Survey of Business Owners and Senior Decision

South East Business Monitor

Makers
Survey of Business Owners and Senior Decision Makers

Hot Topic Spotlight

11
Business Continuity
March 2007
Contents

1. Introduction 2

2. Business Continuity

Key messages 3

Background 3

SMEs in the South East 4

Nature of impact 7

Advice and guidance for SMEs 8

Conclusion 9

3. Annex – Statistics 10
 Hot Topic Spotlight 11: Business Continuity

Introduction

This Hot Topic Spotlight is based upon findings from the South East Business Monitor - a
quarterly survey of businesses based in the South East, conducted by the region’s Business
Link Providers (BLPs).

The Business Monitor has the following key objectives:

1. To identify business issues and concerns
2. To monitor business intentions and future growth expectations
3. To explore attitudes towards and experiences of using external business support and
advice
4. To establish whether any gaps exist in current support provision

Every three months, at least 1,200 telephone interviews are conducted with business owners
and senior decision makers of small and medium-sized enterprises (SMEs), based in the
South East. This allows an ongoing ‘temperature check’ of business issues and concerns.
The survey results are weighted to reflect the size and structure of the region’s SME
population.

The questionnaire consists of a set of fixed core questions, and additional ‘hot topic’
questions that change from wave to wave. ‘Business Continuity’ was covered in wave 3 of
the South East Business Monitor, the fieldwork for which took place in May 2006.

The findings from the hot topic questions are published in a series of Hot Topic Spotlights,
freely available upon request.

Hot Topic Spotlights currently available are (as at February 2007):

1. Business start-ups 7. Sustainability
2. Fuel, energy and water costs 8. Work-related stress
3. 2012 Olympics 9. Access to finance
4. Red tape and SMEs 10. Succession planning
5. Women’s enterprise 11. Business continuity
6. Home-based SMEs

To request a Hot Topic Spotlight, or if you have any enquiries about this research, please
email Stuart Cole at Business Link, Stuart.Cole@businesslinkkent.co.uk.

This Hot Topic Spotlight was prepared for the South East Business Link Providers by Step Ahead Research. The
views expressed within it are the views of the authors, and do not necessarily reflect those of Business Link.

© Copyright WSX Enterprise Ltd. The information contained in this paper may be quoted, provided the
following is acknowledged as the source: “South East Business Monitor, a quarterly survey of business
owners, conducted by the region’s Business Link Providers”.

2
 Hot Topic Spotlight 11: Business Continuity

Business continuity

Key messages

• 59% of SMEs in the South East do not have a plan in place to deal with major
emergencies, although 70% believe they have the finances available to deal with a short
break in trading.

• Micro-businesses (1-10 employees) are the least likely to have a plan in place for major
emergencies or to have the finances available to deal with a break in trading (32% and
69% respectively).

• SMEs in the broad manufacturing, construction and retail, tourism & other sectors are
also less likely to have disaster recovery plans than those in the land based, business &
finance and transport & distribution sectors.

• One possible explanation is that the most recent and high profile ‘disasters’ are more
likely to have affected the land based, business & finance and transport & distribution
sectors (from Foot and Mouth disease to terrorist attacks on the World Trade Centre and
London Underground).

• Growth orientated businesses may also be at particular risk as they are less likely to have
finances available to deal with a short break in trading.

• According to the Chartered Management Institute the loss of Information Technology was
the most commonly experienced interruption to businesses. It is also the most reported
perceived threat to business.

• The terms ‘Disaster Recovery’ and ‘Business Continuity’ are often used interchangeably
in business communications. Whilst connected, they do have distinctive connotations and
this may cause some confusion amongst SMEs.

Background

The meaning of the term Disaster Recovery is often used in the same context as Business
Continuity Management and both are often used interchangeably by various support and
advice organisations. However, the Business Continuity Institute report Business Continuity
Research suggests that Disaster Recovery and Business Continuity Management have
slightly different connotations for many businesses.

Although when asked to describe both activities separately each was used to describe the
other, Figure 1 suggests that Disaster Recovery is strongly linked to physical setbacks and
recovering data from Information Technology whilst Business Continuity is more linked to
planning and business processes1.

