Survey of Business Owners and Senior Decision South East Business Monitor Makers Survey of Business Owners and Senior Decision Makers
Hot Topic Spotlight 11 Business Continuity March 2007
Contents 1. Introduction
2
2. Business Continuity Key messages
3
Background
3
SMEs in the South East
4
Nature of impact
7
Advice and guidance for SMEs
8
Conclusion
9
3. Annex – Statistics
10
Hot Topic Spotlight 11: Business Continuity Introduction This Hot Topic Spotlight is based upon findings from the South East Business Monitor - a quarterly survey of businesses based in the South East, conducted by the region’s Business Link Providers (BLPs). The Business Monitor has the following key objectives: 1. To identify business issues and concerns 2. To monitor business intentions and future growth expectations 3. To explore attitudes towards and experiences of using external business support and advice 4. To establish whether any gaps exist in current support provision Every three months, at least 1,200 telephone interviews are conducted with business owners and senior decision makers of small and medium-sized enterprises (SMEs), based in the South East. This allows an ongoing ‘temperature check’ of business issues and concerns. The survey results are weighted to reflect the size and structure of the region’s SME population. The questionnaire consists of a set of fixed core questions, and additional ‘hot topic’ questions that change from wave to wave. ‘Business Continuity’ was covered in wave 3 of the South East Business Monitor, the fieldwork for which took place in May 2006. The findings from the hot topic questions are published in a series of Hot Topic Spotlights, freely available upon request. Hot Topic Spotlights currently available are (as at February 2007): 1. Business start-ups 7. Sustainability 2. Fuel, energy and water costs 8. Work-related stress 3. 2012 Olympics 9. Access to finance 4. Red tape and SMEs 10. Succession planning 5. Women’s enterprise 11. Business continuity 6. Home-based SMEs To request a Hot Topic Spotlight, or if you have any enquiries about this research, please email Stuart Cole at Business Link,
[email protected]. This Hot Topic Spotlight was prepared for the South East Business Link Providers by Step Ahead Research. The views expressed within it are the views of the authors, and do not necessarily reflect those of Business Link.
© Copyright WSX Enterprise Ltd. The information contained in this paper may be quoted, provided the following is acknowledged as the source: “South East Business Monitor, a quarterly survey of business owners, conducted by the region’s Business Link Providers”.
2
Hot Topic Spotlight 11: Business Continuity Business continuity
Key messages •
59% of SMEs in the South East do not have a plan in place to deal with major emergencies, although 70% believe they have the finances available to deal with a short break in trading.
•
Micro-businesses (1-10 employees) are the least likely to have a plan in place for major emergencies or to have the finances available to deal with a break in trading (32% and 69% respectively).
•
SMEs in the broad manufacturing, construction and retail, tourism & other sectors are also less likely to have disaster recovery plans than those in the land based, business & finance and transport & distribution sectors.
•
One possible explanation is that the most recent and high profile ‘disasters’ are more likely to have affected the land based, business & finance and transport & distribution sectors (from Foot and Mouth disease to terrorist attacks on the World Trade Centre and London Underground).
•
Growth orientated businesses may also be at particular risk as they are less likely to have finances available to deal with a short break in trading.
•
According to the Chartered Management Institute the loss of Information Technology was the most commonly experienced interruption to businesses. It is also the most reported perceived threat to business.
•
The terms ‘Disaster Recovery’ and ‘Business Continuity’ are often used interchangeably in business communications. Whilst connected, they do have distinctive connotations and this may cause some confusion amongst SMEs.
Background The meaning of the term Disaster Recovery is often used in the same context as Business Continuity Management and both are often used interchangeably by various support and advice organisations. However, the Business Continuity Institute report Business Continuity Research suggests that Disaster Recovery and Business Continuity Management have slightly different connotations for many businesses. Although when asked to describe both activities separately each was used to describe the other, Figure 1 suggests that Disaster Recovery is strongly linked to physical setbacks and recovering data from Information Technology whilst Business Continuity is more linked to planning and business processes1.
1
Business Continuity Research, Business Continuity Institute, 2005.
