"It'll never happen to me"

by Andrew Sinclair, Glen Abbot Ltd

But how often do we think about the impact on our business if the unforeseen actually happens? While thinking the unthinkable may get you a reputation as a Jonah, there is a firm in Perth who are riding high by helping others to plan for an unexpected future.

Glen Abbot was founded in Perth in 1998 to provide skills and assistance to companies as they prepared for the uncertainties of the Year 2000. Growth has continued unabated since then with their client base now including many household names. Glen Abbot is now one of the UK's leading suppliers of Business Continuity Management services.

So what does this all mean? Business Continuity? Put simply, it means thinking about how you would cope and what you would do when something goes wrong. "Plans should be made in the cold light of day, not the heat of the moment" is a phrase that's often used by Andrew Sinclair, one of the Directors of Glen Abbot. "This is what organisations who are successful in recovering from unforeseen events actually do". The need to plan and have your critical processes clearly understood has never been higher. There are many potential hazards out there, ranging from the threat of a flu pandemic (if it happens) to a computer failure (which will happen) to the impact of climate change due to global warming (Perth could face floods again). Just because you're a small or medium company doesn't mean you can be complacent. If anything, there is a greater need for you to have a plan in place. A large company like a bank can always find extra resources, systems or people, from elsewhere within it, a smaller company doesn't have that luxury. It's worth a moment to reflect on the differences between an emergency plan and a business continuity plan. Generally, an emergency plan is written to ensure that your company can deal with an external event. A Business Continuity Plan is designed to ensure that your company can deal with an internal emergency. A burst water pipe in your office or computer failure, our staff illness would cause you to use your BC plan.

Last year, the Government passed a Law called the Civil Contingencies Act. This law places an obligation on Local Authorities to maintain their own Business Continuity Plans. Glen Abbot has been working with Perth & Kinross council, amongst others, to ensure that they are prepared. The act also requires Local Authorities to be able to provide advice on Business Continuity to organisations in their area. This is one of the areas where Glen Abbot are assisting the Council.

So how do you go about doing this? There's a draft British Standard for Business Continuity now, so this should be the first port of call. The standard gives guidance on what and how an organisation should arrange its business continuity. It's called BS25999. Although this may seem complex, Glen Abbot will be delighted to assist with any questions you may have on this standard.

Self Test on your readiness

1. Do you have a documented procedure for handling problems and crises?
2. Do you have all the contact details for staff, suppliers and emergency assistance written down and stored in a place where you can easily access it?
3. Do you back up all your important computer files?
4. Are your back-ups stored in a different place from the computers?
5. Do you know which of the suppliers to your business you depend on most?
6. How could you recover your financial information e.g. Sage accounts if you lost your computers?
7. Have you discussed Business Continuity with your insurance company? (they may offer a discount if you have a BC plan)
8. How long could you keep your business going if you weren't able to get into your site? eg because of a burst gas pipe or water main or perhaps due to Police cordons.
9. Do you have plan, which addresses the risk of a power cut?
10. Once you can answer yes to all the preceding nine questions - have you actually tested all the things you assume will happen?

Of all the scenarios, which we can imagine, the one which actually causes the most problems, regardless of the size of the organisation, is the loss of a key member of staff. Consider the dilemma of the sales director who loses a top field agent because she has broken her foot falling on the stairs and is unable to drive? Or the IT director who forgets to pass on the security code for the alarm before traveling on holiday to another time zone? Consider the unsettling impact on the share price of a public company when the CEO retires. Looking after staff and making sure that there are processes in place which can be used to mitigate the impact of someone being unavailable is an important step to take. It's also a relatively easy step, albeit one which take consideration and time to implement. How much critical information to the wellbeing of your business do you carry in your head? Now multiply that by the number of staff in the company and you soon see why turning "organisational knowledge" into captured processes can give valuable results. Many businesses rely heavily on the experience of the staff, and have few formal mechanisms to share or pass on that experience. Not so long ago the Apprenticeship route was the way that knowledge was passed on. Now there are fewer such options available, while paradoxically the ability to store knowledge and information has never been higher. The challenge is to ensure your contingency plan covers how you capture the knowledge in your staff.

Increasingly, we rely on electronic systems to hold even small pieces of information which we used to simply remember. Consider even your mobile phone. Can you write down from your own memory all the numbers which you've stored in it? If not, do you back-up your phone? Low-cost devices are available to do exactly this. Or you can generally back it up to a PC. That then raises the question about how do you back up your PC? Many individuals, and organisations, use digital photographs which are stored on a standard PC. In the past, people might separate their photos from the negatives. This was a back-up strategy so that if the photos became damaged or lost they cold order reprints from the negatives. Now that photographs are computer files, what steps should be taken to keep a copy? The simplest step to take is to burn a copy to a CDROM. This backup copy could then be stored somewhere other than with the PC. Or, as there are many suppliers in the marketplace, you could simply backup all the data on the PC using an online service. Online backup services have the advantage of being easy to set-up and use, and they can be accessed from almost any computer connected to the internet. This helps when considering how fast a recovery can be.

Aside from being sound business practice, there may be a need for your organisation to maintain a Business Continuity Plan for legal or regulatory reasons. Although the Sarbanes Oxley Act doesn't directly apply to many UK firms, it does lay out in detail the requirements for a firm to prove that it is being managed soundly. The Financial Services Authority in the UK is believed to be looking closely at this Act and assessing how some of its requirements could be adopted to form FSA regulations. This will have an impact on any company working in the finance sector.

To help you though the potential minefield of starting on BC planning Glen Abbot provided the following top tips:

Top Tips & Simple Solutions

• Backup your mobile phone regularly. How much hassle would you have if the phone was lost or stolen?
• Backup your PC data files and store the backup away from the PC.
• Test that you can restore the information from the backups!
• Write down the five main processes your company does - then make a list of all the resources/assets/things/stuff that you need to have to make those processes work. 
• Consider how long you could keep your organisation going if you didn't have one of the supporting resources/assets/things/stuff.
• Write your plans down - templates are available from a wide range of sources if you Google for "business continuity plan templates"
• Communicate with all the people involved in your organisation about their roles and responsibilities in the event of a crises - even if their role is to go home and await further instructions.
• Once you've written your plan, test it. Make sure everyone knows what is planned to happen. And then test it again to ensure any changes will work as you assume they will.
• Never assume that other will behave in the manner you expect. In the event of a major civil emergency even the Blue Light services may not be able to provide the assistance you expect.
• Talk to your business neighbours about their contingency plans; talk to the Local Authority and to you local trade organisations. Help ensure the community is resilient.

As Noah demonstrated, it was easy to build an Ark before the rains came. Don't put this off 'till tomorrow, as you never know when the unforeseen accident or event will occur.