When a meat processing business in Northern Ireland declined a quote for a fire risk assessment, it had no way of knowing that within three months its manufacturing site would burn down, with two or three neighbouring businesses also losing their premises.
For Joe Hanna (pictured), head of risk management at Willis Insurance and Risk Management in Belfast, the case illustrates a recurring problem among small and medium-sized enterprises (SMEs). Resilience is often addressed only after something has gone wrong, creating an opportunity to intervene earlier.
Hanna, a construction, design and management (CDM) specialist by background who has expanded into health and safety, environmental and sustainability advisory work, said part of the problem is structural.
"The main part is because there's no regulatory requirement," Hanna said. "So it's normally led by insurance companies asking companies what they're doing."
That can make resilience dependent on the priorities of whichever insurer happens to be on the risk. Hanna described one company that had completed around 60% of a business continuity plan after an insurance surveyor requested it.
"You write it, you get to about 60% and they ...