Four steps to build a business continuity plan for micro, small and medium-sized companies in Latin America. An opportunity for MSMEs in Latin America.
Introduction
Recently, at an amusement park licensed by the Government of Mexico City, a fatal accident occurred in a “roller coaster” type of game. This caused the closure of said Park while the expert investigations were being carried out and when responsibility was demonstrated on the part of the operating company, the operation concession of said park was revoked, which is very famous and focused on the popular class of Mexico City. Consequences? Payment of hospitalization and recovery expenses as well as Compensation to users and relatives of the two deceased persons, loss of the concession to operate a business that has already been accredited for several years, Workers' compensation for loss of source of work attributable to the employer (according to Mexican labor law), payment of various legal expenses,Affecting the social fabric due to the decrease in family amusement parks and low cost, generation of government bidding processes not contemplated to grant a new concession to other interested parties and the budgetary expenses that this implies and this just to point out some of the consequences of a serious incident.
In 2017, Mexico suffered a series of earthquakes that severely affected nine states, affecting the most vulnerable population, since six of those states have population margins in poverty. Several buildings, schools, and private businesses suffered considerable damage.
In the image, a mechanical workshop that was severely affected, located on Santa Ana avenue at the corner of Ejidos de Santa Cruz Atoyac in the Coyoacán delegation. Photo: Carlos Maruri, Cuartoscuro.
The countries of Latin America are located in areas of high volcanic, seismic, and hydrometeorological risk, (Hurricanes, Cyclones, typhoons, Storms, droughts and floods) in addition to the so-called socio-organizational phenomena such as: Drug trafficking, Guerrillas and local armed conflicts and regional, migrations and also health problems such as epidemics of the NH-1 virus, or flu, and a long etcetera. The occurrence of any of these situations can put micro, medium and small companies throughout Latin America out of competition.
According to the Economic Commission for Latin America and the Caribbean, (ECLAC 2019): “micro, small and medium-sized enterprises constitute 99% of the industrial fabric, they generate most of the jobs, their productivity is extremely low in relation to large Business.".
In recent times, risk management has become increasingly important. The purpose of this essay is to suggest general criteria so that Latin American MSMEs can create a Plan that allows them to face crisis situations and come out ahead of them.
What is a MiPyme?
MiPyMe is the acronym for Micro, Small and Medium Business. This classification is due primarily to two main factors: The working capital you have and the number of employees you have. Mainly attending to this last consideration we would have the following classification:
Source: Own elaboration with data from INEGI, Mexico. Economic Census 2014.
Another factor commonly used to define whether a company is micro, small or medium, is its global sales turnover index in one year, but this definition depends on the exchange rate of the dollar with respect to the local currency, so for effect of this work will not be considered.
Being an entrepreneur is not easy and once it has been undertaken, making the business remain in the face of strong economic competition, not local but globalized, makes the permanence of the business reduced, according to the portal of the business magazine Expansión, it mentions that data of the 2014 economic census of INEGI (Mexico), this type of companies generally have a duration of 7.7 years of commercial life, after which most disappear.
What is risk?
Alexander Dumas already raises the problem of risk in his novel "The Count of Monte Cristo", as he tells how after the ship "El Faraón" has sunk, the owner and patron of Edmundo Dantes (The future count) is totally ruined and is going to bankruptcy with somewhat dire consequences.
Risk Management involves precisely "managing risks". But what is a risk? Risk is the possibility that something unwanted happens, such as, for example, that the warehouse premises catch fire, or that the truck that transports our merchandise crashes, the owner dies or becomes seriously ill, or we suffer theft of sensitive commercial information, that an earthquake, a hurricane or an epidemic affects us, etc….
Need to have a Business Continuity Plan
As already stated, it is necessary for micro, small and medium entrepreneurs to have a Business Continuity Plan (PCN) or Business Continuity Plan (BCP). Recall that this idea originally came from IT developers, who sought to solve the programming problems of different software packages, but given its usefulness it is extrapolated to business. This process ended up changing the IT area and being adopted by the Accounting and Business Administration. Much is said about "customer service" but what about service to our own business? There is insurance for many things, but there is no insurance coverage that protects the knowledge of the operation to be able to continue with the company in case of serious incidents.
