The latest business continuity news from around the world

Time for change: business continuity for small and medium sized enterprises

Traditional business continuity is not well suited to small and medium sized enterprises (SMEs) says Paul Kudray. In this article, he sets out his vision for creating the 3 A’s of ‘achievable, affordable and available’ resilience for SMEs.

‘All businesses want and need to know, what to do when something goes wrong’. A simple statement that will not create ripples across the resilience profession. But in these ever-challenging times, it’s obvious that existing resilience and business continuity services to the SMEs of the world are not inclusive for all; in fact, they are more exclusive in respect of cost, time and effort.

SMEs, are somewhat frozen out of real access to quality resilience support; my research indicates that despite all the resilience publications, institutions and establishments, most SMEs do not know what business continuity management (BCM) means. Why would they when BCM or organizational resilience (OR) sounds complicated to them?  So, when the big corporate organizations ask challenging questions such as ‘How good is your supply chain?’, they are not necessarily addressing the smaller businesses, because those SMEs do not know where and who, to listen to.

Business resilience leadership

The concerning point for me here is that we are in a liberating era of worldwide resilience where all the big organizations and professionals say the same thing. We want resilience: we need everyone to have it; be resilient. Resilient cities, towns, businesses and economies; resilient communities. That’s what we promote.

However, until now, none of those organizations and professionals have inspired innovation and vision to make a real difference at all levels, not just the easy levels; something new which can truly reach everyone in those business communities and cities. Something that speaks in the right language in respect of time, cost and simplicity. We say we want resilience to be achieved but we only offer an old heavy sledgehammer to crack a nut.

In the resilience profession, today, it is time to show some realism-leadership to offer a new achievable standard for a much wider audience, which still provides quality in respect of time, price and outcome. Achievable, affordable, available resilience for the world’s SMEs is what’s required.

It’s time to change a design flaw in the system and create a new standard baseline level of resilience, if we all truly do want to enable resilient societies.

Go: ‘what you hear is not a test’

I was asked by a fellow professional, ‘was I going to write a business continuity plan (BCP) for my own SME? To practice what I preach, so to speak. My learned colleague appeared confused when I replied, (without any hesitation), no; I would not write a BCP. Why would I?

Of course, BCM is exceptional in concept and principle; it enables a substantial level of resilience to be achieved if applied correctly; especially in complex organizations. But let’s be truthful here; BCM in terms of time, cost and jargon, is expensive and perhaps more controversially, it is too bulky and dated for everyone’s needs; especially for SMEs.

So, what about the SMEs just like me? The everyday high street, local shops and businesses? Where can they go to build a resilient capability when there is only a ‘full fat version’ of BCM available on the shelf of the ‘resilient supermarket’? Today’s SMEs have different dietary, financial and time needs. They need something that suits their requirement but a capability that is achievable, affordable and available (the 3 A’s of modern resilience).

Charlie says…

I grew up in an era when we used to have the benefit of public information messages on television. One of the series included a cartoon character and his cat (called Charlie) and the message of advice always ended with ‘Charlie says’. It was a fun, visual way of ‘educating’ children about the dangers of that time.

A few weeks back on Continuity Central, the well-recognised resilience professional, Charlie Maclean Bristol of Plan B Consulting, wrote an article entitled ‘Is the business continuity planners’ ‘people, premises, resources and suppliers’ (PPRS) list fit for purpose?' Charlie raised some great points because he challenged long standing assumptions to see if they remain viable today.

However, I do not think that it is necessarily the limitations of the PPRS which is the real problem. I believe that the real problem remains the lack of an appropriate (modern day), worldwide, standard level of business resilience, which can be easily understood and communicated between the professionals and the business world. This is the design flaw in our system.

Charlie suggested that risk management might help us come up with a better threat list but I disagree that this is the right solution. I am not dismissing this suggestion, however the real issue (for me) is a question of incentive. Is the motivation and incentive for a business real and appropriate? ‘What is in it for me?’

