What These Objections Say About Your Lack of Business Continuity Planning

COVID-19 revealed many foundational cracks across all industries, especially when it comes to business continuity planning and enterprise risk management. In March 2020, 12 percent of 1,500 businesses surveyed believed that they were prepared for how the pandemic would affect their businesses. Even more surprising, over a quarter of them thought that the virus would have minimal impact on their businesses.

Fast forward six months, and it's plain to see that the pandemic left no sector unspared. We saw real estate, hospitality, logistics, and consumer durables as just a few of the sectors with so much disruption that companies that had been a part of the landscape for decades folded.

Having a business continuity plan means maintaining some function during major disruptive disasters, including a pandemic. It goes beyond just getting your data back because this is a comprehensive plan that is not limited to disaster recovery. 

The First Two Steps of Your Business Continuity Plan

There are at least two fundamental steps to take when creating a resilience plan for your business. The first is to establish your emergency response team. These are people who will initiate specific mission-critical tasks in the event of an emergency. This committee can include specific supervisors, managers, and even employees if your business is small. 

Secondly, you need to do a business impact analysis, BIA. It will help you identify and quantify the impact of all interruptions and disruptions. Here, you will discuss how this negative situation will impact your business if it continues for three, six, or nine months.

And when we say your business, we don't just mean your employees. We're also talking about your clients and suppliers. Creating a BIA is extensive, and once you see the risks written down, it informs your planning strategies along with goals and objectives, communication, and risk mitigation.

4 Common Objections

Businesses with objections about creating a comprehensive continuity plan speak to a few inaccurate perceptions about what it involves and why it's needed. Some of the most common objections are:

1. "We don't have to worry about that."
2. "My Disaster Recovery Plan is good enough!"
3. "Downtime isn't that expensive…we can handle it."
4. "Oh, our insurance deals with all of that!"

Here's how we break these down. 

1. Objection: "We don't have to worry about that." 

What they probably mean: "We're unsure about the full spectrum of risks to our business and how to address them."

The argument: One of the most dangerous assumptions is that your business already backs up your data as a part of its business continuity plan. In 2019, ransomware, a cyberattack type in which hackers take your data hostage for a fee in untraceable cryptocurrency, hit 15.4 percent of government institutions. In 2020, their attention turned to small and medium businesses. Over 85 percent of managed service providers reported increased ransomware attacks against SME's, predicting it will worsen. 

For those who choose to pay, the likelihood of being hit again increases, because they see you as a ripe target. Even if you have your data backed up, how will you handle the infrastructure recovery process? This forensic investigation can go on for weeks and your company will have to pay for that.

Along with that, there are hardware and software costs, in addition to employee training. In many cases, the downtime caused by a ransomware attack costs a company far more than the ransom itself. This is one of the reasons why a comprehensive business continuity plan with detailed mitigation and recovery steps in place involves more than having regular back-ups.  

2. Objection: "My Disaster Recovery Plan is good enough!"

What they probably mean: "We put a lot of time and money into developing this plan and don't see how another plan would work better."

The argument: Disaster recovery is all about getting your computer systems up and running, while business continuity involves keeping your business going as smoothly as possible so hardly anyone suspects how hard you've been impacted. It's also about minimizing the tangible and intangible losses that come with the disaster and recovery.

Let's take a common natural disaster scenario, such as a hurricane. Damaging rains and winds can completely devastate small businesses. Rising waters introduce infrastructure and health risks that go beyond damage to computers and servers. The hazards of mold and potential building collapse are also part of the equation for which all business owners need a plan. 

In the case of a hurricane, identifying and implementing emergency contact procedures, renting temporary office space, or even executing a remote worker strategy until your business and local employees figure things out is key to your recovery strategy. For example, if half of your local employees don't have the means to communicate much less travel to work, can the other half pick up the slack, or will you need to employ temporary remote staff to help you keep it together? Can you and your staff even get back into your original location? Is it salvageable and safe? 

These are the types of questions disaster recovery plans can't fully answer without integrating continuity. If you're doing regular data back-ups that will mitigate that data loss, that's great. But when was the last time you tested this to make sure that your back-ups work or were complete? Testing the redundancy measures and upgrading procedures in your recovery plan ensures that employees know what to expect, and your customers never know your business had a problem. 

3. Objection: "Our downtime isn't that expensive...we can handle it."

What they probably mean: "We haven't taken into account the full value of our business."

The argument: One of the starkest reminders of how much downtime costs a business, look at the airline industry. For any of the top carriers, those planes cost hundreds of millions every day they are grounded. That cost doesn't just include fuel but also customer refunds, worker salaries, and leases, if applicable. Any business that wants to understand whether they can handle the downtime, needs to do the math. 

One of the simplest ways to quantify how much your downtime costs is with this formula:

Cost of Downtime = (Number of Impacted Employees) * (Productivity Factor %) * (Average hourly salary)

Say you're running a small business with just five employees, you included, and you were completely down. If your average hourly salary is a modest $25, that means downtime costs you:

5 (employees) x 1(100 percent for complete downtime) x $25(per hour) = $125 per hour

This means your business is losing $3,000 per day. 

Can you afford to lose $3,000 per day? There aren't many small businesses that can afford to hemorrhage that much for a prolonged period. That number makes a case for allotting between 5 and 10 percent of your business' annual budget towards continuity planning.

4. Objection: "Oh, our insurance deals with all of that!"

What they probably mean: "We've paid a lot of money for this policy, but we're not sure what it covers or how much we'll get. We know we'll get something."

The argument: Business continuity insurance, also called interruption insurance, is an integral part of your continuity plan. Its goal is to make the business whole, so to speak. It can restore finances to the point they were before the loss and can include repair or replacement. It can facilitate some continuity while you try to get things going, but it has its limitations. It covers a good amount of monetary lifelines, depending on the coverage you get, but it doesn't usually cover asset sales profits or investment payments. If you have a disaster, you are obligated to cover all of that.

Another complication arises for businesses with inventory. While you may have some coverage, how you fill the gaps and minimize turnover for material that isn't covered requires extra planning. Additionally, if multiple locations containing inventory are damaged at the same time, adjusting those claims can be complex and time-consuming, resulting in delayed payments.

Business insurance supports your business continuity plan; it doesn't replace it. As a business, you'll still have to deal with the ripple effect of the disaster your business is facing, including unfulfilled client expectations, potential missed market opportunities, and stalled objectives. 

Business continuity planning is a strategy that makes the risks feel less harrowing and affords businesses peace of mind. It can also instill confidence in your brand and mitigate damage to your reputation among clients, suppliers, and creditors. Doing a comprehensive business continuity plan puts more power in your hands, and that's what Agility Recovery is all about. We provide the means for planning, testing, and training your team to be more aware of the threats so they can eliminate them.