Disaster recovery planning: Q&A with Hedley Basford
Business consultant Hedley Basford on why it can pay to plan for the worst
Many small firms don’t have a disaster recovery plan, often because they don’t expect the worst to happen or don’t fully appreciate just how hard it is to get operational again following a serious fire, flood, burglary or IT disaster.
According to the Association of British Insurers, 80% of businesses that suffer a major incident fail within 18 months. Canterbury-based management consultant, Hedley Basford, offers advice to small businesses on disaster recovery planning.
Why do so few small businesses have disaster recovery plans?
Hedley Basford (HB): “Most small-business owners are preoccupied with day-to-day operations, I think. They acknowledge their vulnerabilities, but seldom give it the time and attention to address them.”
What disastrous things can happen to a small business?
HB: “A disaster is any event that seriously disrupts normal operation, which can even threaten the survival of the business. That could be a serious fire, flood, burglary, arson, a building collapsing or criminals compromising your IT system. Less severe events can still be highly disruptive and examples might be losing a key customer or staff member, serious supply issues, compliance failures, and critical processes going wrong. Small businesses should identify all such threats and plan for them.”
What is the difference between a disaster recovery plan and a business continuity plan?
HB: “A disaster recovery plan is a formal document the sets out the steps a business needs to take immediately after a disaster, to prevent further damage and become operational again. A business continuity plan refers to the longer process of rebuilding revenues.”
Can small firms be affected by events nearby?
HB: “They can – a fire at neighbouring premises or a house is a good example. I know a company that was located at the end of a cul-de-sac on an industrial estate. It needed to make daily deliveries in the early hours, but one day, a fire at neighbouring premises prevented access. If a proper risk analysis had been done, the company may have moved to other premises.”
Do most business fail following a disaster?
HB: “Sadly, they do. Statistics vary, but the general consensus is that about three quarters of business fail within three years of a disaster, with many failing much sooner or never recovering at all. Failures don’t always happen immediately, often there’s a ‘domino effect’, with things going wrong and gradually sales decline as customers are lost.”
What difference can a disaster recovery plan make?
HB: “A disaster recovery plan deals with the incident and the actions necessary to get the business up and running again. How a disaster is handled in the first few hours can make a big difference to the business’s long-term survival. A good plan will make it easier to manage the disaster. It will, for example, contain contact details of emergency and support services, staff, key customers and suppliers, etc. It will explain the arrangements for alternative premises or temporary plans to work from home, etc.”
How can a small business put together such a plan?
HB: “The first stage involves analysing risk; the second involves taking steps to reduce them. So, stage one, you identify potential risks to your business, assess their likely impact and define maximum downtimes for different circumstances that your business can sustain.”
So, now I have identified the risks, what next?
HB: “You can take steps to eliminate, reduce or mitigate them. Those that cannot be dealt with in this way are ‘residual risks’, and insurance is the only way to deal with these. However, getting paid by an insurance company can take a lot of time and it won’t always prevent business failure. Disaster recovery plans can help businesses to respond to residual risks. The business owner and key employees, guided by an experienced disaster-planning adviser, should work through the process. An adviser can help to produce a documented plan that the business can implement and maintain. You must test, rehearse and keep your plan current if it is to remain useful.”
What other advice do you offer to small businesses?
HB: “You don’t have to develop a disaster recovery plan to the same level of complexity as a large company, it’s not necessary and larger organisations have more people and resources. But you can create a simple but effective disaster recovery plan, as long as they identify the risks and eliminate, reduce or mitigate them, which can often be done for little or no cost. Seek help from an experienced disaster-planning professional. Make sure all team members read and understand your plan, with key people keeping copies at home, in their car or accessible via their mobile phones. All key team members should know exactly what they need to do should something disastrous happen.”