Monthly Archives: April 2017

How much does business resilience cost?

How Much Does Business Resilience Cost?

If you are reading this you probably know you need to do something to understand the risks your company faces and want an idea of the costs you might expect to make your company more resilient.

If you are just reading out of curiosity you may wish to bear in mind that companies who haven’t invested in their resilience are more likely to fail when some adverse event takes place. 

Resilient companies also see improved systems of work because they have looked at and mitigated the risks.

The business in ashes.

Business Resilience isn’t just a new name for Business Continuity, it is much more than that.

Business Continuity is still important but technology means that a lot of the traditional risks such as loss of premises when your team can work remotely are not as serious as they once were.

Business Resilience is about looking more holistically at the risks faced by your company and working out ways of removing or mitigating them.  It covers Business Continuity, Cyber Security, Crisis Management, Disaster Recovery and a whole host of other areas that were traditionally separated, often in silos, which is never good.

Finding a Business Resilience practitioner can be more difficult than finding niche specialists but it’s no more expensive.

When it comes to the cost of hiring a consultant or employing a business resilience specialist you probably won’t be surprised if I said, ‘it depends’ but read on and I will give you some useful information that might help you make some important decisions to improve your businesses resilience.

Building a resilient business is an ongoing set of processes and it depends on where you are now and where you need to be. 

Are you just starting out or are you an established company that is expanding and now needs to think a bit more strategically about how you will survive if something untoward happens?

Do you need to have ISO accreditation or do you just want to make sure your processes are robust and resilient?

Do you just want a Crisis Management Plan because social media is outstripping your ability to respond to criticism or high profile incidents?

So, I have put together a list of things you might need to do and I will give you an idea of what they might cost if you employed a consultant to help you.

The caveat is that these are estimates. If you want me or any other consultant to do any work for you make sure you have a discussion and a clear idea on costs and the scope of the project before the work is started.

I won’t do any work unless I have agreed exactly who was doing what for whom. That way we will all avoid misunderstandings.

Some of the things you need to consider when making your business more resilient will include:

  • Business Impact Analysis (BIA) –

A BIA looks at your business operations and assesses the potential effect of a disruption.

The BIA can be conducted at operational, tactical or strategic levels.

How much this will cost depends on the size and complexity of the business but for an operational level assessment for a small business with a limited number of products or services you are probably looking at around £3-400. At the other end of the spectrum, it will cost thousands.

  • Threat Mitigation Measures –

The BIA will identify risks, some of which may be easily mitigated by redesigning the process but for others, it will be necessary to develop some intervention measures.

This stage is about improving the resilience of your company and may take some time. I wouldn’t like to guess how much that might cost because it is very much a piece of work that needs collaborative working between your team and the consultant.

Consultants would charge somewhere between £400 & £800 a day but your team may well be able to do much of the work with some guidance.

It may take a day or it may take some weeks or months off and on. It really depends on the complexity of the business.

  • Developing an Incident Response Structure –

If you have an incident you are going to have to manage it.

I have a wealth of experience in incident response so I am well placed to help you.

If your company is small then I can probably develop a structure for about £300. Again, if your company is more complex it will cost more but shouldn’t be much more than £1000.

Once your structure is decided though you will need to train the team members in their role and develop the plan in the light of the training and exercising experience. This will obviously add to the costs.

  • Business Continuity Plan (BCP) –

A BCP can be a complex beast, depending on the complexity of the business and what you are trying to manage.

It could be made up of several sections covering such things as incident response, media response, major hazards, disaster recovery, cybersecurity, continuity of supply etc.

Clearly, with such a huge scope it would be very difficult to give you a cost but the cost of each of those parts may start at around £3-400, again, depending on complexity.

  • Plan Validation –

Once you have your plans in place you will need to validate them.

This will involve training staff and exercise the plans.

You will need to do this regularly so that everyone knows what their role is and so that you can be sure that the plan will actually work.

Again, it’s really going to depend on the scope of the training and exercising.

While you may be able to do the training in-house it is advisable to have someone independent doing the exercising.

I have a great deal of experience in all levels of training and exercising ranging from a short table-top walk through to full-blown multi-agency live play exercises. The former will cost you around £500 and the latter will cost much more.

  • Crisis Management Plan (CMP) –

A CMP forms a distinct part of the BCP and deals with the mechanics of how you will manage a disruptive event.

It’s about communication, internal and external with the public, shareholders, suppliers, and customers.

It’s about how you will put together teams to respond effectively to protect life, reputation and the ability to continue or recover operations.

A CMP has many parts, depending on the complexity of the company but a basic plan will cost around £1200 for a small company.

Hopefully, this has given you an idea of what costs might be involved to make your business more resilient. You could employ someone as a member of staff, which will cost the business around £80,000 – 90,000 per annum. Alternatively, you could use a consultant, allowing you to manage your costs and without the attendant expense of having an employee.  I will write a blog on how to choose a Business Resilience Specialist later so please sign up to regular emails to make sure you don’t miss out.

If you are unsure what you need but know you need something (and why would you have read all the way to the end of this post if you didn’t) please get in touch and I will do what I can to help.


