By Teresa Meek
A midsized U.S. manufacturer of airline parts didn’t have a disaster plan. Like many organizations, the company was focused on growth instead of planning for a catastrophic event.
Then, a few years ago, the manufacturer started getting letters from the major airlines it supplied asking to see its business continuity or disaster plan. How would the company keep them supplied if something went wrong? If you can’t show us you have a plan in place, the letters warned, we’ll take our business elsewhere.
“Their backs were up against the wall,” explains Paul Kirvan, the business continuity and disaster recovery expert who helped the company’s leaders develop a 75-page disaster plan.
Once its customers audited and approved the plan, the manufacturer was able to retain their business.
A hurricane, tornado, fire, flood or attack never did strike the company; but its lack of planning still almost led to a business disaster. The story illustrates a number of important lessons for business owners:
A disaster may not be likely, but if it does happen, the consequences are severe. According to the Red Cross, 40 percent of small businesses are so devastated after a major natural disaster that once they shut down, they never reopen.
Here are the 5 steps you can take to put an effective disaster plan in place.
1. Assess your business
A disaster plan should be written, but long before you put pen to paper, you need to:
For your business, what are the most important functions you would need to bring back into operation quickly after a disaster? What could wait?
Payroll and communications with employees, customers and suppliers top the list for most companies, Kirvan says. Even manufacturers often want to get email and critical apps running before they worry about the assembly line.
Organizations such as the Red Cross and the U.S. Small Business Administration provide suggestions and checklists to help you identify potential business risks. But every business is different, especially when it comes to finances. You need to analyze the fiscal impact of a potential loss and determine how soon you would need to switch to another way of paying workers, taking customer orders, shipping parts or making whatever other updates your business needs to make to survive.
Make sure to consider your staff, as well. Identify the people who have the most critical knowledge and experience to your company’s operation. For each key staffer, choose a couple of other employees who could step in and take over if necessary. They may need some training, but at this stage, you just need to pinpoint who they are. “The people piece is key,” Kirvan says.
Along with gaining a thorough understanding of your business priorities, you’ll need to research the physical risks in your business territory. Whether your region is prone to hurricanes, floods, earthquakes, tornadoes, wildfires or severe winter storms, no place is completely immune to weather disasters. Remember to consider your branch locations, too.
Remember: Disasters aren’t just about weather. Is your business located near a railroad or a major highway? You could be affected by a derailment or a tractor-trailer accident that involves a chemical spill. Consider and document all potential business risks in your area.
2. Create your plan
After you’ve determined which business functions are most important and what the physical risks are in your area, it’s time to start working on a plan. It should be a single document — you don’t want people to run around searching for the hurricane plan or the fire plan in an emergency.
“If you don’t plan, you won’t be able to perform when an emergency takes place,” Kirvan says.
A disaster plan is extremely detailed. It covers emergency contacts and communications and outlines the roles and responsibilities of staff. For each catastrophic event, it clearly delineates actions and steps that are easy to read and follow before, during and after an emergency.
In the plan, you will want to:
The plan should also include damage assessment processes and steps to follow in the recovery phase.
3. Consider special needs
If your business or industry has special requirements, your plan needs to address them specifically, says Chris Marrion, owner of Marrion Fire & Risk Consulting in New York.
“If you have a lab with 15 years of research experiments in freezers and someone cuts a power cable outside your building, you’ve lost everything,” Marrion explains. To cover that risk, learn how much time you have to get the power back on and create a plan to make it happen, whether that means putting in a generator with an adequate fuel supply, making an agreement to tap into an alternate power line or having a secondary line installed.
If you have valuable electronics that you want to protect from sprinklers or fire-fighting chemicals in the event of a fire, look into implementing a gaseous suppression system, which is more expensive, but limits the damage.
“You need to decide what you’re trying to protect, to what degree and with what measures,” Marrion says.
Your business changes over time, and so does emergency technology. Therefore, frequently revisiting and updating your plan is also essential for success, experts agree.
4. Plan IT resources
Covering your information technology needs during a disaster is so important that it’s actually a consulting field unto itself. According to a 2013 Ponemon Institute study (PDF), one minute of down time costs the average business approximately $7,900.
It’s imperative to back up your data frequently and duplicate it either in a separate location, in the cloud or using a combination of the two. If you have sensitive information that’s subject to HIPAA or other regulations, make sure your backup location can comply with your governance policies.
Also identify the IT resources you need to run the business and who will provide them. Determine and outline how much storage capacity you need, where you will get it and how much it will cost.
5. Test and train
“Some companies think if they fill in the blanks on a template, they’re protected,” Kirvan says. “They couldn’t be more wrong.”
The heart of a plan is in testing it and training staff to use it. This testing includes checking equipment and performing drills regularly.
Malfunctioning safety equipment magnifies a disaster. If you don’t test it, there’s no point having it, says Marrion. Unfortunately, many companies don’t bother. Marrion has seen sprinkler systems where the valve was shut and water couldn’t get to the shower heads, IT facilities that lack smoke detectors where they’re needed, and construction sites where workers cover smoke detectors to avoid false alarms.
Kirvan has also seen plans with designated exits that call for 50 people to squeeze through without tripping each other or clogging the doorway.
All of these situations are preventable through practicing your plan often – and revising it as needed.
No one wants to think about disaster. But having a plan in place is what protects you if one occurs. By creating a detailed disaster plan, testing it and practicing it, your business can continue to thrive – even in the worst of circumstances.