Business Continuity

19 December 2007

The floods earlier this year which affected businesses and homes across a wide area of the UK have served as a timely reminder of the need to have made adequate preparations for when disaster strikes. If you are trapped in your home by rising flood water, how do you service your clients? If your client is flooded out, will you still have a client to service when the floods recede?

This is the second of a series of short articles in which Stephen Graham-Weall, IIM Operations Director, looks at the issues involved in ensuring business continuity.

PART II - IDENTIFYING THE THREATS TO YOUR BUSINESS

Research shows that 80% of businesses affected by major incidents fail within 18 months.

Part I of this series explained that planning is the key to becoming one of the 20% which survive.

Because of the wide range of threats to our businesses, we have to be realistic about those which we can control and then prioritise those which we need to plan for, so spend a few minutes a day over several days jotting down the threats you and /or your key team members think may affect your business.

Once this is complete (eg you are struggling to think of any more threats), tidy up the list and discard those threats that are outside your control, such as nuclear war, and those where you can only marginally influence the outcome, such as voting in elections. Now you should have a list of threats to your business which you can influence; this is still likely to be a daunting list, so it will be necessary to break it into manageable chunks by prioritising the risks.

This is done by quantifying the probability and the impact of each threat so that they can be prioritised. For example, the probability of flooding is higher for a business on a river bank than for one on a hill top, but the impact on the two businesses would be the same. The next step is to quantify them by giving values to the probability and impact; in our example the probability of flooding for the riverside business would be 5 (on a scale of 1 to 5 with 5 as highest) and 1 for the hill top site. Using a similar scale for the impact on both businesses, say 2, and multiplying the values together gives 5 X 2 = 10 and 1 X 2 = 2, clearly showing that addressing the flood risk is more important for the riverside business.

Quantifying the probability and impact of threats is not a precise science, and fortunately doesn’t need to be for most businesses. What is important are the relative priorities. The values in the example have to differ by a lot to change the evaluation enough to change the priority, and experience has shown that the consensus of the assessments of the key members of the business is a remarkably accurate indicator.

The next stage in the process is to sort the list of threats into numerical order, ready for the next steps, mitigating the risks and developing action plans.

If you are concerned about the work involved in this process, remind yourself of the unexpected and unplanned work that will be essential if the serious threats materialise.

Next Newsletter:

Part III - Mitigating the Threats to your Business