What’s the worst thing that can happen to my business?

Category : Uncategorised

What is the worst thing that can happen to my business?

Someone I was working with recently voiced this question and said that he had googled it. So I thought I would write something about it but not in the way you would normally expect a resilience professional to write.

As professionals we talk about Business Impact Analysis, Maximum Acceptable Outage, Maximum Tolerable Period of Disruption and a whole host of other terms. These are of course necessary for us to work effectively but the language we use is sometimes a bit sterile and it could be easy to forget for a while that business resilience is about people, not just documentation.

People are what resilience is all about. It is people who make things happen and we sometimes forget when we are doing the paperwork and plans and checklists that it is people who are affected, often  emotionally when the worst thing that can happen, happens. It is people who invest not just their cash and time but a large part of themselves in their business.

The Upcycled Timber Co.

I was aware that The Upcycled Timber Company based in Lochgelly and owned by Catherine Fotheringham had recently suffered a fire that destroyed the premises.  So I asked Catherine if she would be good enough to share her personal experience so we can get a feel for the human side.

 

This is what Catherine wanted to share with you:

What is the worst thing that can happen to your business?  I’m sure off the top of your head you can think of a few things including your business premises having a fire.  Imagine that, one day everything is ticking along nicely and the next day your business, livelihood and passion is in watery, ashy ruins.  Can you imagine that or does it fill you with so much dread that you won’t even let yourself contemplate it?  If that’s the case, you need to get your head out of the sand and prepare that the worst could just happen to you.

The business in ashes.

The business in ashes.

It happened to me and it is literally one of the worst days of my life.  Let me explain a bit about my business.  I own The Upcycled Timber Co. where we hand make furniture and accessories from reclaimed timber including scaffolding boards and whisky barrels.  All that wood!!  I employ one Joiner to make the products and I do everything else.  Our business was closed for the Christmas and New Year period and we’d just started back on Monday 9th January 2017.  I was the last to leave that day and I checked everything was shut down before I left.  All doors were closed and everything that could be was switched off at the walls.  The next morning I got a call from my Joiner at 8am that the Fire Brigade were sitting outside our workshop.  I rushed there as quickly as I could and was met by four fire engines, two at the front and two at the rear of the building.  All were dealing with the fire that had been burning most of the night and the devastation was incomprehensible.  I sincerely hope that you never have to comprehend what it must be like.  So what caused the fire?  A lithium battery in the workshop radio.  It wasn’t plugged in or switched on but a freak accident meant that it started smouldering and burnt its way through the workbench and then through the ready supply of whisky barrel staves that were stocked behind the bench.  It made its way through a wall into my office/showroom and everything was ruined, either by the fire, smoke or water from the hoses.  It was a freak accident, nothing I could have done could have changed the fire happening.  I think that is the scariest part.  Thankfully no one was hurt and the businesses either side of my workshop weren’t affected.

So what do you do when this happens?  For me it was to phone my husband as the fire was being dealt with.  Then once everyone left it was to secure the building and phone my Insurance Broker and Landlord.  I had contents insurance but my Landlord was responsible for the buildings insurance which was included in my rent each month.

The insurance process was relatively straight forward but it did take a while.  Quite quickly the Loss Adjuster came out to determine the extent of damage and deemed it a total loss, I would be paid out the full amount for stock, materials, tools and machinery and IT equipment.  It was clear though that I was slightly under insured.  As a small business that had been going for just over a year, the policy that I had started with was more than enough at the beginning but as we grew organically, it soon wasn’t enough and we hadn’t realised this.

The Loss Adjuster did request that a Forensic Fire Investigator come out to conduct their own investigation to the cause as part of the insurance claim.  Seemingly this is quite common and the main reason is to see if they can sue the manufacturer of the cause of the fire, in our case the lithium battery manufacturer.  The forensic fire investigation wasn’t quite so smooth emotionally for me.  For the first time since the fire I felt like maybe I had done something wrong.  Lots of questions were fired at me, some of them I just couldn’t understand what they had to do with the fire but were about different aspects of how I ran my business.  It took a full day for two investigators to go through everything and they wouldn’t tell me anything, it wasn’t until they submitted their report to the Loss Adjustor that it was clear that they agreed it was the lithium battery but that was a very tense time.

During this time I had to alert my customers to the fact that the fire had happened and their orders were affected.  I emailed everyone separately and offered either a full refund or asked if they’d be willing to wait, not yet knowing when I would be set up again.  I was very fortunate that the majority of my customers were willing to wait and I only had to refund a small amount.  I also had to inform my suppliers and stockists but thankfully it didn’t adversely affect them.  I made sure that I kept in contact with everyone on a regular basis as to the progress and the messages of support really helped.

How long would it take to get trading again?  Because it was a total loss the workshop had to be emptied of the fire damaged contents and taken back to a shell.  With estimates of anything from 3-9 months before it would be habitable again because of asbestos concrete roofing, I had to secure new premises.  In all, from the date of the fire until the date I moved into new premises it took six and a half weeks and that included the insurance claim being paid out.  That might not sound like a long time but when it’s happening to you, it feels like forever.

