Business continuity for SMEs

When decision-makers of small and medium-sized enterprises (SMEs) come across the terms business continuity and business continuity plan (BCP), they may think that this is a matter for large and multinational companies and SMEs don’t need to be aware of this topic. But in 2022 even a small or medium-sized company need to manage business continuity to be successful in the long term. We have conducted several risk analyses in the past and sometimes wondered why this risk has been on the list at all: “In case of an epidemic or mass illness, most of the workers will not be able to do their job". The recent years have shown that we must be prepared for anything.

Why BCP is important?

Ideally, the business continuity plan will never be needed to be activated in the life of a company, as there are usually no events that would trigger it. Therefore, management tends to forget it completely, or just put it at the end of the to-do list to prepare, test or review the BCP plan. However, if something does happen and the BCP is needed, it is needed urgently and badly. In the event of an incident, taking response measures based on a fresh, regularly reviewed BCP can save the company a lot of money, not to mention the fact that untreated major incidents can put the company’s operations and human lives at risk.
Nowadays, when most business processes are digitalized and data is stored on computers, local servers or in the cloud, everyone is exposed to the availability of IT systems. We take it for granted that we can access our mail or files from anywhere at any time, but have we ever considered what would happen if we couldn't access them for 4 hours? Or even for a week? Could we do our job properly or could we bridge this period? One thing is sure about IT: what can go wrong, will go wrong, and not even mentioning the increasingly common phishing or hacking attacks that are now targeting SMEs too, impacting the availability of their IT services

The process of BCP implementation

We summarize a simple methodology tailored to small and medium-sized enterprises, that can be used to effectively prepare and implement a business continuity plan, even in your own business. The main steps of the process are:

1. 1. 1. Ensure support from senior management.
      2. Identify the key business users for each area who have detailed knowledge of the processes, the systems, services and tools that are used for the business processes in their area.
      3. Interview key business users to understand the processes, identify the systems, services and tools used in the processes, the time tolerance limits built into the business processes and possible workarounds.
      4. Conduct a risk analysis with a list of risks tailored to the company. Each risk is categorised according to 2 dimensions: probability of occurrence and business impact. The combination of the two values results in a rating for each risk including the mitigation and protection measures identified during the interview.
      5. Based on the risk rating we define action plans together with management to reduce the current levels of certain risks in the future if possible. We help to identify scenarios and events that require a business continuity response if they occur.
      6. With the help of business key users, we develop the different scenarios in more detail, including the actions that should be taken, the responsible people for the actions and the communication channels used to reach out to them and to coordinate.
      7. The scenarios we defined in detail are documented in the business continuity plan. It will be finalised and published for employees. together with a quick guide that helps them remember their most important responsibilities.

^{A part of ABTs SME risk analysis methodology}

How can we help?

Our consultants have many years of experience in risk analysis and business continuity, with many successful projects behind them. With our mentioned risk analysis methodology, developed specifically for SMEs, we can support your business continuity processes quickly and efficiently. If you need help with BCP implementation, review or testing, please contact us: ABT Risk & Compliance services.