Many business owners think about how their operations would function in the wake of disaster. With the recent catastrophic wildfires, hurricanes and earthquakes, it's all too easy to imagine a major disaster close to home. But for too many businesses, the preparation for disaster recovery stops there. They never make a formal recovery plan and they never rehearse how a recovery would take place.

That may be the biggest disaster of all. According to the Federal Emergency Management Agency (FEMA), 40 percent to 60 percent of small businesses never reopen their doors following a disaster. The longer your company is unable to conduct business as usual, the less likely it is to recover from a catastrophe. “Following a disaster," says FEMA, "90 percent of smaller companies fail within a year unless they can resume operations within 5 days.” 

What do you have to be ready? A formal business continuity plan (BCP) is central to the resilience and future of your company. A BCP can help you establish procedures for reestablishing communications, logistics, and supply chains or relocating vital operations. Your BCP doesn’t have to be complex and it will be unique to your organization, but all plans have similar foundations, among which are:

1. Analysis/risk assessment
2. Written recovery and response procedures
3. Assignment of responsibilities  
4. Training and testing of the procedures

Make your plans now by reviewing each of these elements.

Analysis

The first step to a practical BCP is the most crucial, as it involves examining the consequences of disruption to operations. This process, which is often called a business impact analysis (or BIA), probes external and internal vulnerabilities and threats, and the risk that failures in key areas pose to the company. It also prioritizes the systems that must be functional to resume operations and identifies the necessary resources. From this assessment, you’ll be able to develop written methods to regroup.

Consider the impacts of natural disasters to your organization, but don't stop there. Property fires are even more common than natural disasters, and also devastating. Statistics released in April 2016 by the National Fire Protection Association (NFPA), show an average of 37,000 fires occur on industrial and manufacturing properties annually, resulting in $704 million in direct property losses for these types of occupancies each year. Even localized internal flooding that occurs in areas of critical operations can bring a company to a grinding halt, causing near disastrous disruptions and costly downtime.

Think about man-made disasters. How will failures of supply deliveries, or delays in providing goods or services to customers affect your organization? What can you do in advance to offset these negative effects? 

Most modern businesses are paralyzed if critical information technology (IT) suffers downtown. The ability to rapidly restore servers, enterprise software and office productivity tools should be part of the analysis. If there are manual processes that can be performed until systems or data can be restored, those should be noted and described in the analysis. Now may be the right time to consider cloud-based servers to backup and store critical company information.

For assistance in this step, FEMA has Operational & Financial Impacts Worksheets, which can be used by company managers to list and evaluate potential threats.

Written Procedures

From your analysis, create recovery and response procedures with an eye on timing. How long can certain business or operational functions remain down before unacceptable service levels occur? Generate written recovery time objectives for restoring business functions with the most serious potential for significant financial or operational loss. These may include time-based goals that require company financial services to be functional within 12 to 24 hours after a disaster.  

In prioritizing your recovery and response procedures, you’ll also realize the type of alternative locations that may be needed. Perhaps only an office location is necessary for immediate functions. In a widespread regional disaster, such spaces may be limited, therefore consider optional areas in the building (cafeterias or break rooms) or telecommuting for essential staff. Look at unusual alternatives. For example, following serious community disasters, many employers have used recreational vehicles (RVs) to house primary financial and business operations. Document these potential offsite and secondary locations, as well as any resources needed, such as inventory, materials, utilities, workforce, etc.

Responsibilities

Triage the workforce for disaster situations when preparing the BCP. For example, after a company fire, maintenance workers may be needed to conduct inspections and repair equipment. Additionally, IT, senior management and office staff may be required to restore financial operations, allocate resources and convey information to customers and vendors. These are the priority workers who must report for duty.

It is time consuming to call each worker and inform them of the need to report for duty. You will want a more efficient and streamlined process to follow after a disaster. Conversely, following a very serious community event, phone services may be disrupted, and communications can be impossible. Therefore, in advance, you should determine a method to notify employees, such as the company website, social media pages, or a local radio or television station. Employees should be made aware of this means of notification through regular briefings, as well as their duties after a disaster. Employers should also be aware, however, that in widespread catastrophes, it may be impractical or impossible for some key staff to get to the business. Impassible roads and personal catastrophes may affect vital workers. Start now to cross-train employees to step in for others who may not be able to make it to your location.

Training Procedures

No plan is complete without training workers about the BCP and testing procedures. Scenarios should be examined routinely, through tabletop exercises, drills and discussion. FEMA has noted that one in five businesses with BCPs spend no time maintaining the plan—which can be tragic for the organization if disaster strikes. Being prepared for recovery with a ready staff, and well documented and frequently tested procedures can help the resilience of your business. A disaster does not have to be a catastrophic loss.

Resources: FEMA: Business Continuity Plan

Open for Business ToolKit

The information contained in this article is intended for general information purposes only and is based on information available as of the initial date of publication. No representation is made that the information or references are complete or remain current. This article is not a substitute for review of current applicable government regulations, industry standards, or other standards specific to your business and/or activities and should not be construed as legal advice or opinion. Readers with specific questions should refer to the applicable standards or consult with an attorney.