Know Your Risks: Understanding What Could Stop Your Business
You can't protect what you haven't identified. The third professional practice in the BCI's Good Practice Guidelines — Analysis — is where continuity planning stops being a general intention and becomes specific: which activities matter most, what threatens them, and how long you could survive without each one.
Two tools do most of the work here. The first is a Business Impact Analysis (BIA), which asks a simple but revealing question about each of your core activities: if this stopped today, how quickly would it hurt — financially, legally, or reputationally — and how long could we cope before the damage became serious? That “maximum tolerable period of disruption” is different for every activity. A payroll failure might be tolerable for a fortnight; a failure to answer emergency customer calls might not survive a single afternoon.
The second tool is risk assessment: looking at what could realistically cause that disruption. For most Greater Manchester businesses, the highest-probability risks aren't dramatic. They're IT outages, key supplier failure, extreme weather affecting premises or transport, loss of a critical member of staff, or a cyber incident. Analysis isn't about imagining exotic disaster scenarios; it's about being realistic about the everyday things that actually take businesses down.
Dependencies deserve particular attention. Modern businesses rarely fail because of a single cause — they fail because of a chain: a supplier's supplier goes under, which delays your stock, which breaks a delivery promise, which loses a client. Mapping who and what you depend on — including the ones you don't have a direct contract with — often reveals more risk than mapping your own internal operations.
This is also where the discipline pays for itself commercially. Many businesses discover, through a proper BIA, that they've been quietly over-insuring against low-impact risks and under-preparing for the one or two dependencies that would actually cause serious harm. Analysis gives you the evidence to prioritise sensibly, rather than guessing.
For a smaller business, this doesn't need consultants and spreadsheets running to dozens of pages. A structured half-day workshop with your leadership team — walking through your top five or six critical activities, honestly scoring impact and likelihood — will usually surface most of what matters. The output should be short enough that you'll actually refer back to it: a one-page table of critical activities, their tolerable downtime, and the risks most likely to hit them.
Everything in the next two practices — designing solutions and putting them in place — depends on getting this analysis right first. Skip it, and you risk building expensive answers to the wrong questions.
Continuity Shop delivers the BCI's Certificate of the Business Continuity Institute (CBCI) training and provides business continuity consulting to organizations across Greater Manchester and beyond. If this article has raised questions about where your own business stands, get in touch with [email protected] to talk through your options.
More on