What would happen if a “Don Pepe” Furniture and Maneuvering truck crashes and causes serious damage? Or if in the "Instituto Cultural del Norte" a student burns with acid in the chemistry lab? What would happen if the "Taller Don Jesús, fine carpentry" caught fire? Or if an ammonia leak occurs at the “Happy Penguin” ice plant? Or if Don Carlos, connoisseur of the recipe for the secret sauce key to the success of the restaurant (source of income for the family) dies? As we can see with the examples mentioned, the risk exists and if it materializes, the consequences for the business can be drastic. So drastic that they can end the business and the wealth of entrepreneurs…
Currently there is the ISO 22301 standard "Business continuity Management System" which focuses on establishing criteria regarding the issue, however, according to the International Management and Evaluation Society (SIGE 2019) this standard is focused on: "Organizations that They provide mission-critical services, Providers of infrastructure services and basic services (electricity, water, transportation, health, etc.). Financial and banking services and telecommunications services, manufacturing companies and government agencies ”, so we can say that, in essence, the standard is designed for large companies with large capital, large global sales turnover and more than 250 employees, that is, to large companies.
Although the criteria of this standard can be adapted to MSMEs, its implementation is not cheap and sometimes it would be expensive for “the corner store” or “Don José's Saddlery” and even for “Transport Atlas” that is to say, for the companies to which this essay is directed.
What is the Business Continuity Plan?
The Business Continuity Plan, PCN, as its name indicates, establishes the means and mechanisms for business continuity. ("Business in progress NIF A-2" Basic Accounting Postulates ") Its importance lies in the fact that, as has been seen, medium and small companies are primarily family-owned and that is where one of the major problems lies; as has been said; Only the Father or Mother or a member of the family is directly responsible for running the business and is the one who has all the general knowledge of its operation. He is the one who knows suppliers, knows the behavior of the market in which they operate, knows the credits and sources of financing and the creditors of the business, knows in a few words the life of the business in all its facets.
General considerations to prepare a Business Continuity Plan
This essay proposes a series of general considerations (“Steps”) so that micro, medium and small companies can generate their own PCN.
These steps are relatively easy to carry out, but they require a planned and dedicated effort in time and form to guarantee the creator of the plan that they have met the expectations of a plan and that it will help them in the event of unfortunate events that affect the business.
Four steps for the construction of the Business Continuity Plan
Below we will break down each of the steps to build a Business Continuity Plan, so that they can be followed sequentially, covering the aspects that are required in each of them:
Step 1. Business Identification
This first step consists of identifying Areas, Processes and People within the business and with it: What does the business do? What is the true essence of the business? Grupo Televisa had by 1994 an approximate of 125 subsidiaries that ranged from the rental of air taxis to personalized courier services. In order to reduce operating costs, Televisa focused on answering three basic questions: What do we do? What do we earn money with? How do we lose money? And so he focused again on the production and distribution of television, film and radio content.
For our PCN we must identify which areas are really substantive, (Sales, Production, Distribution? Which one?) Which processes are the ones that generate value and money (Home delivery, customer service, Production Sub-processes? Which ones?) and finally, who or who are the people that make the business work? Once this is done, we can say that we have already identified the business well. The foundations of PCN have already been laid.
Step 2. Documentation and Safeguarding
Identify key people, areas and processes
Enrico in his book "The War of the Tails" relates how when he was Director at Frito-Lay, the subsidiary of Grupo Pepsi, a worker changed the formula of his product "Fritos" (Doritos in Mexico) and consumers immediately began to protest the change in flavor, affecting sales; so once the problem was identified they returned to the original formula. For this reason, it is necessary to document all the key processes of the areas that generate money and that were already established in Step One.
Ideally, document all processes, but if you cannot or want to do so, document only substantive processes. Also answer the following questions: Who is the key character in the areas already identified? What task does it accomplish? What key processes does it handle?
Safeguarding tangible and intangible assets
It sounds logical, but it is a commonly forgotten situation. Here you must consider the actions to be taken to protect tangible and intangible assets such as: The building, the machines and tools, the raw material, the transport equipment; as well as intangible assets such as formulas, patents and trademarks, rights, letters of exclusivity. For this, the contracting of insurance that covers these eventualities and even the so-called "key man insurance" should be considered. Coca-Cola wouldn't be the same if Pemberton had lost the formula!
From having internal security measures to insurance coverage, our assets must be protected and safeguarded. And this implies establishing within the plan, how am I going to protect them? What type of insurance should I hire and for how much amount? With which insurance company? Does my bank offer me free insurance? Or payment insurance? The Plan must also contemplate civil protection measures, since our collaborators and the work space are also our assets. And here I stop a bit: As part of the PCN, the Internal Civil Protection Plan must be linked to it and determine what risks are in the locality of our business and what actions must be taken to mitigate the risk.
