Crisis management and business continuity planning | Business Link Page 1 of 9

Crisis management and business continuity

planning

Unplanned events can have a devastating effect on small businesses. Crises such
as fire, damage to stock, illness of key staff or IT system failure could all make it
difficult or even impossible to carry out your normal day-to-day activities.

At worst, this could see you losing important customers - and even going out of
business altogether.

But with good planning you can take steps to minimise the potential impact of a
disaster - and ideally prevent it happening in the first place.

This guide will help you to identify potential risks, make preparations for
emergencies and test how your business is likely to cope in a disaster.

Why you need to plan for possible crises

It's essential to plan thoroughly to protect yourself from the impact of
potential crises - from fire, flood or theft to IT system failure, restricted access to
premises or illness of key staff.

This planning is very important for small businesses since they often lack the
resources to cope easily in a crisis.

Failure to plan could be disastrous. At best you risk losing customers while you're
getting your business back on its feet. At worst your business may never recover
and may ultimately cease trading.

As part of the planning process you should:

z identify potential crises that might affect you

z determine how you intend to minimise the risks of these disasters occurring
z set out how you'll react if a disaster occurs in a business continuity plan
z test the plan regularly

For example, if you're reliant on computer information, you should put a back-up
system in place so you have a copy of key data in the event of a system failure.

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 2 of 9

Benefits of a business continuity plan

A carefully thought-out business continuity plan will make coping in a crisis

easier and enable you to minimise disruption to the business and its customers.

It will also prove to customers, insurers and investors that your business is
robust enough to cope with anything that might be thrown at you - possibly
giving you the edge over your competitors.

Download a guide to business continuity management from the Business

Continuity Institute (BCI) website (PDF) - Opens in a new window.

Crises that could affect your business

Depending on your business' specific circumstances, there are many possible
events that might constitute a crisis:

z Natural disasters - for example, flooding caused by burst water pipes or

heavy rain, or wind damage following storms.
z Theft or vandalism - theft of computer equipment, for instance, could prove
devastating. Similarly, vandalism of machinery or vehicles could not only be
costly but also pose health and safety risks.
z Fire - few other situations have such potential to physically destroy a
business.
z Power cut - loss of power could have serious consequences. What would you
do if you couldn't use IT or telecoms systems or operate other key machinery
or equipment?
z IT system failure - computer viruses, attacks by hackers or system failures
could affect employees' ability to work effectively.
z Restricted access to premises - how would your business function if you
couldn't access your workplace - for example, due to a gas leak?
z Loss or illness of key staff - if any of your staff is central to the running of
your business, consider how you would cope if they were to leave or be
incapacitated by illness.
z Outbreak of disease or infection - depending on your type of business an
outbreak of an infectious disease among your staff, in your premises or
among livestock could present serious health and safety risks.
z Terrorist attack - consider the risks to your employees and your business
operations if there is a terrorist strike, either where your business is based or
in locations to which you and your employees travel. Also consider whether an
attack may have a longer-term effect on your particular market or sector.
z Crises affecting suppliers - how would you source alternative supplies?
z Crises affecting customers - will insurance or customer guarantees offset a
client's inability to take your goods or services?

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 3 of 9

z Crises affecting your business' reputation - how would you cope, for
example, in the event of a product recall?

Though some of these scenarios may seem unlikely, it's prudent to give them
consideration. For more information, see the page in this guide on how to assess
the possible impact of risks on your business.

Assess the possible impact of risks on your business

You need to analyse the probability and consequences of crises that could affect
your business. This involves:

z assessing the likelihood of a particular crisis occurring - and its possible

frequency
z determining its possible impact on your operations

This kind of analysis should help you to identify which business functions are
essential to day-to-day business operations. You're likely to conclude that certain
roles within the business - while necessary in normal circumstances - aren't
absolutely critical in a disaster scenario.

Likelihood of risks occurring

It can help to grade the probability of a particular crisis occurring, perhaps on a

numerical scale or as high, medium or low.

This will help you to decide your business' attitude towards each risk. You may
decide to do nothing about a low-probability crisis - although remember that it
could still be highly damaging to your business if it occurred, eg a terrorist
attack.

Potential impact of a crisis

To determine the possible impact of a crisis on your business, it can be helpful to

think of some of the worst possible scenarios and how they might prove
debilitating for the business.

For instance, how could you access data on your customers and suppliers if
computer equipment was stolen or damaged by a flood? Where would the
business operate from if your premises were destroyed by fire?

