Business continuity planning tends to focus on the risks that are easiest to quantify. Cyberattacks, power outages, equipment failures and supply chain disruption can all have an immediate financial impact on a business.
However, there is another operational risk that is considerably more straightforward but can be just as disruptive: being unable to access or secure your premises.
A lost key, failed lock or employee leaving without returning their keys can quickly become a business continuity issue. Staff may be unable to start work, customers may be turned away and valuable equipment or sensitive information could be left inadequately protected.
For small and medium-sized businesses in particular, physical access should therefore form part of wider continuity and risk-management planning.
1. The True Cost of a Business Lockout
The cost of being locked out of commercial premises goes beyond resolving the problem with the door.
Consider a small retailer that discovers at 8:30am that the key will no longer operate the front-door lock. Employees are waiting outside, deliveries are due and the business is supposed to open to customers at 9am.
Every minute spent resolving the problem has a potential operational cost.
The same principle applies to offices, workshops, salons, hospitality businesses and other commercial premises. A lockout could result in lost trading time, delayed appointments, employees being paid while unable to work and deliveries being missed.
This demonstrates an important principle of business continuity: relatively minor failures can have disproportionately large consequences when they affect a critical part of an organisation’s operations.
2. Physical Access Should Be Part of Continuity Planning
Business continuity planning involves identifying the resources and processes an organisation needs to continue operating.
Premises are one of those resources.
Businesses should therefore consider what would happen if employees suddenly couldn’t enter their building or couldn’t secure it properly at the end of the working day.
Questions worth asking include who holds keys, whether spare keys are available, who is authorised to request access and what employees should do if a lock or door fails.
The response should also consider who can resolve the problem. For example, a Birmingham business dealing with an unexpected lockout or damaged lock may need to contact an emergency locksmith rather than waiting until its usual maintenance provider becomes available.
Documenting this process removes uncertainty and can reduce the amount of time lost when an incident occurs.
3. Key Control Is an Operational Risk
Key management can easily become informal as a business grows.
A company might begin with two founders and two sets of keys. Several years later, keys may have been issued to employees, managers, contractors, cleaners and former members of staff.
Unless somebody maintains a clear record, the business may no longer know exactly how many keys exist or who has access to them.
This creates both an operational and security risk.
An effective key-control process should record when keys are issued and returned, restrict unnecessary duplication and establish what happens when somebody loses a key.
Employee departures deserve particular attention. Recovering physical keys, passes and other access credentials should be part of the same offboarding process used to remove access to company email, software and internal systems.
Where a key cannot be accounted for, the business can then assess whether changing or reconfiguring the relevant lock is appropriate.
4. Doors and Locks Need Preventative Maintenance Too
Many business continuity strategies are preventative rather than reactive.
Companies maintain machinery before it breaks, replace ageing IT equipment and service heating or electrical systems to reduce the likelihood of unexpected downtime. Doors and locks can be approached in much the same way.
Locks rarely receive much attention while they are working correctly. However, difficulty turning a key, loose handles, misaligned doors or mechanisms that regularly stick can indicate a developing problem.
Ignoring these warning signs can eventually result in a door that cannot be opened or secured.
Including doors, locks and access systems in routine premises inspections can help businesses identify problems before they become emergencies.
This is particularly important for frequently used entrances, fire exits, storage areas and doors protecting valuable stock, equipment or confidential information.
5. Build Physical Access Into Your Risk Assessment
No organisation can prevent every unexpected incident. The purpose of business continuity planning is instead to understand likely risks and prepare a proportionate response.
Physical access can be incorporated into an existing risk assessment without creating a complicated new system.
Businesses can identify their critical entrances, determine who needs access, keep accurate records of keys and access credentials, establish procedures for lost keys and ensure employees know who to contact when something goes wrong.
It can also be useful to review these arrangements periodically. Businesses change: employees leave, responsibilities shift, premises are refurbished and additional keys are issued. A system that worked two years ago may no longer reflect how the organisation operates today.
For SMEs with limited resources, these relatively simple procedures can make a significant difference.
A failed lock may seem minor compared with a cyberattack or major supply chain disruption, but if employees cannot enter the building on Monday morning, the operational outcome is immediate.
Business continuity is ultimately about keeping an organisation functioning when something unexpected happens. That means protecting not only digital systems and supply chains, but also something much more fundamental: making sure the business can open its doors.