3
Hot Topic Spotlight 11: Business Continuity Figure 1: Understanding of business continuity and disaster management
Business Continuity Management
Disaster recovery
plans for general recovery after a big physical disaster e.g. fire
47
synonymous w ith Business Continuity Planning
27
plans for IT recovery after server failure
25
alternative means of data processing, storage, protection, integrity third party support for IT, w orkstation and data resumption protecting the core running of the business if an unexpected event occurs
12 10 42 32
disaster recovery plans ensuring the business keeps running smoothly at all times
26 24
being ready for anything 15
comprehensive plans for robust business processes 0
10
20
30
40
50
% Source: Business Continuity Research, Business Continuity Institute 2005. Survey of 251 businesses with more than 50 employees.
The South East Business Monitor asked SMEs across the region whether they have a plan to deal with a major emergency or unplanned disaster (e.g. a Disaster Recovery plan) and, whether they had the finances to deal with a short break in trading (e.g. 4 weeks). The latter question deals with a specific aspect of Business Continuity Planning.
SMEs in the South East Just over a third (37%) of the region’s small and medium enterprises (SMEs) have plans in place to deal with a major emergency. This is a lower proportion than that recently reported by the Chartered Management Institute (59%), although almost half of their survey respondents were large businesses with more than 250 employees2. The majority of SMEs in the region (59%) do not have a plan and 4% don’t know if they do or not (Figure 2). Despite the proportion of businesses without a plan, 70% of all SMEs think that they have available finances to deal with a short break in trading. Even amongst those SMEs that don’t have a plan in place to deal with a major emergency, 66% believe that they have the finances available.
2
Business Continuity Management, Chartered Management Institute, May 2006.
4
Hot Topic Spotlight 11: Business Continuity Figure 2: Capacity to cope with unplanned events 80
70
70 60
%
50 37
40 30 20 10 0
Recovery plan/disaster recovery plan
Finances available
Source: SE Business Monitor (May 2006). Base = 1,804.
Nearly two thirds (64%) of micro-businesses (1-10 employees) do not have a plan to deal with a major emergency. However, a significant majority (81%) of medium sized businesses (50-249 employees) do have a plan and the proportion of small businesses (11-49 employees) with a plan is also relatively high (66%). The South East Business Monitor also suggests that larger businesses are the most likely to have other plans in place as well (e.g. business, training or sales and marketing). Interestingly, the majority of micro-businesses (69%) do suggest that they have the finances available to deal with a short break in trading (see Figure 3), although once again small and medium sized businesses are more likely to report that they have finances available.
Figure 3: Capacity – size of business 100 90
Recovery plan/disaster recovery plan Finances available
80
69
70
88 81
81 66
%
60 50 40
32
30 20 10 0 Micro Business (1-10)
Small Business (11-49)
Medium Business (50+)
Source: SE Business Monitor (May 2006). Base = 1,804, Micro-businesses = 1,008, small businesses = 479 and medium businesses = 317.
The Business Link segmentation model categorises SMEs in terms of the age, ownership structure and development plans of the business (see Annex for information on categories). SMEs seen as growth orientated (whether owner or team managed) are the most likely to have a plan to deal with a major emergency (see Figure 4). However, these businesses are
5
Hot Topic Spotlight 11: Business Continuity less likely than their counterparts (steady state businesses) to suggest that they have the finance available to deal with a short break in trading. Micro-economics would suggest that growing businesses are trying to buy more goods and services in advance of sales than steady state businesses and this may explain the differences. However, this does mean that growth SMEs could be disproportionately affected in the event of a disaster and/or serious disruption to trading.
Figure 4: Capacity – Business Link segmentation model 22
Start Up
73
Grow th (Ow ner managed)
46
Steady State (Ow ner managed)
63
26
74
Corporate Grow th (Team managed)
49
Steady State (Team managed)
76
40
0 Recovery plan/disaster recovery plan Finances available
10
20
30
40
84 50
60
70
80
90
%
Source: SE Business Monitor (May 2006). Base = 1,804, Start ups = 111, growth (owner managed) = 273, steady state (owner managed) = 365, corporate growth (team managed) = 574 and steady state (team managed) = 410.
Nearly three quarters (73%) of start up businesses have the finances available to deal with a short break in trading, although this could be due to the recent investment of money used to start the business. The South East Business Monitor suggests that an above average number of SMEs in the land based, business & financial services and transport & distribution sectors have a plan to deal with emergencies (see Figure 5).