1
Business Continuity Research, Business Continuity Institute, 2005.

3
 Hot Topic Spotlight 11: Business Continuity

Figure 1: Understanding of business continuity and disaster management

plans for general recovery after a big physical disaster
47
e.g. fire
Disaster recovery

synonymous w ith Business Continuity Planning 27

plans for IT recovery after server failure 25

alternative means of data processing, storage,

12
protection, integrity
third party support for IT, w orkstation and data
10
resumption
protecting the core running of the business if an
42
unexpected event occurs
Business Continuity

disaster recovery plans 32

Management

ensuring the business keeps running smoothly at all

26
times

being ready for anything 24

comprehensive plans for robust business processes 15

0 10 20 30 40 50
%

Source: Business Continuity Research, Business Continuity Institute 2005. Survey of 251 businesses with more than 50
employees.

The South East Business Monitor asked SMEs across the region whether they have a plan
to deal with a major emergency or unplanned disaster (e.g. a Disaster Recovery plan) and,
whether they had the finances to deal with a short break in trading (e.g. 4 weeks). The latter
question deals with a specific aspect of Business Continuity Planning.

SMEs in the South East

Just over a third (37%) of the region’s small and medium enterprises (SMEs) have plans in
place to deal with a major emergency. This is a lower proportion than that recently reported
by the Chartered Management Institute (59%), although almost half of their survey
respondents were large businesses with more than 250 employees2.

The majority of SMEs in the region (59%) do not have a plan and 4% don’t know if they do or
not (Figure 2). Despite the proportion of businesses without a plan, 70% of all SMEs think
that they have available finances to deal with a short break in trading. Even amongst those
SMEs that don’t have a plan in place to deal with a major emergency, 66% believe that they
have the finances available.

2
Business Continuity Management, Chartered Management Institute, May 2006.

4
 Hot Topic Spotlight 11: Business Continuity

Figure 2: Capacity to cope with unplanned events

80
70
70

60

50
37
40
%

30

20

10

0
Recovery plan/disaster recovery plan Finances available

Source: SE Business Monitor (May 2006). Base = 1,804.

Nearly two thirds (64%) of micro-businesses (1-10 employees) do not have a plan to deal
with a major emergency. However, a significant majority (81%) of medium sized businesses
(50-249 employees) do have a plan and the proportion of small businesses (11-49
employees) with a plan is also relatively high (66%). The South East Business Monitor also
suggests that larger businesses are the most likely to have other plans in place as well (e.g.
business, training or sales and marketing).

Interestingly, the majority of micro-businesses (69%) do suggest that they have the finances
available to deal with a short break in trading (see Figure 3), although once again small and
medium sized businesses are more likely to report that they have finances available.

Figure 3: Capacity – size of business

100 Recovery plan/disaster
recovery plan 88
90 Finances available
81 81
80
69 66
70

60

50
%

40
32
30

20
10

0
Micro Business (1-10) Small Business (11-49) Medium Business (50+)

Source: SE Business Monitor (May 2006). Base = 1,804, Micro-businesses = 1,008, small businesses = 479 and medium
businesses = 317.

The Business Link segmentation model categorises SMEs in terms of the age, ownership
structure and development plans of the business (see Annex for information on categories).
SMEs seen as growth orientated (whether owner or team managed) are the most likely to
have a plan to deal with a major emergency (see Figure 4). However, these businesses are

5
 Hot Topic Spotlight 11: Business Continuity

less likely than their counterparts (steady state businesses) to suggest that they have the
finance available to deal with a short break in trading. Micro-economics would suggest that
growing businesses are trying to buy more goods and services in advance of sales than
steady state businesses and this may explain the differences. However, this does mean that
growth SMEs could be disproportionately affected in the event of a disaster and/or serious
disruption to trading.

Figure 4: Capacity – Business Link segmentation model

22
Start Up
73

Grow th (Ow ner 46

managed) 63

Steady State (Ow ner 26

managed) 74

Corporate Grow th 49
(Team managed) 76

Steady State (Team 40

managed) 84

0
Recovery plan/disaster 10 20 30 40 50 60 70 80 90
recovery plan %
Finances available

Source: SE Business Monitor (May 2006). Base = 1,804, Start ups = 111, growth (owner managed) = 273, steady state (owner
managed) = 365, corporate growth (team managed) = 574 and steady state (team managed) = 410.

Nearly three quarters (73%) of start up businesses have the finances available to deal with a
short break in trading, although this could be due to the recent investment of money used to
start the business.

The South East Business Monitor suggests that an above average number of SMEs in the
land based, business & financial services and transport & distribution sectors have a plan to
deal with emergencies (see Figure 5).