Think like a business SME, not like a resilience professional. Just saying I (as an SME) can be better prepared for challenges does not totally work in this modern world. The design flaws are the fact there is nothing new, modern and available to the SME to get them started; there is no baseline which can then lead to everything else: the upgrades and higher levels of resilience if they expand or want to move further along the BCM road.

The resilience profession and the big organizations/governments need to offer something more appealing, achievable, affordable. A new standard rather than just keep banging on the (same) old BCM drum.

‘Writing on the wall’

I’m reminded of reading, some years back now, Spencer Johnson’s brilliant ‘Who Moved My Cheese’ and I suggest that if the resilience profession continues to eat and offer the same old cheese, we will fail to  see the writing on the wall and never achieve in full, what we promote for all. “Movement in a new direction helps find new cheese” and remember “we resist changing because we are afraid of change”.

A question of how much and how long?

If anyone knocks on your door and tells you they have something which will help you (like resilience should), we immediately think of the ‘how long’ and ‘how much’ principle. Time is so precious to everyone; and to the SMEs, money is tight.

Institutionalised/corporate BCM is needed and it enables effective organizational resilience, but it requires heavy investment, time and commitment; however, that does not mean that SMEs should be left out in the cold, away from access to available resilience advice, support and guidance. So why, until now, has nothing ever been really made available to the SMEs? SMEs do not need a checklist or the dangle of something which is too far out of their reach; they need a baseline level of what to do if (when) something goes wrong.

What you see is what you get

I have looked at what is available to SMEs in terms of resilience support. There is the full fat creamy BCM; or there is the checklist approach which is exactly what it says (just a checklist) and does not provide a tangible plan of action when something goes wrong. There is also the offer of resilience support from suppliers on a contractual or ad hoc basis and the repetitive lines for the big resilience institutes such as asking the ‘supply chain question’.

But, as mentioned previously, it is fair to say that the SMEs are not listening; do not know who to listen to; do not know where to look; and do not have access to resilience which is affordable and simple to understand.

The elephant in the community

Controversially, it would be easy to say that nothing has been made available to SMEs because there is not a great deal of money in it; that is money to be gained by the profession and investment benefit to the SME. SMEs are never going to pay the price of a top-flight consultant to sort their BCM arrangements at the current levels and equally, neither side has the time to commit to it. So, BCM for the SME market gets left as an ‘elephant in the community’ (not the room).

We know that on average, SMEs do not have quality levels of resilience (if at all) yet there is dismay and discord when SMEs become vulnerable and go out of business when a challenge occurs. But did we truly do enough to help them? What did we offer them? Full fat versions and complex ISOs only? Look in the mirror; is it their fault, ours, or both?

The SME ‘de-resilient’ business triangle – (business, bank, insurance)

An SME needs a business bank; the business bank needs the SME to stay in business so the bank makes money. The insurance companies need the SME to purchase their insurance to cover the business. The SME needs the insurance and the whole triangle is connected. But not necessarily in a truly resilient way.

For example, if you decide today that you want to develop and become a business, the business bank manager will ask for your financial forecast projections and this becomes your so called ‘business plan’. Great, if all goes well, here’s your business account number, debit card and, if you asked for a loan, fingers crossed, it’s on its way!

But wait a minute; why doesn’t the modern forward thinking business bank and the insurance company ask about how resilient you will be to a challenging event? Why, in this day and age, is resilience not a ‘due diligence’ question to ask and seek on a SMEs business plan? Why can it not be on a par with how you will be able to repay the business loan? How resilient will you be to some basic challenges ahead? How will you stay in business if the flood happens for example? (Other disasters are also available!)

My suspicions as to why this is not the case is because no one has raised or addressed the question before with any real conviction, support or drive to make it happen, especially from those very big institutes and the SMEs themselves.

This makes me wonder why, especially when we have so many big resilience institutes and providers. The SMEs, I believe, are more likely to be naïve about the subject. If this is the case, we should not set high expectations to achieve resilient communities and cities because of the lack of incentive.

And perhaps, more importantly, there remains only ‘full fat BCM’ available on the shelves of the ‘resilience supermarkets’ as discussed already. With no alternative available, the SME is more likely to go without.

