Small business owners are strongly encouraged to make contingency plans for responding to and recovering from disasters that may befall them. Analysts note that disasters—whether they take the form of floods, corporate espionage, fires, or power out-ages—can have a devastating impact on a business's viability. Business experts also insist that the importance of a good disaster and recovery plan has never been as acute as it is today, in large part because so many businesses rely on vulnerable technology (communication networks, management information systems, process control systems, etc.) to execute fundamental business operations.
Yet as Alan M. Levitt reported in Disaster Planning and Recovery, "various studies and surveys instruct us that most organizations have not established a comprehensive strategy for disaster planning and recovery. The percentage of organizations that lack any semblance of a plan is, simply put, frighteningly large." Levitt also noted that many disaster contingency plans that do exist are "applicable only to certain specific business processes (put another way, it is designed only to rescue specific bits and pieces of the business, not to save the entire organization!)." Many other companies' disaster planning policies, meanwhile, seem to consist only of disaster insurance. Such coverage is valuable, but it is only of limited usefulness. Indeed, Kenneth N. Myers, author of Total Contingency Planning for Disasters, described disaster insurance as only one element of a comprehensive disaster contingency plan. "The role of insurance in protecting against loss of physical assets, such as buildings and equipment, is clear," wrote Myers. "However, using insurance policies to protect against the loss of cash flow, the ability to service customers, or the ability to maintain market share is often not practical…. The primary function of business insurance is to provide a hedge against loss or damage. A disaster recovery and business continuation plan, however, has three objectives: 1) Prevent disasters from happening; 2) Provide an organized response to a disaster situation; 3) Ensure business continuity until normal business operations can be resumed."
It is essential, then, that small businesses take the time and effort to construct comprehensive disaster and recovery plans if they hope to weather unwelcome interruptions in business operations in good financial and market condition. "Some call it Crisis Management," remarked Building Design & Construction magazine. "Others call it Disaster Management, Emergency Preparedness, Business Resumption, or Contingency Planning. The newest 'buzz word' is Business Continuity Planning. It really doesn't matter what it's called as long as your company does it."
"It is not easy to recognize the hundreds of hazards or perils that can lead to an unexpected loss," wrote Susan Anastasio in the SBA's Small Business Insurance and Risk Management Guide. "For example, unless you've experienced a fire, you may not realize how extensive fire losses can be. Damage to the building and its contents are obvious, but you should also consider: smoke and water damage; damage to employees' personal property and to others' property (e.g., data-processing equipment you lease or customers' property left with you for inspection or repair) left on the premises; the amount of business you'll lose during the time it takes to return your business to normal; the potential permanent loss of customers to competitors."
Of course, many other types of disasters can strike a business as well, ranging from those triggered by natural events such as floods, tornadoes, earthquakes, or hurricanes, to those that come about as a result of localized environmental problems, like water main breaks, work force strikes, power outages, hazardous materials spills, explosions, and major transportation mishaps (aircraft crash, train derailment, etc.). In addition, damage that is the direct result of premeditated human actions such as vandalism, sabotage, and arson can also be classified as a disaster.
The first step in creating a strategy (or reviewing existing contingency plans) to protect a company from these and other events involves mustering the necessary business will to undertake the challenges associated with the task. However, business observers contend that many companies fail in this regard. "The fact is that the majority of private-sector management is still reluctant to allocate the necessary time, staff, or funds to prepare and plan for the possibility of a disaster that may put them out of business," according to Building Design & Construction. Myers agreed that this tendency to give short shrift to disaster planning is a common one, observing that "when the economic climate is favorable, contingency planning is last on the list of things to do; when profits are down, contingency planning is the first item to be cut from the budget."
Small business owners, then, need to make sure that they devote adequate resources to disaster preparedness and recovery planning before beginning the process. Indeed, Levitt said that contingency planning efforts are ultimately doomed if they are undertaken without top management commitment, involvement, and support; participation of front line managers and staff teams in both planning and implementation; and ongoing communication with all constituencies of the business.