Figure 5: Disaster recovery plan – sectors

50 47
45
45
37 40
40
35 32
28
30
25
%

20
20
15
10
5
0
Retail/Tourism/Other

Transport/Distribution
Business/Financial
Construction
Land-Based

Manufacturing
All businesses

Services

Source: SE Business Monitor (May 2006). Base = 1,804, land based = 130, manufacturing = 279, construction = 244,
retail/tourism/other = 512, business and financial services = 453 and transport and distribution = 186.

6
 Hot Topic Spotlight 11: Business Continuity

The proportions of SMEs in these sectors with plans to deal with a major emergency could
be due to health and safety scares for the land based sector (Avian Flu and Foot and Mouth)
and the recent terrorist attacks on the World Trade Centre and London transport system.

Only 20% of SMEs in the construction sector have a plan and SMEs in the manufacturing
and retail, tourism & other sectors are also less likely to have plans. In part this could reflect
the size profile of these sectors (the construction sector has a much higher proportion of
micro-businesses). There is much less sector variation in terms of finances available to deal
with a short break in trading (see Figure 6).

Figure 6: Finances available - sectors

90 82 77 75
80
70 67 71
70
61
60
50
%

40
30
20
10
0
Retail/Tourism/Other

Transport/Distribution
Business/Financial
Construction
Land-Based

Manufacturing
All businesses

Services

Source: SE Business Monitor (May 2006). Base = 1,804, land based = 130, manufacturing = 279, construction = 244,
retail/tourism/other = 512, business and financial services = 453 and transport and distribution = 186.

Nature of impact

According to recent research by the Chartered Management Institute, Business Continuity

Management, the most commonly experienced interruption to the running of a business was
the loss of Information Technology, followed by the loss of people and telecommunications.
These three interruptions were also cited as the top three perceived threats to businesses,
with regard to costs. Other perceived threats to businesses include loss of access to
business site, loss of skills, utility outage, fire and terrorist damage3. Figure 7 shows the most
commonly perceived threats of disruption to businesses with regard to finance and also the
proportion of these perceived threats that are covered by Business Continuity Plans. Plans to
cope with the loss of Information Technology and loss of telecommunications are the most
likely to be in place.

3
Business Continuity Management, Chartered Management Institute, May 2006.

7
 Hot Topic Spotlight 11: Business Continuity

Figure 7: Perception of threats to businesses

80 Perceived Threat
67 67
70 63 Covered by BCP's
61
60 56 56 54
51 49
50
40
40
%

30
20
10
0 telecommunications

Loss of skills
Loss of access to
Loss of IT

Loss of people
Loss of

site
Source: Business Continuity Management, Chartered Management Institute, May 2006. Survey of 1,150 managers from
businesses of all sizes and from all sectors.

Advice and guidance for SMEs

There are a number of organisations that provide advice and guidance to businesses with
regard to Disaster Recovery/Business Continuity. For example, the Business Link website
provides a guide to Crisis Management and Business Continuity Planning as well as a guide
to risk management. These guides provide information on how to assess the impact of risks
on a business. The website also has a risk assessment tool specifically for Information
Technology4.

Since May 2006 all Local Authorities have a statutory obligation to provide advice and
assistance to local businesses.

The Civil Contingencies Secretariat also provides information and advice on emergency
planning through its UK Resilience website5. The Government’s Preparing for Emergencies
website6 provides information on Business Continuity Management including links to training
websites, other sources of advice and case studies. The MI5 website7 also provides advice
to businesses and organisations to help them to protect themselves from threats.

A number of organisations, for example the Business Continuity Institute and the Continuity
Forum, provide advice and support to continuity professionals and the British Standards
Institution has published a new standard for BCM – BS25999-1 Code of Practice for
Business Continuity which is based on the following model:

4
http://www.businesslink.gov.uk/bdotg/action/layer?r.l1=1074404796&topicId=1074428566&r.s=tl – accessed 05/03/2007.
5
http://www.ukresilience.info/index.shtm - accessed 08/02/2007.
6
http://www.pfe.gov.uk/business/index.shtm
7
http://www.mi5.gov.uk/ - accessed 08/02/2007.

