SMEs need to understand the benefits of Business Continuity Management Systems

According to a recent report published by the Business Continuity Institute (BCI) in association with the British Standards Institution (BSI), companies see cyber-attacks as the biggest threat to business, followed closely by the risk of unplanned IT/telecoms outages and data breaches. With increasing reliance on the internet, cyber threats such as ransomware, malware, phishing and online fraud are becoming more common. Companies should not only worry about external threats, but also internal attacks by rogue employees who have access to systems and the knowledge to cause significant damage.

The same source point out that although most large organisations understand the benefits of Business Continuity Management Systems (BCMS), many small and medium sized enterprises (SMEs) remain either unaware of its importance or are under the impression that implementing a business continuity plan is unnecessary.

According to a different report published by Databarracks, only 27% of small businesses in the UK have adopted a business continuity plan, and of that percentage, 73% admit to not having tested their plan in the last 12 months. Similarly, a US study found that only one in four small businesses have a BCMS and more than half claim it would take them at least three months to recover from a disaster.

BCI defines a Business Continuity Management System as a holistic management process that identifies potential threats and the impact these threats could have on an organisation. It provides a framework for building resilience capabilities to effectively respond to threats and safeguard the interests of the company’s reputation, key stakeholders, brand and values.

A BCMS extends beyond the basic reactive measures of a risk management strategy to adopt a more proactive approach by understanding the organisation, its strengths and weakness, and pre-empting any disruptions. A BCMS builds resilience to ensure businesses can respond quickly and effectively in the event of a major incident by regularly testing their business continuity plan and documenting learning points.