Business Continuity: Not Just for Big Companies
During a recent seminar, a participant raised a question that incited a great deal of discussion. An owner of a small start-up business asked – “How large does a company have to be to have a Business Continuity Plan?”
This very simple question quickly turned into a complex discussion. It migrated away from “the number of employees,” into a dialogue around the use of available capital, the potential return on investment and the loudest comment, “we do not have the time or resources to devote to the project.”
All of these are valid points. Given the inherent difficulty of measuring returns from continuity programs, the cost in time, capital and resources (especially to a small or pre-revenue business) can be significant and very difficult to justify. The preceding concerns are valid, but I do want to share some other factors that must be considered by small businesses when analyzing the need for a preparedness program.
Preparedness is no longer a luxury for a business – big or small. It is a necessity. Regardless of size, OSHA requires that a business protect its employees by providing a safe work place. Companies need to guard their intellectual property, protect their critical business information and have steps in place to respond to a crisis. In addition, the following reasons can help justify the need and cost of a Continuity Program for a small business.
- Regulated businesses are required to create and maintain Business Continuity plans. Organizations such as HIPPA and FINRA have very specific requirements for registered businesses. Regardless of a company’s size, if it operates in a regulated environment, it has to have proper plans in place and tested.
- Corporate governance is another driver of a continuity plan. A Business owner has a fiduciary responsibility to provide a safe workplace and protect their employees. This goes beyond items such as hard hats, protective clothing and safe machinery. It also includes procedures for lock-downs and shelter-in-place, communicable illness programs and workplace violence awareness. In today’s media saturated environment, EVERYTHING IS FORESEEABLE AND TOMORROW – ANYONE MAY BE FOUND ACCOUNTABLE.
- Procurement requirements are driving the need for preparedness plans. I recently worked with a 30-employee contract manufacturer that was required, as part of their supply contract, to provide a summary of their Business Continuity and Crisis Recovery plan. There is a growing requirement, as a way to protect their supply chain, of requiring vendors to provide evidence of a documented and tested continuity plan. In addition, even small companies have critical suppliers (water, electrical, staff) that need to have preparations in place if the service is interrupted.
- Some small companies see a continuity plan as a competitive advantage. Preparedness and Resiliency are brand attributes for every company. By demonstrating a commitment to preparedness, especially if the program is part of your quality process, you have the opportunity to show a customer how you can help protect their supply chain.
- As part of an investor’s due diligence, it is becoming more common to expect start-up and early stage companies to define how they will protect the business during a crisis. A plan is just one part of good business practice and indicates a commitment to the business and an awareness of the risks to the investor’s capital.
The size and complexity of a continuity plan will depend on the size of the business, but all plans will focus on protecting the most important resource, employees.
Plans need to include an evacuation and communication process.
A business also needs to protect its information technology and understand the risks to the business so that risks can be mitigated. At Firestorm, we have a number of Tool Kit products that are suited to small enterprises and our solutions can be tailored to fit the time and cost restrictions for small or emerging business.
“What should we do now?” “What should we say?”