47
45 37
40 32
28
Transport/Distribution
Business/Financial Services
Retail/Tourism/Other
Construction
Manufacturing
20
Land-Based
50 45 40 35 30 25 20 15 10 5 0
All businesses
%
Figure 5: Disaster recovery plan – sectors
Source: SE Business Monitor (May 2006). Base = 1,804, land based = 130, manufacturing = 279, construction = 244, retail/tourism/other = 512, business and financial services = 453 and transport and distribution = 186.
6
Hot Topic Spotlight 11: Business Continuity The proportions of SMEs in these sectors with plans to deal with a major emergency could be due to health and safety scares for the land based sector (Avian Flu and Foot and Mouth) and the recent terrorist attacks on the World Trade Centre and London transport system. Only 20% of SMEs in the construction sector have a plan and SMEs in the manufacturing and retail, tourism & other sectors are also less likely to have plans. In part this could reflect the size profile of these sectors (the construction sector has a much higher proportion of micro-businesses). There is much less sector variation in terms of finances available to deal with a short break in trading (see Figure 6).
Figure 6: Finances available - sectors 90 80 70
82 70
75
77
71
67 61
%
60 50 40 30 20
Transport/Distribution
Retail/Tourism/Other
Construction
Manufacturing
Land-Based
All businesses
0
Business/Financial Services
10
Source: SE Business Monitor (May 2006). Base = 1,804, land based = 130, manufacturing = 279, construction = 244, retail/tourism/other = 512, business and financial services = 453 and transport and distribution = 186.
Nature of impact According to recent research by the Chartered Management Institute, Business Continuity Management, the most commonly experienced interruption to the running of a business was the loss of Information Technology, followed by the loss of people and telecommunications. These three interruptions were also cited as the top three perceived threats to businesses, with regard to costs. Other perceived threats to businesses include loss of access to business site, loss of skills, utility outage, fire and terrorist damage3. Figure 7 shows the most commonly perceived threats of disruption to businesses with regard to finance and also the proportion of these perceived threats that are covered by Business Continuity Plans. Plans to cope with the loss of Information Technology and loss of telecommunications are the most likely to be in place.
3
Business Continuity Management, Chartered Management Institute, May 2006.
7
Hot Topic Spotlight 11: Business Continuity Figure 7: Perception of threats to businesses 80 70
67
Perceived Threat
67
63 56
60
56
54
51
61
%
50
Covered by BCP's 49 40
40 30 20 10
Loss of skills
Loss of access to site
Loss of people
Loss of telecommunications
Loss of IT
0
Source: Business Continuity Management, Chartered Management Institute, May 2006. Survey of 1,150 managers from businesses of all sizes and from all sectors.
Advice and guidance for SMEs There are a number of organisations that provide advice and guidance to businesses with regard to Disaster Recovery/Business Continuity. For example, the Business Link website provides a guide to Crisis Management and Business Continuity Planning as well as a guide to risk management. These guides provide information on how to assess the impact of risks on a business. The website also has a risk assessment tool specifically for Information Technology4. Since May 2006 all Local Authorities have a statutory obligation to provide advice and assistance to local businesses. The Civil Contingencies Secretariat also provides information and advice on emergency planning through its UK Resilience website5. The Government’s Preparing for Emergencies website6 provides information on Business Continuity Management including links to training websites, other sources of advice and case studies. The MI5 website7 also provides advice to businesses and organisations to help them to protect themselves from threats. A number of organisations, for example the Business Continuity Institute and the Continuity Forum, provide advice and support to continuity professionals and the British Standards Institution has published a new standard for BCM – BS25999-1 Code of Practice for Business Continuity which is based on the following model:
4
http://www.businesslink.gov.uk/bdotg/action/layer?r.l1=1074404796&topicId=1074428566&r.s=tl – accessed 05/03/2007. http://www.ukresilience.info/index.shtm - accessed 08/02/2007. 6 http://www.pfe.gov.uk/business/index.shtm 7 http://www.mi5.gov.uk/ - accessed 08/02/2007. 5
8
Hot Topic Spotlight 11: Business Continuity The Business Continuity Management Process •
Programme Management: enables the business continuity capability to be both established (if necessary) and maintained in a manner appropriate to the size and complexity of the organisation
•
Understanding your business: activities associated with “Understanding the organisation” provide information that enables prioritisation of an organisation’s products and services, and the urgency of the activities that are required to deliver them. This sets the requirements that will determine the selection of appropriate BCM strategies.