So why do insurance companies not offer an annual discount to SMEs if they have at least a baseline level of resilience, which will ultimately make everyone better prepared and reduce costs when something goes wrong? We receive discounts for no claims on car insurance, yet with disasters and resilience, it does not seem to matter. This surely lends to another lack of incentive to be better prepared?

Walk the line or create the pathway for change?

I earn a living from BCM in addition to emergency and crisis management, yet I did not want to develop my own BCP for my business. Why was that? I did not have the time and finance to give this ability to my own team’s resilience. I needed something fresh and ultimately effective in time and cost. I needed ‘resilient simplicity’. Something a bit more, well, exciting!  But where was it? Why doesn’t it exist already?

Does the current resilience system have a design flaw in it because it really isn’t modern enough and attractive to everyone in the business world? Was it designed and priced as a Boeing 747 when actually some only need and want a smaller, lighter aircraft to get them from A to B? And they all don’t need or want the business class seats.

As a resilient professional, I want to practice what I preach; but the issue of requiring my own BCM made me stop thinking like a resilience ‘expert’ and start thinking as a small business. The solution I came up with was to develop what I really needed, to make my small business more resilient.

I did not follow the usual well-trodden line, ignoring the blatantly obvious gap, but instead I created a fresh, simple new path, which could be achieved in a fraction of the time and cost. A path which would enable resilience capabilities to be built using plain, straightforward, no-nonsense jargon, without any complicated risk assessments and business impact analysis. The result was Resilient60©: a simple, cost-effective framework, providing a simple level of quality resilience, which only takes 60 minutes to complete!

Instinct and leaders of the opposition

Our instincts help us to survive everyday as people and we listen to it and the other warning signs and senses around us. My professional instinct and senses made me ‘smell the cheese’ and told me there is a time for change and a new, simple effective way to help SMEs become more resilient. I needed it as an SME, not as a resilience supplier.

Some professionals and bodies out there will undoubtedly state that resilience cannot be achieved in 60 minutes! Yes, there will be countless naysayers. Yet at the same time, they will be unable to give a true accurate timescale on just how long it will take, as it depends on the organization, commitment and of course, cost. However, the same professionals and bodies (public and private sector) have not previously developed any new alternative approaches for the SMEs of the word. I remain resilient in my innovation and belief that it is time to change and will continue to make a difference for the better.

Resilient60© is not BCM. It does not claim to be; but it does give SMEs a level of protection. And if they want to progress to a higher level, at least this gives them the right starting point. Critically it will help the SME to be better prepared and resilient, as opposed to having no capability at all. It will enable a quality level of resilience in 60 minutes. That is all it takes to produce a workable resilience plan.

As excellent as BCM can be, it is like shopping in the expensive stores; products that can only be achieved and available to those who have the time and money to buy. Others may go in for a browse but they won’t buy if they cannot afford it and do not have the time to commit. It might feel uncomfortable for a while, but it will pass. They will just take the risk of not having a BCM or resilience capability. It’s time for a modern approach; it’s time for change.

The author

Paul KudrayAn international leader in business resilience consultancy, training and coaching; Paul Kudray, MSc FICPEM CBCI AMBCI Fellow of the EPC, is an ex-emergency services commander who finished an exemplary 32 year career in the UK healthcare sector, working for the NHS - culminating in 7½ years as the Director of Resilience for one of the world’s largest ambulance services, NWAS NHS Trust. He now works with private and public sector clients around the world, training, advising, coaching and mentoring them at the highest levels about emergency and business continuity management.

For more information about Resilient60© please contact or via LinkedIn 

Want news and features emailed to you?

Signup to our free newsletters and never miss a story.

A website you can trust

The entire Continuity Central website is scanned daily by Sucuri to ensure that no malware exists within the site. This means that you can browse with complete confidence.

Business continuity?

Business continuity can be defined as 'the processes, procedures, decisions and activities to ensure that an organization can continue to function through an operational interruption'. Read more about the basics of business continuity here.

Get the latest news and information sent to you by email

Continuity Central provides a number of free newsletters which are distributed by email. To subscribe click here.