Don't think your small business is at risk? Think again. When you realize it, your business has valuable information and assets that probably are not protected right now. Your business likely has confidential client information, proprietary business or just internal knowledge that you wouldn't want to be exposed to criminals or competitors. No one want to have risk in their business plans, but the truth is that without risk there is no business.
Firstly, they want to understand they are not the key risks in your business are so fundamental to the investment proposition that it would prevent them from funding you. Some businesses are not at the right stage to receive external funding and placate funder concerns. These businesses are best off dealing with key risk factors prior to seeking funding. The loss of this information could have a devastating impact on your business. While business insurance, which is one of the important part of your protection, it cannot protect clients from identity theft or your business from unscrupulous employees or competitors. No matter how big or small, your business needs to have a security, privacy and recovery plan in place that determines what risks you have, helps protect against those risks and sets plans in place to handle the most likely types of losses you may experience. Your plan should also look at the both the physical and the virtual aspects of your business. Start by gaining information in types of risks to which your business may be vulnerable. What if your business information was lost or stolen? Do you have customer files or records, tax receipts, bank statements, business plans, customer work products? Next, consider the physical aspects of your business that may be vulnerable. Do you have unique office equipment, inventory, computers or trade specific tools? Finally, look at how you do business. Do you rely on technology, the internet or employees with unique skills? Does your business model depend on repeatable processes that are unique to your business? Now, consider what would happen to your business if these parts of your business were lost, destroyed or stolen. Could you continue operating if you lost your client files? Could you be sued by customers if their personal information was exposed? Could you be the target of negative publicity? Could your competitors benefit if they gained access to the information? What if you lost email access for a day? What if that key employee suddenly left for another job? What if your office space caught fire or was flooded? Your security and recovery plan should put in place the safeguards and policies and procedures to prevent some of these risks and the potential to negatively impact your business. Physical access to buildings is relatively easy to control, although most small business have little more than a lock on the front door. Should you consider locking file drawers? Is inventory controlled? Does every employee have access, even, the things that are not part of his or her job? Could a disgruntled or fired employee return to the workspace after hours with an extra key copy? Your plan should consider how to protect the virtual parts of your business also. Do you have backups of any important files? Do you have passwords, account numbers and other keys securely guarded? Do your computers have virus and firewall protection and is it up-to-date? Do you have internet and email usage policies in place to protect your employees from harassment charges? What about remote employees or workers who take work home? In today's highly mobile environment, vital business information can now be easily accessed outside your physical controls? Do your employees know how to safeguard laptops, cell phones, flash drives or even print out of business information once they leave your workspace? What if a laptop is stolen from a worker's car or home or hotel room? Do you have a backup of the data that was on the laptop? What if your employees are accessing your information from a coffee shop Wi-Fi? How do you know if your clients and business are protected? Lastly, your security and recovery plan should consider how you would handle the most likely losses. For instance, if the computer that holds all your sales information destroyed, you should probably have a plan to immediately restore that information from a backup. Where is the backup tape or disk kept? Who has access to it and most importantly, who knows how to restore a backup? If your office is flooded, how quickly can you relocate? Can some employees work from home or other remote locations temporarily? If client information is stolen, do you have a way to contact them? Most small business owners likely have taken first steps like purchasing insurance and putting locks on the front door. Unfortunately, few have taken the time to really understand and analyze the potential risks to their business. By the time now to at least put together an informal plan will go a long way in the event of a real disaster or other loss. Even, the best planning obviously won't protect against all disasters, but it can certainly lessen the impact to your business once one occurs. Aubrey Jones is President and founder of Riverbank Consulting, Inc. Since 1996 he has worked to protect internet banking clients for one of the top US financial Institutions, including serving as a Risk Manager.
The right way to address business risks: The main reason many business owners don’t talk about business risks with potential funders is because they don’t want to highlight the weaknesses in their business. This is a fair concern to have. However, there is a right way to address business risk with funders, without turning lenders and investors off.
The solution is to focus on how you mitigate the risks. In other words, what are the steps you are taking in your business as a direct reaction to the risks that you have identified? This is very powerful in easing funder fears, and in positioning you as someone who has a handle on their business. For example, if a business risk you had identified was a high level of customer concentration, then a suitable mitigation plan would be to market your products or services targeting new clients, as opposed to focusing all efforts on one client.
You must be logged in to post a comment.