Emotionally it was a roller coaster and it felt like a bereavement.  Every time I had to go back to my old workshop to meet someone about the insurance process or start to clear out the fire damaged contents it would set me back again.  I seriously considered packing it all in and walking away, it was such a horrendous time.  It was scary, emotional and boring.  Waiting on decisions being made and payments being released was incredibly boring.

It was a huge task to kit out a new workshop again with new tools, machinery, stock etc and I underestimated how big a task it would be.  Regarding IT, I had everything saved to the cloud so this was hugely important in being able to contact customers, stockists, suppliers, update my website, write blogs as it was happening, share on my social media channels, sort out all the financials and keep track of new purchases.  Without access to all of my administration, sales and marketing information then I can’t even imagine how much worse the whole thing would have been.

Where am I now?  I’m in new premises and trading again.  The whole fire saga feels surreal and like it happened to someone else.  It’s taken a while to get up and running again and get outstanding orders out, we’re still not quite there but have very patient and understanding customers.

Rising from the ashes.

What you should take away from my experience is this:

  • Ensure you’re fully covered with your insurance policy. Keep a list of all your equipment as it is bought and its value, and regularly ensure that your insurance policy is still adequate in terms of cover
  • Back up data to the cloud
  • Keep your customers, suppliers and stockists up to date, it may surprise you how great people can be if they’re kept informed. It will also help protect your reputation
  • Make sure you’re legally covered with an up to date fire risk assessment

 

 


Haulage Industry Crisis Management Plan – How to write one.

Category : Uncategorised

Haulage Industry Crisis Management Plan

crisis ahead road signEstimated reading time 4 – 5 minutes.

In a recent blog, I spoke about how a haulier’s reputation is vulnerable when a high-profile event happens with one of your vehicles. In this blog, I thought I would expand on that and give you some information on developing a Crisis Management Plan and what should be in it.

The first question to address of course is what do I mean by a Crisis Management Plan?
Basically, it should be the document you use whenever a crisis occurs. It should be written with a generic response in mind, not a specific scenario. If you write for a specific scenario you will come unstuck because the crisis you next find yourself in won’t be what you had imagined when writing the plan.

There is a British Standard (BS11200:2014 Crisis management – Guidance and good practice) that gives some guidance on what a plan should contain. Adding my years of experience, I recommend that your plan considers the following headlines.

At the start, it really needs to have a triggering mechanism detailing who and when the crisis management plan should be activated. Do you allow the duty supervisor to trigger it or does he or she have to inform a manager or director? Whatever you come up with needs to suit the structure of your company.

Contact details for key contacts need to be clear. If the MD or General Manager is to be informed (and he or she should be) how are you going to contact him or her?

The plan needs to make clear who is responsible for what. It will depend again on the size and shape of the company but things you may want to consider are who is going to lead the Crisis Management Team. If the company is big enough you may want to give the CMT team leaders role to a suitable director or senior manager who will be responsible for managing the situation and recovery. The MD or General Manager may be better employed facing the media to talk for the company at the highest level.

About media, I cannot over emphasis how important a media plan is to a successful outcome. If you get the media wrong it could be extremely damaging to the company’s reputation. The media response part of the plan needs to detail who is going to say what. It needs to have a planned response to social media and someone dedicated to dealing with it. It is no good waiting until the event has happened to think about how you are going to handle your communications. Things will be more emotionally charged and that isn’t a great way to decide what you are going to say. Once the incident has happened you have minutes, not hours, to respond appropriately so you need to be ahead of the game and have your responses pre-prepared. There is a lot more to say about handling the media but I will leave that for another blog.

Checklists, set agendas and situation report formats that everyone is trained to use will ease the flow of information inside the company. Don’t forget to keep a log, when the enquiry comes having a log of who made what decisions and why will be critical, especially if the enquiry is an external one where prosecutions may be likely.

Once you have written your carefully crafted plan you do of course must ensure that everyone in the organisation knows of its existence and where they fit within it. In short it needs to be embedded, practiced and refined.

I have seen plans that people thought would work but have collapsed under even the most basic testing. The key here is to involve the people who will make the plan work and above all else, to test it, even if it’s a walk through the plan in the office. You will then need to refine it considering the lessons learned because no one can write a plan that will be perfect first time round. Once you have a plan that is workable you should exercise it more widely and involve staff in the exercise so they can use the opportunity as a training tool.

You will have to adapt the plan to suit your company’s structure and culture. What I have written here is generic advice you should consider including. There will be a lot more detail in your finished plan.

Once have a plan don’t forget to revisit it from time to time and when something in the company changes and remember to exercise it regularly.

Of course, if you feel that writing  a Crisis Management Plan isn’t the best use of your time or skills I can help you develop a plan that suits your company. I don’t do off the shelf plans. I will work with you and your team to produce a plan that works for you. Just get in touch and we can discuss your requirements.

How much will it cost you ask? The honest answer is that it depends but you expected me to say that. It depends on the size and complexity of your company and it depends on how much, if any of the training and exercising you want me to do. We can discuss what your requirements are and I will be able to provide you with a cost before you decide.