risks and build a workable business continuity plan to address then and, second, it puts in place a business continuity team that understands the risks and the plan and is therefore able to act quickly when required.²

Identify and Plan for Risks

The second step is to identify, quantify and rank key risks that could affect the normal running of the business – from loss of key people, technology downtime and damage to premises or equipment through to financial, customer and supply chain risks.

By understanding how seriously these risks could impact the business and how likely they are, businesses can prioritise, invest in resilience, and create appropriate plans to recover quickly.²

Test, Learn and Update Business Continuity Plans

It is these risks and responses that make up the bulk of business continuity plans, but the process does not end there. It is also vital to educate all staff, test business continuity plans regularly, and update based on lessons from test exercises – for instance, a test to understand how well plans to cope with IT system downtime perform might well identify areas for improvement.²

Finally, as pointed out earlier, business continuity planning is not a ‘one and done’. They must be updated regularly to reflect changing and new risks – in fact, according to some experts, updating your plan is more important that creating it in the first place.³

As a general rule, business continuity plans should be reviewed every six months⁴ – though it is fair to say that SMEs should consider updating plans as a priority in 2021, given the impact of COVID-19 in creating new risks and changing business practices.

^Sources:

<sup>1. ibm.com/business-continuity/plan
2. sage.com/business-continuity-plan
3. agilityrecovery.com/how-update-your-business-continuity-plan-2021
4. fsb.org.uk/how-to-create-a-business-continuity-plan</sup>