Will Your Business Continue?

A question many management teams should ask, but rarely do until their investors require it or when it’s too late. I know this all too well and first hand.

Business Continuity Planning (BCP) and Business Continuity Management (BCM) gained popularity in the 90s as risk of terrorism and other threats increasingly showed the strong links to business operations and entire sectors.

BCP is a diagnostic of the risks and related impacts on the business- a snapshot into the current state of the company’s ability to withstand a shock.

BCM is the longer-term and embedded systems and methodology within the company that continues to manage and prepare the company for shock.

A company ultimately needs both to ensure people, systems and departments are in sync.

My company was in a terrorist attack in 2019 that affected the team and traumatized all aspects of the business. Employees, managers, systems, client relationships are all tested and in unison in these - and much milder situations.

As a people-based, relationship-based business, recovering from a shock is hard- and in some cases, close to impossible. It certainly felt like it at the time. While it’s taken a while, I’ve returned to consulting and aspire to help other companies avoid the pitfalls we encountered.

Start with a Business Continuity Plan

Recently, I’ve been increasingly asked to help companies assess risk, largely upon request from lenders and investors. So where does one begin? In general, it is good practice to know your risks so you can tackle them, rather than putting them off until they grow beyond reasonable control.

Companies can begin by doing a diagnostic of their current situation including key internal and external risks, then the systems and policies in place that employees will know to follow in case of a relevant situation. Eventually they may want to follow an ISO procedure to do a full diagnostic. I’ve worked on baseline BCPs and also collaborate with a few others to conduct a full BCP. While a baseline BCP is a quicker analysis to uncover key risks and assess a company’s preparedness to respond, a full BCP will take at least a few months of site visits, interviews and deep document and systems review.

The Business Impact Analysis (BIA) uncovers the risks, their severity and likelihood of occurring and then contrasts that against current organizational systems and management tools, such as departmental policies and procedures that will support time-sensitive and smart actions to minimize time to recovery.

Continue with a Managed Process

A BCP is a good start that sensitizes management and departments to key gaps, as often teams do not prioritize risk, especially in the early of growth. However, as managers know, businesses are a fluid, ever changing entity and that is why establishing a long-term solution and diagnostic function is important. Continuous business risk assessment and management will have endless benefits with growth.

Business Continuity Management (BCM) is a deeper, embedded solution. It should include a dynamic task force that touches across critical departments of your company. Usually a BCP is conducted by an outside independent party and that party can help to provide point-in-time e.g. annual updated diagnostics of company risks from an outsider’s perspective, finding blindspots the core team may struggle to see. But also, having an internal function- a task force- to lead the Business Continuity response or recovery in case of an incident, and also to implement on addressing gaps identified in the annual BCP are extremely valuable.

Risks Can Grow Unmonitored

Finally, just remember that early growth of a startup is hectic and fast-paced. It is easy to put aside thinking about business risk or assessing gaps in internal processes and others- but assign someone strong from the start to manage this internal process, and ensure these core risks to your business do not grow likes weeds out of control. It is important to aim to build more than a beautiful house of cards, and that requires the systems, processes, procedures, insurance and more to shore up sustained growth and operations.