Business Continuity Planning: Keeping Your SME Running During a Crisis

1. Risk Assessment: Know What You Are Up Against

The first step in business continuity planning is understanding what threats your business faces. Sit down with your team and identify the risks specific to your location, industry, and operations.

Common Risks for Malaysian SMEs

• Floods: Malaysia's monsoon seasons (November–March for the east coast, April–September for the west coast) bring heavy rainfall. If your premises are in a flood-prone area — and many business districts in KL, Selangor, Penang, and Johor are — flood is your top risk.
• Fire: Electrical faults are the leading cause of commercial fires in Malaysia. Older shop lots and buildings without proper fire safety systems are especially vulnerable.
• IT system failure: A ransomware attack or hard drive crash can wipe out your customer database, financial records, and operational data.
• Supplier failure: Your key supplier goes out of business, their factory burns down, or shipping routes are disrupted.
• Key person dependency: What happens if you — the owner — or your only trained operator is hospitalised for a month?
• Pandemic / health crisis: As COVID-19 showed, a health crisis can shut down operations for weeks or months.

Score each risk on likelihood (1–5) and impact (1–5). Multiply them to get a risk score. Focus your planning on the highest-scoring risks first.

2. Disaster Recovery: Getting Back on Your Feet

Disaster recovery is the operational side of BCP — the specific steps you will take to restore your business after a disruption.

Data Backup (Non-Negotiable)

Your business data — customer records, invoices, inventory lists, financial statements — is one of your most valuable assets. Implement the 3-2-1 rule: three copies of your data, on two different types of media, with one copy stored off-site (or in the cloud).

• Cloud backup: Google Drive, Dropbox, or dedicated backup services like Acronis or Backblaze. For critical data, set up automated daily backups.
• Local backup: An external hard drive kept in a fireproof safe on-site, updated weekly.
• Off-site backup: A second external drive stored at a different location (e.g., your home or a trusted relative's house).

Physical Asset Recovery

For physical businesses — retail shops, restaurants, manufacturers — your disaster recovery plan should answer these questions:

• Can you relocate temporarily? Do you have an alternative location lined up?
• Who are your backup suppliers if your primary supplier is affected?
• Do you have up-to-date photos and inventory records for insurance claims?
• What equipment would need to be replaced first for you to resume operations?

3. Communication Plans: Who Needs to Know What and When

During a crisis, clear communication can make the difference between chaos and orderly response. Your communication plan should cover:

• Employees: How will you contact your team? Have a phone tree or WhatsApp group ready. Designate a crisis leader and a backup person.
• Customers: If you have to close for repairs or delay orders, how will you inform customers? Draft template messages for social media, email, and SMS in advance.
• Suppliers: Notify your key suppliers immediately if you cannot take deliveries or if you need urgent alternative supply.
• Insurance company: Keep your insurance policy number and claims hotline accessible. Designate someone on your team to handle the claims process.
• Local authorities: For fires, floods, or other emergencies, know the local police station, fire station, and hospital numbers.

4. Real-World Scenarios: Flood and Fire Planning for Malaysian SMEs

Flood Scenario (e.g., Klang Valley monsoon floods)

The threat: Water entering your premises, destroying stock, equipment, and paper records.

Prevention: Install flood barriers or sandbags at entry points during monsoon season. Keep critical equipment and valuable stock on elevated platforms or higher floors. Store important documents in waterproof containers.

Response: Have a pre-arranged storage unit at a higher elevation. Move inventory and equipment when flood warnings are issued. If you have flood insurance, understand the claims process in advance.

Recovery: After the flood, prioritise drying out the premises to prevent mould. Contact your insurance adjuster immediately. Use cloud-based systems so your data is accessible even if your physical premises are not.

Fire Scenario (e.g., electrical fire in a shop lot)

The threat: Fire destroying your premises, stock, equipment, and potentially neighbouring businesses.

Prevention: Ensure your premises have proper fire extinguishers, smoke detectors, and emergency exits. Conduct quarterly electrical safety checks. Keep a fireproof safe for critical documents and cash.

Response: Evacuate immediately — no asset is worth a life. Have fire drill procedures in place so employees know the evacuation routes and assembly point.

Recovery: Work with your insurance company to assess damage and start the claims process. If your premises is uninhabitable, activate your temporary location plan. Use cloud backups to access your data from anywhere.

5. Making BCP a Habit, Not a Project

The biggest mistake SME owners make is writing a BCP document, putting it in a drawer, and forgetting about it. A business continuity plan is a living tool that must be reviewed, tested, and updated regularly.

• Schedule a bi-annual review: Every January and July, review your plan. Have your risks changed? Have you moved premises? Changed suppliers? Hired new key staff?
• Run a tabletop exercise: Once a year, gather your team and walk through a hypothetical crisis. "It's November and a major flood is forecast for next week. What do we do?" This reveals gaps in your plan that you would not spot on paper.
• Integrate BCP into your daily operations: Regular data backups, supplier diversification, and proper insurance should be part of your routine business practices, not special projects.

Frequently Asked Questions