The COVID-19 pandemic served as a major wake-up call to businesses that operational threats can emerge anytime. If downtime lasts more than a few days, the chances that a business will fail are high. Yet many companies have no business continuity plan.
Business continuity planning helps restore critical functions to normal operations in the wake of a disruption. Without a plan that includes an analysis of shutdown scenarios, an impact analysis, recovery strategies, and training, a business is tempting fate.
Failing to Plan Could Be Planning to Fail
COVID-19 may have been a once-in-a-lifetime occurrence, but its lessons should be permanently ingrained in the small business community. Caught flat-footed, businesses did their best to adapt on the fly to the pandemic. Unfortunately, large numbers of them were not able to weather the storm.
Economists say pinpointing the number of businesses that were shut down during the pandemic is difficult. By some estimates, one-third of US small businesses closed during the pandemic, permanently or temporarily. Closures were not felt equally among business sectors, though, and many businesses have since reopened.
But economists also say that the longer a business remains closed, the less likely it is to ever reopen. This analysis is in line with Federal Emergency Management Agency (FEMA) data indicating that 40 percent of businesses do not reopen after a disaster, 25 percent fail within one year of a disaster, and 90 percent fail within a year if they cannot resume operations within five days. Statistics from the U.S. Small Business Administration show that over 90 percent of businesses fail within two years of a disaster.
In the wake of the pandemic, a study found that more than half of businesses globally had no plans or protocols to combat an emergency such as COVID-19. The study also revealed that more than one-quarter of companies of any size had a business continuity plan in place.
According to the insurance company Travelers, nearly half of small businesses are operating without a business continuity plan. The insurance brokerage Gallagher says that over 70 percent of companies without a comprehensive business continuity plan fail to recover from a significant business interruption.
The Threat Landscape
On its Disasters and Emergencies preparedness page, the federal government lists the following hazards that can cause a business to shut down:
However, a focus on dramatic occurrences can obfuscate the more mundane risks that threaten business operations. Unplanned downtime can be caused by something as simple as a hardware or software failure, corrupted data, or user error.
Cybercriminal attacks represent one of the biggest threats that small businesses face. A 2022 report found that nearly two in three midsize organizations suffered a ransomware attack in the past eighteen months. And one in five of them spent $250,000 or more to recover from the attack.
Data breaches are another common cause of business interruption. Midsize businesses represent about 30 percent of all data breach victims. The cost of a data breach to a small business averages $120,000 to $1.24 million.
Cyberattacks have risen dramatically in recent years and are mainly perpetrated by external actors. But a sobering statistic comes from Verizon, which found that internal personnel commit one-third of cybercrime. Even when employees are not being malicious, they are often careless. Verizon says 82 percent of breaches involve human error, such as a worker opening a malware-infected email.
Additionally, in some instances, major life occurrences involving owners or key leaders may lead to business interruption. Events such as motor vehicle accidents, medical complications, or unexpected death may shake the foundations of a business that is considered stable.
Unplanned downtime—whether caused by disease outbreak, natural disaster, cyberattack, IT malfunction, staff shortage, life occurrence, or some other unexpected event—is costly. Although downtime costs vary by business size and type, they can run from hundreds to thousands of dollars per minute. There are also the associated restoration and recovery costs, which are often greater than the downtime costs.
Business Continuity Planning Steps
The longer a business interruption lasts, the more money it costs. Lost revenues and extra expenses equal reduced profits. Cash flow problems are a leading cause of small business failure, and most organizations cannot afford to ignore business continuity planning.
While the actual plan may be detailed, a few simple steps can kick off the planning development process:
If this all sounds a bit vague, it is because every company is different, and organizational needs vary. There is not a one-size-fits-all option for business continuity planning. Any specific plan should reflect a company’s critical functions and resources and the recovery strategies it can reasonably implement. A company headquartered in hurricane- or tornado-prone areas, for example, will need reliable sources of backup power, while industries more prone to cyberattacks may need to focus on ransomware responses.
Will You Be Ready When Disaster Strikes?
Entrepreneurs often learn the hard way to expect the unexpected. The threat landscape, from pandemics to cyberattacks to hardware and software failures, is continually growing and changing. While it is impossible to see around every corner, it is possible to anticipate major disruptions or disasters and plan accordingly.
Our attorneys can help you with the legal aspects of business continuity planning, particularly drafting the contracts and preparing the documentation necessary for your business to survive a crisis. We can also help you assemble a team of experienced professionals to implement other aspects of your plan. Do not get caught without a continuity plan. Start planning today, and be ready for whatever comes your way. Call or contact us to get started.
 Social Engineering. https://www.verizon.com/business/resources/T5cd/reports/dbir/2022-data-breach-investigations-report-dbir.pdf (last visited Apr. 17, 2023).