•
Determining business continuity strategies: enables a range of strategies to be evaluated. This allows an appropriate response to be chosen for each product or service, such that the organisation can continue to deliver those products and services - at an acceptable level of operation; and within an acceptable timeframe during and following a disruption. The choice made will take account of the resilience and countermeasure options already present within the organisation
•
Developing and implementing a BCM response: results in the creation of business continuity plans and incident management plans that detail the steps to be taken during and after an incident to restore operations.
•
BCM exercising, maintenance, review and audit: leads to the organisation being able to, demonstrate the extent to which its strategies and plans are complete, current and accurate; and identify opportunities for improvement.
•
Embedding BCM in the organisation’s culture: enables BCM to become part of the organisation’s core values and instils confidence in all stakeholders in the ability of the organisation to cope with disruptions.
Source: BS25999-1 British Standard Institution Code of Practice for BCM.
Conclusion The insight outlined in this Hot Topics Spotlight paper suggests a need to encourage more SMEs to put in place plans to help their business in the case of a ‘disaster’ or significant interruption to trading. In particular it highlights that smaller businesses (and in particular micro-businesses) are much less likely to have disaster recovery plans and that ‘all business’ surveys can overestimate the preparedness of the SME community. Particular attention should also be paid to growing businesses who, whilst more likely to have recovery plans, may be disproportionately affected by an interruption in trading (through a relative lack of finances). Whilst it is only natural for those sectors most affected by recent emergencies and disasters to be more prepared for future disruptions, there is no guarantee that future events may not disproportionately affect other sectors (e.g. manufacturing, construction, retail or tourism).
9
Hot Topic Spotlight 11: Business Continuity Annex: Business continuity – statistics This Annex sets out four figures which provide more detailed analysis of business continuity, based on the South East Business Monitor. It should be noted that in some cases these figures are based on a small number of responses and care should be taken in interpreting the results.
Figure A.1: Capacity – areas 90
83
80
70
75
74
70 60 45
%
50 40
37
54
36
74
70
46 31
31
31
30 20 10 0 South East Berkshire
Hants & IoW
Kent
MKOB
Recovery plan/disaster recovery plan
Surrey
Sussex
Finances available
Source: SE Business Monitor (May 2006). Base = 1,804, Kent = 504, Sussex = 497, Berkshire = 203, Hampshire & IoW = 199, MKOB = 200 and Surrey = 201. MKOB = Milton Keynes, Oxfordshire and Buckinghamshire. IOW = Isle of Wight.
Figure A.2: Capacity – trading life 80
72
73
70
67
70 60
%
50 40
39
37
37
30
22
20 10 0 All businesses
2 yrs or less
2-10 yrs
Recovery plan/disaster recovery plan
10 yrs+
Finances available
Source: SE Business Monitor (May 2006). Base = 1,804, 2 years or less = 111, 2-10 years = 487 and 10 years+ = 1,203.
10
Hot Topic Spotlight 11: Business Continuity Figure A.3: Capacity – dominant management gender 80
74
70
70
65
61
60
%
50 41
37
40
33
28
30 20 10 0 All businesses
Majority female managed business
Majority male managed business
Recovery plan/disaster recovery plan
Management genders equal
Finances available
Source: SE Business Monitor (May 2006). Base = 1,804, Majority female managed business = 302, majority male managed business = 1,242 and management genders equal = 233.
Figure A.4: Capacity - turnover 100
89 94
90
80
80
71
70
61
%
60 50 40 30 20
67 71
70
38
57 35
19
10 0 All Up to £58,000 £58,001 businesses £1,000,000
£1,000,001 - £6,800,001 Over £6,800,000 £34,000,000 £34,000,000
Recovery plan/disaster recovery plan
Finances available
Source: SE Business Monitor (May 2006). Base = 1,168, Up to £58,000 = 206, £58,001 - £1,000,000 = 440, £1,000,001 £6,800,000 = 337, £6,800,001 - £34,000,000 = 141, Over £34,000,000 = 44. This figure excludes ‘don’t know’ responses and those who refused to respond.
11
Hot Topic Spotlight 11: Business Continuity Box 1: Business Link Segmentation Model Start-up: Any business in operation for less than 2 years. Growth (owner managed): Established owner managed businesses expecting to expand in the next 12 months. Steady State (owner managed): Established owner managed businesses not expecting to expand in the next 12 months. Corporate Growth (team managed): Established team managed businesses expecting to expand in the next 12 months. Steady State (team managed): Established team managed businesses not expecting to expand in the next 12 months.
12