Five golden rules of small business continuity

The Business Continuity Institute (BCI) has kindly informed me that the annual Business Continuity Awareness Week 2011 is due to take place from 21 to 25 March. It’s a global event designed to educate business about, and spread awareness of, business continuity issues. Given that it’s an annual event and I haven’t heard of it before, despite being an IT journalist with 20 years under my belt, it’s not a good start.

Not that I’m a huge fan of this sort of thing. Designated weeks or months for a specific activity, I mean – being a small business owner myself I am actually quite keen on business continuity. You only have to take a look at some of the events that Business Continuity Awareness Week shares March 2011 with to see what I mean: Brain Awareness Week, National Peanut Month, National Frozen Food Month, National Bed Month and my personal favourite, National Bubble Week.

But seriously, shouldn’t every business be aware of continuity issues every week of the year?

I have absolutely no statistical evidence to back up (ding! business continuity pun number one) my theory that awareness weeks have no long-term,  positive impact whatsoever on keeping businesses running when disaster strikes. However, that’s OK as I have yet to see any such evidence from the awareness camp to prove the opposite either.

Not that a short sharp shock is always futile, but that’s where consultants come in and the shock needs to be highly targeted to be effective. The organisers of Business Continuity Awareness Week have targeted businessmen by, amongst other things, producing something called BC24. This is an online multiplayer incident simulation game designed to test the skills of crisis-management teams around the world, and includes a live leaderboard for a bit of a competitive element.

I’d rather take the Jon Honeyball approach and go directly after the man with the money and influence with a chainsaw

It’s a bit of fun with a serious message and there’s nothing wrong with that, but the entire awareness week approach to business continuity strikes me as firing grapeshot at the audience and hoping a few people get hit. Forget simulations and games, I’d rather take the Jon Honeyball approach and go directly after the man with the money and influence with a chainsaw.

I still recall with a smile the account of PC Pro’s own Jon Honeyball testing how well one business would cope with a server going down by pulling out a chainsaw in the server room in front of a suddenly less confident IT director. As Jon said “the purpose was to unseat the IT director, to put him well outside his comfort zone. He wasn’t able to think fast enough, to remain calm and in control when put in an unfamiliar and high pressure space”. And that’s the difference between real life and simulation: comfort.

It’s not that I think the whole awareness week concept is pointless, it’s just somewhat misguided. If 2011 was Business Continuity Awareness Year then I’d be a lot more positive about it, as small businesses are feeling the economic pinch. With cash flow often so precariously balanced that it really doesn’t take much disruption to send it plummeting off the precipice and never return, the small business sector has to take business continuity seriously every day of the week. Unfortunately, with day-to-day survival often the main focus at the smallest end of the small business scale, persuading someone to invest time and money in something that may, or may not, happen at some point in the future is a hard sell.

I have sat opposite the owner of a business with a handful of employees who was paying me for data security advice who, when I happened to note that he really could do with even the most basic of business continuity plans, stared at me as if I was mad.

His reasoned, if totally unreasonable, response was that in ten years of running his business, tech disaster had never struck, so why should it in the future? Anyway, the chap insisted, if it did he would just buy new kit, reinstall his software and work from his last data backup.

And when was his last data backup, I enquired? Turns out that would be some three months ago, as he had been too busy of late. Turns out he hadn’t factored disruption to his business while he sourced the new computers, installed the new software, got his records up to date, and got the business back up and running. Assuming his business survived being offline and out of the loop for a few days or a week, of course.

The truth is that business continuity isn’t just a matter of making backups, it’s a matter of making plans and it’s a matter of having the right mindset in order to survive a worst-case business disaster. I like to give a client a sheet of paper and get them to write down, step by step, what they would do given a couple of ‘what if’ examples covering the small disaster (computer dies, server goes down, data gets corrupted or lost etc) to the really big ones (the fire and flood scenario) and then compare notes. It is clear that most would not survive a major disaster and even the smallest of business interruptions could prove costly.

With that in mind, here are my top tips for getting started with small business continuity planning:

1. Think about it

Analyse what your business needs to do in order to keep working, and how various disaster scenarios would impact upon that ability. This means getting really objective about which systems are actually business critical.

2. Plan for it

Calculate everything from the bare bones approach (I need to do this to keep afloat, albeit at a reduced work rate) to business as usual (what do I need to do to ensure there is absolutely minimal interruption to my business?) and determine which is the most realistic for your circumstances. Sometimes, especially at the smaller end of the business scale, the cost of implementing a fully blown business-as-usual plan would be just as damaging as doing nothing.

3. Tell your staff about it

A business continuity plan is not a top secret document and should not be treated like one, although all too often it is shared by the boss and the IT guy (often one and the same, of course, which makes thing worse). Make sure all your staff know what their roles are in the event of a disaster, what you expect of them and how they can help ensure they still have jobs at the end of it. Headless chickens are not at all helpful when the lights go out.

4. Test it

This one is really difficult to get across, often seen not only as a waste of time but one that the smaller business simply cannot afford. However, just as a data backup is useless if it cannot be restored properly, the same applies to a business continuity plan that has a logistical flaw which appears when it is put into action for the first time. Think of testing as an insurance premium: you only begrudge the cost until you need to make a claim.

5. Keep it updated

And finally, successful business continuity planning is dynamic in nature. Using the insurance premium analogy again, just as you will increase the cover you pay for as your business liabilities change, so your continuity planning needs to accommodate changes and growth in your business.