It's essential to look at risks from the perspective of your customers. Consider
how they'd be affected by each potential crisis. Would they be likely to look for
alternative suppliers?

Consider whether you would be able to keep to service-level agreements

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 4 of 9

(SLAs) if a particular crisis occurred - and what the consequences might be if

you couldn't. For further information on SLAs, see our guide on how to manage
your suppliers.

Minimise the potential impact of crises

Once you've identified the key risks your business faces, you need to take steps
to protect your business functions against them.

Premises

Good electrical and gas safety could help protect premises against fire. Installing
fire and burglar alarms also makes sense.

Think what you would do in an emergency if your premises couldn't be used. For
example, you might suggest an arrangement with another local business to share
premises temporarily if a crisis affected either of you.

You may consider using a business continuity supplier, which can make
alternative premises available at short notice. But this can be expensive.

Equipment/machinery

If you use vital pieces of equipment, you may want to cover them with
maintenance plans guaranteeing a fast emergency call-out.

IT and communications

Installing anti-virus software, backing up data and ensuring the right

maintenance agreements are in place can all help protect your IT systems. You
might also consider paying an IT company to regularly back up your data offsite
on a secure server.

For more information, see our guide on how to keep your systems and data
secure.

Printing out copies of your customer database can be a good way of ensuring you
can still contact customers if your IT system fails.

People

Try to ensure you're not dependent on a few staff for key skills by getting them
to train other people.

Consider whether you could get temporary cover from a recruitment agency if
illness left you without several key members of staff. And take health and safety

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 5 of 9

seriously to reduce the risk of staff injuries.

Insurance

Insurance forms a central part of an effective risk-management strategy. For

more information see our guides on how to insure your business and assets -
general insurances and how to insure your business - people, life and health.

Plan how you'll deal with an emergency

You should draw up a business continuity plan setting out in writing how you
will cope if a crisis does occur.

It should detail:

z the key business functions you need to get operating as quickly as possible
and the resources you'll need to do so
z the roles of individuals in the emergency

Making the most of the first hour after an emergency occurs is essential in
minimising the impact. As a result, your plan needs to explain the immediate
actions to be taken.

Consider whether you'll need to give staff specific training to enable them to
fulfil their responsibilities in an emergency situation. Ensure all employees are
aware of what they have to do.

Arranging the plan in the form of checklists can be a good way to make sure that
key steps are followed.

Include contact details for those you're likely to have to notify in an emergency
such as the emergency services, insurers, the local council, customers, suppliers,
utility companies and neighbouring businesses.

It's also worth including details of service-providers such as glaziers, locksmiths,

plumbers, electricians, and IT specialists. Include maps of your premises' layout
to help emergency services, showing fire escapes, sprinklers and other safety
equipment.

Set out how you'll deal with possible media interest in an incident. Appoint a
single company spokesperson to handle questions and try to be positive in any
statements you issue. Ensure staff, customers and suppliers are informed before
they find out in the media. For more information on handling the media, see our
guide to PR: the basics.

Finally, make sure hard copies of your business continuity plan are lodged at

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 6 of 9

your home and with your bank and at the homes of other key members of staff.

Test your business continuity plan

Once your plan is in place, you'll need to test how well it's likely to perform in the
event of an emergency.

Although by their nature crises are hard to simulate in a rehearsal, you can
assess your plan against a number of possible scenarios in a paper-based
exercise.

Think about the things that would cause most disruption and that are most likely
to happen to your business. Then make sure that your plan covers each of the
risks. Ask yourself the following key questions:

z Does it set out each employee's role in the event of each emergency?
z Have you set out the right steps to take?
z Is the order of the plan correct so that priority actions to minimise damage
will take place immediately after the incident?

Make some telephone calls to check that the key contacts and phone numbers
that you have given are correct. Having to find the right number after a crisis
could use up valuable time.

Keep your plan updated

Remember to update your plan regularly to take into account your business'
changing circumstances.

If you move into new premises, for example, you could face an entirely new set
of risks. You'd need to draw up new maps for the emergency services and amend
any contact numbers necessary.

You should test your plan regularly, even if your business hasn't undergone
significant changes.

Download a guide to business continuity management from the Business

Continuity Institute (BCI) website (PDF) - Opens in a new window.

Here's what I learned about contingency planning after a

disaster

Alison Williams
FDS Group - Opens in a new window

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 7 of 9

Alison's top tips:

z "Turn to your suppliers and contacts for help after a disaster - you'll find
there's a lot of untapped goodwill towards your business."
z "Implement robust backup procedures - particularly for IT systems."
z "Choose a good determined negotiator to work for you - it eases the stressful
process of dealing with insurers and can get you a better settlement."

