Most business owners spend their time thinking about how to grow the business, attract customers, manage employees and increase revenue. Very few have the time to think about what would happen if something suddenly went wrong.
What would happen if your key employee was unavailable? What if your premises became inaccessible? What if your computer systems stopped working, your supplier failed, a cyber incident occurred or a major emergency affected your operations?
These situations may seem unlikely, but business disruption can happen quickly. The difference between a business that struggles to recover and one that continues operating often comes down to preparation.
This is where business resilience becomes important.
What Is Business Resilience?
Business resilience is the ability of an organisation to prepare for disruption, respond effectively when something goes wrong, continue critical operations and recover as quickly as possible.
It is much broader than simply having a Business Continuity Plan sitting in a folder.
A resilient business considers the many things that could affect its ability to operate, including:
- People and staffing
- Business premises
- Technology and IT systems
- Cybersecurity
- Suppliers and contractors
- Financial pressures
- Security risks
- Natural disasters and emergencies
- Critical business processes
- Communication
- Leadership and decision-making
- Customer and stakeholder relationships
The objective is not to predict every possible disaster. That would be impossible.
The objective is to understand your business well enough to identify what is most important, what could go wrong and what you can do to reduce the impact.
The Small Business Resilience Challenge
Large organisations often have dedicated risk managers, business continuity specialists, IT teams and emergency management resources.
Small businesses generally do not.
In many small businesses, the owner is responsible for sales, finance, employees, operations, compliance, customers and decision-making.
That can create a significant vulnerability.
What happens if the owner cannot work for several weeks?
What happens if only one person knows how to access the banking system, contact key suppliers or complete an important operational process?
What happens if important information exists only on one computer?
These are not simply management issues. They are resilience issues.
A business that relies heavily on one person, one supplier, one system or one location may have a significant single point of failure.
Resilience Starts With Understanding Your Business
One of the most important steps in developing resilience is identifying your critical business activities.
Ask yourself:
What does my business absolutely need to keep operating?
This might include taking customer orders, processing payments, accessing customer information, communicating with employees, delivering products or services, managing payroll or maintaining access to essential premises.
Once these critical activities have been identified, you can begin considering what could prevent them from operating.
For example, if your business relies heavily on your accounting software, what happens if the system is unavailable?
If you have a small team, who performs an essential role when someone is sick or unavailable?
If your premises are damaged by fire, flooding or another incident, where could you operate from?
The answers help identify weaknesses before they become emergencies.
Business Continuity Is Only One Part of Resilience
Business continuity is an important component of resilience, but it is only part of the picture.
A strong resilience approach also considers prevention, preparedness, response and recovery.
For example, security measures may reduce the likelihood or impact of an incident. Staff training can improve response capability. Emergency procedures can help people make decisions under pressure. Backup systems can reduce technology-related disruption.
Testing is also critical.
A plan that has never been tested is largely an assumption.
Businesses should periodically exercise their plans and ask questions such as:
Would this actually work?
Do employees know what they are expected to do?
Are contact details current?
Can we access important information if our normal systems are unavailable?
Who makes the decisions during an emergency?
Testing can reveal weaknesses that may not be obvious when simply reading a document.
Resilience Is About People Too
Technology receives considerable attention when discussing business resilience, but people remain one of the most important elements.
Employees need to understand their responsibilities during a disruption.
Managers need to understand who has authority to make decisions.
Businesses need to consider succession, cross-training and delegation.
If one employee is the only person who understands a critical process, that creates a vulnerability.
Documenting procedures and cross-training employees can reduce this dependency.
It also helps businesses operate more effectively during normal conditions.
Don’t Wait Until Something Goes Wrong
One of the biggest mistakes businesses can make is developing resilience plans after an incident has already occurred.
Planning after a disruption means making important decisions while under pressure.
Planning beforehand provides the opportunity to think clearly, consult employees, identify resources and develop practical strategies.
Even small improvements can make a significant difference.
Review your important contacts.
Check your backups.
Document critical procedures.
Identify alternative suppliers.
Review your insurance.
Train your employees.
Test your emergency procedures.
Identify who can make decisions if you are unavailable.
These activities do not need to happen all at once. Resilience can be developed progressively.
A Practical Approach to Business Resilience
Business resilience should not become another complicated document that sits on a shelf.
It should become part of how the business operates.
That means regularly reviewing risks, updating plans, training people, testing procedures and learning from incidents, near misses and exercises.
The process should also change as the business changes.
New employees, new technology, new premises, new suppliers and new services can all introduce new risks.
A resilience plan developed two years ago may no longer reflect the business you operate today.
The SGH Business Resilience Toolkit
Developing a practical resilience framework can be difficult, particularly for small business owners who are already managing the day-to-day demands of running their organisation.
This is one of the reasons I developed the SGH Business Resilience Toolkit.
The toolkit is designed to provide businesses with a practical framework for considering resilience across areas such as risk, continuity, security, staffing, technology, cyber risks, planning, testing, exercising and continuous improvement.
Rather than simply telling business owners that they “need a plan”, the toolkit provides practical guidance, templates, checklists and activities to help them work through the process.
It can be used as a starting point for developing a resilience framework, reviewing existing arrangements or identifying areas where the business needs to strengthen its preparedness.
Resilience Is an Ongoing Process
No business can eliminate every risk.
The goal is to become better prepared to deal with disruption.
A resilient business understands its vulnerabilities, prepares its people, protects its critical operations and learns from experience.
The question every business owner should ask is not:
“Could something go wrong?”
It is:
“If something does go wrong, how prepared are we to keep operating?”
The sooner you start asking that question, the more options you have.
Business resilience is not about expecting the worst.
It is about being prepared for it.
If you would like a practical starting point for reviewing and strengthening your business resilience, the SGH Business Resilience Toolkit has been developed to help you work through the process step by step.
