Risk assessment and contingency planning

It has been a challenging and eventful three years for UK businesses with a series of high-profile incidents highlighting how situations can change suddenly and often without warning.

From the continued pressure of uncertainty relating to Brexit, terrorism, fire, extreme weather and cyber-attacks, how would your business cope if it was affected by something similar?

Would your staff know what to do? Would the business be able to keep trading? And what about smaller events, like your biggest customer suddenly switching to a competitor or multiple staff experiencing sickness issues?

If you do not already know the answer to these questions, then it’s time to start building a contingency plan for your business.

Many small businesses are heavily reliant on key personnel, often the owner-manager, and it is easy to find yourself in a situation where a lot of the key information exists only in that person’s head. But what would happen if they weren’t there?

Putting in place contingency plans can give you the peace of mind that everything could continue without key personnel, with the added bonus that it should make the business more organised and efficient.

What is a contingency plan?

A contingency plan is a Plan B for your business to follow if an event occurs which could interrupt its day-to-day operations.

The idea of a contingency plan is to enable your business to operate despite the problem, or at least keep the business closed for a minimal amount of time.

It is a key document for every business, regardless of its size, as this plan can make or break your business, should it be needed.

Every business is different and therefore every contingency plan will vary for each business and each type of incident that could affect it.

To be most effective your contingency plan should be simple, easy to follow and communicated to everyone in your team.

Creating a contingency plan

Start by putting together an operational guide for your business, outlining everything you would need to know to keep it running, such as who your suppliers are, how and when they are paid, and everything else that happens on a daily, weekly or monthly basis.

As part of the same process, not only outline the roles and responsibilities of every key member of staff, but document the daily and weekly tasks so a replacement could assume those responsibilities quickly. You should also assess how long it could take to have each individual operation up and running again should it get shut down.

Having everything documented builds a much greater awareness of roles and responsibilities within the business. It also doubles up as a handbook for new members of staff coming in, ensuring your processes remain consistent in the event of any disruption.

It’s also wise to keep copies off site as well as in the office in case your premises are inaccessible for any reason when you need it.

Assess your risks

Start by focusing on identifying the risks that are most likely to affect your business.

Ask yourself three questions: What could happen? What is the most suitable response on your part? And what are you going to do to prepare yourself and your business?

There’s not much value in preparing for events which are very unlikely to happen, so it is important to prioritise your risks.

For example, you may have listed earthquakes as a possible risk but if the business doesn’t operate on or near a tectonic plate, it would not be productive to focus all your time preparing for such an event.

It’s likely the biggest issues your business will face will be the internet going down, being hit by a cyber-attack or a large proportion of your work force being unable to get into work.

To determine which risks are more likely to occur, you could use a risk impact or probability chart.

These charts are useful in helping estimate the likelihood that an event will occur and therefore where to focus your efforts.

Minimising those risks

Once you have assessed all of the risks to your business and put them in order of priority, it’s time to put together a plan to mitigate those risks.

You could also create a list of ways to minimise the risk of these events occurring and take action to put any safeguards in place at the same time.

Any plan should include a step-by-step guide that outlines what to do once the event has happened and how to keep your business running. The plan should:

• include a list of everyone, both inside and outside of the organisation, who needs to be contacted should the event occur, along with up-to-date contact information for those people.
• consider the likely progression of events, in terms of how you would communicate to staff and customers, whether via the website, social media, or email.
• run through the absolute essentials you would need to keep operating, even if it is at a limited level.

The internet is vital to what most modern businesses do, and if this is the case for your business then considering how you would cope with a cyber-attack, data breach or ransomware attack should be high on your list of priorities.

Keeping multiple backups in place in case your normal supplier went down, backing up company data every day and ensuring copies are kept off site are the minimum safeguards your business should be putting in place. Alternatively, keeping files stored in the cloud will ensure they can always be accessed from any location.

Another important but simple contingency plan for the internet is ensuring every single member of your staff knows the basics of where the router is, how to restart it, who your supplier is and what their contact number is.

If there are any issues, this should ensure anyone in the business can work on restoring your connection and minimising any downtime disruption.

Maintaining the plan

Even after you have created a contingency plan for your business, the process doesn’t stop there.

The success of the plan will depend on everyone understanding their role and responsibilities should the plan need to be activated.

Reviewing your plan frequently will ensure it does not become out of date for personnel, operational and technological changes which can quickly make the plan inadequate.

It’s also very important that you communicate the plan to everyone within your business and who could potentially be affected by it.

Ensure that you have made all your employees aware of its existence as well as its location, and store it where it is easily accessible.

Nobody likes to think about being hit by something that could jeopardise their business, but it’s critical to your business’s survival that you do so. And once you have a plan in place, you can rest assured you are prepared for whatever the world throws at you.

For further information on Risk Assessment and Contingency Planning, please contact Michaela Johns on 023 8046 1256.