When arsonists destroyed the head office of Kent-based field marketing agency
FDS Group, chairwoman Alison Williams ensured her 75 employees were re-
housed and the business fully operational within three working days. Here's what
Alison did - and what she learned.

What I learned

People are your biggest asset

"Having a disaster-recovery plan which helped to relocate the entire business

within days sent out a strong, positive signal to our customers. But we still
learned a great deal - especially about the people we work with.

"Our contingency-planning routines meant that our data was backed up off site,
so we knew the data was safe. We made use of our contacts in the local business
community and had two temporary offices to view within 24 hours. We couldn't
make any moves without our insurance company's approval, so our company
secretary was tasked with making sure that a loss adjuster was on site by noon
the day after the fire. When he arrived, we thrust a licence for potential premises
under his nose and got his approval to move in there. He was surprised at this -
but realised we had a business to run and co-operated on this point.

"I've never been so proud of my staff - and suppliers fell out of the woodwork to
help us too. Postmen came round to help us clean up and rescue items after they
had come off duty, delivery drivers kept our parcels safe and Compaq, our IT
supplier, worked alongside our own IT department from Monday night to
Wednesday night non-stop, bar a few snatched naps on the floor."

Engage an insurance assessor

"We found dealing with insurance companies both stressful and time-consuming
as they were not always helpful or co-operative. Once we had an insurance
assessor on our side who knew the ins and outs, we were much more
comfortable. Our assessor was paid a percentage of what we received from the
insurance. But he more than covered his costs in terms of reducing our stress
levels and negotiating a better settlement with the insurers than we could have

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 8 of 9

done."

Clients need to be reassured

"There was no time to dwell on the situation - most of our clients are blue-chip
businesses that demand and deserve continued service no matter what, and our
offices were totally uninhabitable.

"Getting operational as quickly as possible was the best way to reassure our
clients. Having got a fully functioning office, we spent a lot of time making sure
that our customers' confidence in us remained strong. Members of our
management team held several informal meetings with customers to share ideas
and resolve any residual problems. This demonstration of our commitment
showed that we were very much back in business and valued our customer's
needs above everything else."

What I'd do differently

Devote more resources to winning new business

"I would have ensured I allocated more staff working on winning new business in
the period after the fire. Our main priority was to keep the business we had, so
new business development went on the back burner for a few months. As a
result, our profits growth dipped from 35 per cent a year to just 8 per cent in the
year following the fire."

Check insurance levels are adequate

"Generally we were well covered, but only had one year loss-of-earnings cover.
In hindsight, this wasn't enough and it took a lot of work to prove our losses in
one year. We've now got three years - if we had that cover at the time, it would
have taken a lot of the pressure off."

Related guides on businesslink.gov.uk

Use our interactive tool to assess and minimise your IT risks

Keeping your systems and data secure

Insure your business and assets - general insurances

Insure your business - people, life and health

Managing risk

Use our interactive tool to work out which forms of insurance you should have for

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008
Crisis management and business continuity planning | Business Link Page 9 of 9

your business

Diseases, infections and allergies

Here's how I conducted a risk assessment

Related web sites you might find useful

Download a guide to business continuity management from the Business

Continuity Institute website (PDF)
http://www.thebci.org/London%20Firsts.pdf

Download a guide to developing a business continuity plan from the AXA

website (PDF)
http://www.axa4business.co.uk/resources/files/BizContinuityGuideT1404.pdf

Download guidance on IT disaster prevention from the Institute of

Directors website (PDF)
http://www.iod.com/intershoproot/eCS/Store/en/pdfs/IT1DISAS.PDF

Download the five steps to risk assessment from the Health & Safety
Executive website (PDF)
http://www.hse.gov.uk/pubns/indg163.pdf

Read a guide to buying insurance for your business on the AIRMIC

website
http://airmic.com/en/other/document_summary.cfm/docid/1882DD50-5EF6-
4DF8-89FB094A8AB7CE5F

Download a guide to minimising insurance risks from the Institute of

Directors website (PDF)
http://www.iod.com/intershoproot/eCS/Store/en/pdfs/in3min.PDF

You can find this guide on http://www.businesslink.gov.uk by navigating to:

Home > Grow your business > Managing risk > Crisis management and business
continuity planning

© Crown copyright 2007

http://www.businesslink.gov.uk/bdotg/action/printguide?r.l1=1074404796&r.l3=1074458... 10/11/2008