Digital Intelligence
Finally and importantly, the safekeeping and custody of Digital Information. We understand by Digital Intelligence, all the information related to the business and that is obtained and generated by electronic means. Digital intelligence is all the information that is generated and controlled through ICT and computer software that accompany them. From those that provide us with accounting and tax information to those digital files that contain the development of plans and projects, formulas, construction plans, etc. In this way, we must establish mechanisms that prevent the theft, damage or espionage of our digital systems, and these measures range from a simple antivirus to the contracting of more sophisticated electronic defense mechanisms.
Recently a friend suffered an attack on his computer, where they asked him for an amount of money to be deposited in an account in Africa, to release his "files" because he had no access to them. Fortunately, he is a Cybersecurity Engineer and he managed to kill the "hijacking" and recover all his information. But not all of us have those abilities, therefore, we must establish how we will recover our information in case of loss. From the entire process of administrative accounting information (Suppliers, clients, creditors, accounts) to the personal photos of the owner when he opened the restaurant and when he managed to convert it into a national chain. That is to say; all digital information that is considered important for the operation of the business. (What about photos ?! Well, they become business history!)Conclusion: In this digital age, not only backup in the cloud is or can be good, but also in a strongly guarded physical medium. Each person will choose what they think is most convenient with the help of experts.
Step 3: Recovery
In 2000, the famous "Bug" was expected, a problem that was thought to affect computers due to the effect of their internal clock. No one on the entire planet knew exactly what was going to happen. Before this, a Mexican military institution had a procedure established years ago to recover its digital information and physically extract it (on computer tapes), taking it to a heavily armored underground facility and with tape exchange processes. They left some and took the ones that were in the vault to reuse them on their site, so they told me, in case of contingency they would only lose information for a maximum of three days and not all of it. And let's remember that we are talking about more than twenty years ago!
Now in this third step we must establish the Mobility aspect in our plan. Mobility refers to answering the following question: Where do I move my offices / business / operation in case of damage? This phase refers to where the business will mobilize in a fortuitous event. Suppose an earthquake occurs that destroys the offices or business premises, where can the business move? Where can the merchandise be transferred? Where can we locate the workers? Determine the area or areas of the company or areas close to where the business can be relocated.
Our plan should establish the possible future locations of the business in case of impact. Perhaps to other offices in a nearby neighborhood or to another location. In your case, what other facility can carry out what we did in the affected facility? And this implies the order of movements and transfer of personnel, machinery and in case of not being able to move to another facility, it implies the search for government support or private assistance institutions for the recovery of the business.
Step 4: Reactivation
No business can function without human, financial, technological or material resources. The Plan must consider how, once the risk has occurred, it will be put into operation again. And the foregoing implies how will the staff be reunited? New work days at the time of recovery, special permits for staff who have been affected by the accident, where appropriate, settlements and new hires. In the case of financial resources, insurance collection, define before whom or to whom government support can be resorted to and its modalities, from which banks credit can be requested, whether business-owned credit titles will be sold, recovery of bank accounts and their amounts etc.For technological resources, from whom are new equipment purchased or how and who will be in charge of setting up and ready the digital systems. Regarding material resources, define which ones with the machines, tools and equipment in general that are required and before whom or from whom they can be obtained. In all cases, it is important to establish periods of business set-up.
Communication and business reactivation
It is important to let customers and the community in general know that the business continues and on what date it will be operating or if it is operating at what capacity. This allows retaining customers and even earning more. The use of print and social media can contribute to this. Another form of communication is the “flyer”, the delivery of flyers informing about the reopening. A scheme that is sometimes not so contemplated, but that is very supportive is word of mouth and this happens when our community helps us to spread the word that we are already in operation again, therefore, the PCN should not forget this means of communication.
Conclusions
Every company, whether micro, small or medium, throughout Latin America, should think about establishing a Business Continuity Plan, PCN, which allows it to face risk situations and promote its resilience and therefore its survival within any economic environment - Commercial where it is, being the PCN a tool that supports that purpose. The steps proposed here are general criteria that contribute to the development of said plan, considering that they are phases that, due to their ease of implementation, can be easily replicated and applied by Latin American MSMEs, contributing to their growth and with it to the strengthening of the social, industrial and commercial fabric of the region.
Once your PCN has been prepared, it is necessary that key people know it and even know where it is in digital form or in the form of a printed document, but defining the means of dissemination and to whom it should be disclosed is, necessarily, the subject of another essay.
Bibliography and Infoweb
- Molina Golfredo in: MiPymes: What are they and how are they developed?
