What a Business Continuity Plan Looks Like for a Small Company

Sep 13

Business continuity planning has a branding problem. The phrase suggests thick binders, tabletop exercises and a dedicated risk team, none of which a twenty person company has. So it gets filed under things we will do when we are bigger, and the business carries on hoping nothing happens.

The useful version is much smaller than the name implies. It fits on a few pages and it answers one question. If something we depend on stops working, what do we do in the first twenty four hours.

Start with what would actually stop you

Forget the catalogue of disasters. Most of what disrupts a small business falls into a short list, and you can name it in half an hour.

A system you cannot work without becomes unavailable.
You lose access to your own accounts, through a lockout, a mistake or a compromise.
The one person who knows how something works is suddenly unavailable.
The building is inaccessible, through weather, power or something more ordinary like a burst pipe.
A supplier or vendor you rely on stops delivering.

In South Florida, the weather version is not theoretical, and it comes with several days of notice, which is more than most disruptions give you.

Work out what you have to keep running

Not everything in the business needs to survive day one. Some things can wait a week without anybody noticing.

Go through what the company does and sort it into three piles. What has to keep running within hours, usually taking money, serving existing customers, meeting a contractual obligation. What can pause for a few days. What can wait until things are normal.

This sorting is the whole exercise in miniature. It tells you where to spend your planning time, and it stops the plan from trying to cover everything.

A plan that covers everything gets read once. A plan that covers the three things you cannot be without gets used.

Write down the manual version

For each of the things that has to keep running, answer one question. How would we do this without the usual system.

Sometimes the answer is a paper form and a phone. Sometimes it is a spreadsheet kept offline. Sometimes it is an agreement that orders get taken by email and entered later. None of these are elegant. All of them are better than a team standing around waiting for a status page to change.

Write the manual version down while things are calm, because nobody invents a good workaround under pressure.

Names, not roles

Plans that say the operations team will assess the situation fail immediately, because on the day nobody is sure whether that means them.

Put names against the decisions. Who declares that the plan is in effect. Who talks to customers. Who talks to staff. Who can authorise spending to fix the problem, and up to what amount. Who is the backup for each of those people, because the first name on the list is often the one who is unreachable.

One page with names and mobile numbers is worth more than thirty pages of process.

Sort out the things that fail quietly

A few practical items cause more trouble than they should, and all of them are cheap to fix in advance.

Access to your own accounts. Two people should be able to reach anything critical. Sole administrator accounts held by one person are a common and avoidable single point of failure.
Contact details that live somewhere else. If your staff and customer contact lists only exist inside the system that is down, you cannot tell anyone what is happening.
A copy of the plan that does not need the network. Printed, or on a phone. A continuity plan stored only in the drive you cannot reach is not a plan.
Backups somebody has actually restored. An untested backup is a belief, not a control.

Test it in an hour, not a day

A full exercise is out of reach for most small teams and is not necessary. Sit five people around a table, describe a scenario in two sentences, and walk through the first twenty four hours out loud.

You will find the gaps in the first fifteen minutes. Usually it is a phone number nobody has, a decision with no clear owner, or a manual process that assumes something that is also unavailable. Fix those, and you have already done more than most businesses your size.

Keep it alive

The plan goes stale the moment somebody leaves, a system changes, or a new supplier becomes important. Give it an owner and a review date, twice a year is enough for most companies, and review it after anything that disrupts you, even a small one. The near miss is the cheapest lesson you will get.

This is process and documentation work, which is squarely what we do with clients. Mapping what the business cannot operate without, writing the manual version down, and putting names against the decisions before anyone needs them.

You are not trying to predict what will happen. You are trying to make sure that whatever does happen, the first hour is not spent working out who is in charge.

We work with businesses in Pompano Beach, across South Florida and remotely to write continuity plans people can actually follow. Book a consultation, or visit www.expertechsolution.com.