We are living in an unprecedented time. We are witnessing global disruptions across nearly every industry, labor shortages, a radical shift in the behavior of our workforce, the possibility of a recession over the next 12 months, a new COVID-19 wave on the horizon, and the invasion of Ukraine and the war crimes being perpetrated by Putin.
When unexpected and unprecedented events affect business economics at a micro level – employees, customers, competitors – business owners must be willing and ready to adapt and initiate systems and procedures that enable resiliency. Unfortunately, many small businesses do not have a plan in place that allows for resiliency when faced head-on with disruption. These businesses are reactive and most certainly not prepared to handle an event that is unexpected. We need to look no further than the pandemic to know first-hand what it’s like to for a never-before-seen event to shutdown businesses and entire industries.
How can your firm become resilient? Have a plan.
It will be difficult to plan for all possible disruptions, but you can and should be prepared to handle an unexpected event that prevents employees from doing their job, takes mission critical vendors offline or puts them out of business, or interrupts communications. There are also unexpected events that do not affect your business but do affect your competitors. By planning for an unexpected, perhaps never-before-seen event, you can mitigate risks when your business is in jeopardy or capitalize on opportunity when an event affects your competition.
Identify all the potential risks to your business to include strategic, operational, and financial risks. What can go wrong, what likely will go wrong, and what are the consequences of each scenario? Possible risk categories include IT and data, personnel, cybersecurity, fraud, procedures, policies, as well as risks associated with losing key clients, and more.
Develop an alternate plan that shows you what to do if the unexpected event happens, the order of steps, and each stakeholder’s responsibility. While your plan is intended to be corrective, be sure to also include preventive controls that can stop a risk before it happens. By not having an alternate plan, you risk having a slow response or making poor decisions while under pressure.
Understand the SLA and Disaster Recovery Plan for critical vendors. Take the time to do your homework on your software providers and service relationships. Do not go through the exercise of collecting SLAs and disaster recovery plans simply to check off boxes. Take the time to read the documents and understand what would happen to your vendor partner if their business or service was shutdown tomorrow. What would happen to your data? Do they have application continuity? Do they have policies in the agreement that prevent or limit your right to litigate and recover damages? Are they profitable? How many full-time employees do they have and of those, how many have been with them for more than 5 years? If a vendor or service provider does not answer your questions to a level that you are comfortable, you should be looking at their competitors.
Test your plan. If there is a plan in place at your business, have you tested it? How well did it work in practice? There are a few different ways to test your plan. One common method is to run a “tabletop” exercise, where you gather key personnel in a room and simulate how they would respond to a particular scenario. This can be a helpful way to identify any weaknesses or gaps in your plan. You can also perform a “live” test of your plan, which involves implementing the plan in response to a real-life event. This is often considered the most effective way to test a plan, but it can also be the most disruptive and expensive. No matter which method you choose, it’s important to test your plan on a regular basis. By doing so, you can be sure that your business is resilient and will continue operating when faced with the unexpected and unprecedented.
No one can predict the future, but businesses that plan are more resilient and have a better chance of operating when the unexpected is also unprecedented. By establishing protocols and procedures, having a plan in place, and testing the plan, you can avoid or mitigate disaster. What steps have you put into place to make your business more resilient?