8
 Hot Topic Spotlight 11: Business Continuity

The Business Continuity Management Process

• Programme Management: enables the business continuity capability to be both

established (if necessary) and maintained in a manner appropriate to the size and
complexity of the organisation
• Understanding your business: activities associated with “Understanding the
organisation” provide information that enables prioritisation of an organisation’s
products and services, and the urgency of the activities that are required to deliver
them. This sets the requirements that will determine the selection of appropriate
BCM strategies.
• Determining business continuity strategies: enables a range of strategies to be
evaluated. This allows an appropriate response to be chosen for each product or
service, such that the organisation can continue to deliver those products and
services - at an acceptable level of operation; and within an acceptable timeframe
during and following a disruption. The choice made will take account of the resilience
and countermeasure options already present within the organisation
• Developing and implementing a BCM response: results in the creation of business
continuity plans and incident management plans that detail the steps to be taken
during and after an incident to restore operations.
• BCM exercising, maintenance, review and audit: leads to the organisation being able
to, demonstrate the extent to which its strategies and plans are complete, current
and accurate; and identify opportunities for improvement.
• Embedding BCM in the organisation’s culture: enables BCM to become part of the
organisation’s core values and instils confidence in all stakeholders in the ability of
the organisation to cope with disruptions.

Source: BS25999-1 British Standard Institution Code of Practice for BCM.

Conclusion

The insight outlined in this Hot Topics Spotlight paper suggests a need to encourage more
SMEs to put in place plans to help their business in the case of a ‘disaster’ or significant
interruption to trading. In particular it highlights that smaller businesses (and in particular
micro-businesses) are much less likely to have disaster recovery plans and that ‘all business’
surveys can overestimate the preparedness of the SME community. Particular attention
should also be paid to growing businesses who, whilst more likely to have recovery plans,
may be disproportionately affected by an interruption in trading (through a relative lack of
finances).

Whilst it is only natural for those sectors most affected by recent emergencies and disasters
to be more prepared for future disruptions, there is no guarantee that future events may not
disproportionately affect other sectors (e.g. manufacturing, construction, retail or tourism).

9
 Hot Topic Spotlight 11: Business Continuity

Annex: Business continuity – statistics

This Annex sets out four figures which provide more detailed analysis of business continuity,
based on the South East Business Monitor. It should be noted that in some cases these
figures are based on a small number of responses and care should be taken in interpreting
the results.

Figure A.1: Capacity – areas

90
83
80 75 74
70 74 70
70
60
54
45 46
50
%

37 36
40
31 31 31
30
20
10
0
South East Berkshire Hants & Kent MKOB Surrey Sussex
IoW

Recovery plan/disaster recovery plan Finances available

Source: SE Business Monitor (May 2006). Base = 1,804, Kent = 504, Sussex = 497, Berkshire = 203, Hampshire & IoW = 199,
MKOB = 200 and Surrey = 201. MKOB = Milton Keynes, Oxfordshire and Buckinghamshire. IOW =
Isle of Wight.

Figure A.2: Capacity – trading life

80
70 73 72
70 67

60

50
37 39
40 37
%

30
22
20

10

0
All businesses 2 yrs or less 2-10 yrs 10 yrs+

Recovery plan/disaster recovery plan Finances available

Source: SE Business Monitor (May 2006). Base = 1,804, 2 years or less = 111, 2-10 years = 487 and 10 years+ = 1,203.

10
 Hot Topic Spotlight 11: Business Continuity

Figure A.3: Capacity – dominant management gender

80
74
70
70 65 61
60

50
37 41
40
%

33
28
30

20

10

0
All businesses Majority female Majority male Management
managed business managed business genders equal

Recovery plan/disaster recovery plan Finances available

Source: SE Business Monitor (May 2006). Base = 1,804, Majority female managed business = 302, majority male managed
business = 1,242 and management genders equal = 233.

Figure A.4: Capacity - turnover

100
89 94
90
80
80
71 70 67 71
70
61 57
60
50
%

38 35
40
30
19
20
10
0
All Up to £58,000 £58,001 - £1,000,001 - £6,800,001 - Over
businesses £1,000,000 £6,800,000 £34,000,000 £34,000,000

Recovery plan/disaster recovery plan Finances available

Source: SE Business Monitor (May 2006). Base = 1,168, Up to £58,000 = 206, £58,001 - £1,000,000 = 440, £1,000,001 -
£6,800,000 = 337, £6,800,001 - £34,000,000 = 141, Over £34,000,000 = 44. This figure excludes ‘don’t know’ responses and
those who refused to respond.

11
 Hot Topic Spotlight 11: Business Continuity

Box 1: Business Link Segmentation Model

Start-up: Any business in operation for less than 2 years.

Growth (owner managed): Established owner managed businesses expecting to expand in the
next 12 months.

Steady State (owner managed): Established owner managed businesses not expecting to expand
in the next 12 months.

Corporate Growth (team managed): Established team managed businesses expecting to expand
in the next 12 months.

Steady State (team managed): Established team managed businesses not expecting to expand in
the next 12 months.

12