Once a business's leadership has decided to invest the necessary time and effort into the creation of a good disaster preparedness and recovery plan, it can proceed with the following steps:
DETERMINING VULNERABILITIES "Begin the process of identifying exposures by taking a close look at each of your business operations and asking yourself what could cause a loss," counseled Anastasio. "If there are dozens of exposures you may find dozens of answers…. Many business owners use a risk analysis questionnaire or survey, available from insurance agents, as a checklist." These questionnaires will typically address the business's vulnerability to losses in the areas of property, business interruption, liability, and key personnel, among others.
Obviously, this component of disaster preparedness planning—often referred to as risk management—needs to be comprehensive, covering all aspects of business operations, including telecommunications, computer systems, infrastructure, equipment, and the facility itself.
GATHERING INFORMATION "The process of creating a disaster planning and recovery strategy is, in reality, the result of determining the organization's goals and objectives for business continuation—the ability to deliver its goods and services in the asintended manner, utilizing its as-intended processes, methods, and procedures—whenever any out-of-course event might impair, impact, impede, interrupt, or halt the as-intended workings and operations," stated Levitt. " A disaster planning and recovery strategy is not a method; it is a medium to sustain … the organization." With this in mind, businesses should make an extra effort to solicit the opinions of all functional areas when putting together a disaster and recovery plan. Facility management areas may be most knowledgeable when it comes to the vulnerabilities of computer systems, office areas, etc., but other areas can often provide helpful information about the areas of the business that most need protection or fallback plans so that the business can continue to operate in the case of a disaster.
RECONCILING FINDINGS WITH PRINCIPLE OBJECTIVES All businesses should be concerned with meeting certain fundamental goals of disaster prevention, safety, and fiscal well-being when working on contingency plans. Analysts offer largely similar assessments of priorities in this regard, although minor differences in nuance and emphasis are inevitable, depending on the industry, the size of the business, and the viewpoint of the analyst. Most experts agree, however, that the primary objectives of a good disaster response plan should include:
Disaster response strategies will vary from business to business, but in the final analysis, they should all be structured in ways that will best ensure that essential business functions can be maintained until operations can be returned to normal.
COMMUNICATION OF PLAN Disaster contingency plans should be widely disseminated throughout the company. All employees should be cognizant of the business's basic disaster plan, but this is particularly important for managers, who are often called upon to make important operational decisions in the aftermath of crisis events.
RECOVERY This final stage of contingency planning is concerned with returning the business to its predisaster competitive position (or at least returning it as close to the position as is possible) and normal business operations in the event that a crisis event does take place. According to Industry Week' s Karen G. Strouse, this entails restoring productivity in three primary areas: people, information, and facilities. "People are the priority," stated Strouse. "You need to account for them physically and emotionally, and enlist them in your recovery efforts…. Contact each employee personally; don't be satisfied with an answering-machine connection. Restoring technology is critical for two reasons. First, most companies rely on technology to conduct day-to-day business. Second, technology may represent your only means of giving your employees, customers, and the media important information as soon as they need it." Finally, Strouse observed that while information and employees are portable, "facilities are not. Your central facilities—mailroom, copy center, file room—need to be restored immediately. Office space is often on the critical path to people and information; without it, nothing else can happen." She also warned business owners to ensure that safe practices are followed when searching for and conducting operations in temporary locations.
Levitt, meanwhile, broke the recovery stage down into two elements: "First is the aspect of planning concerned with providing the resources for recovery. This encompasses the resources of a workplace, equipment, facilities, power, communication capabilities, information and data, forms and other supplies, people, food, lodging, transport, and all else that enables to the business processes to continue or to be re-established—within the planned time-line basis—after being impeded, impaired, interrupted, or halted." The other aspect of the recovery phase, wrote Levitt, is "concerned with impact, consequence and affect mitigation, and damage restoration requisite for the return to as-intended functioning."
Anastasio, Susan. Small Business Insurance and Risk Management Guide. Washington, D.C.: Small Business Administration, n.a.
Arend, Mark. "Time to Dust Off Your Contingency Plan." ABA Banking Journal. February 1994.
Brunetto, Guy, and Norman L. Harris. "Disaster Recovery." Strategic Finance. March 2001.
"Dealing with Disasters Takes Careful Planning Ahead of Time." Building Design & Construction. September 1996.
Head, George L., and Stephen Horn II. Essentials of Risk Management. Insurance Institute of America, 1991.
Karpiloff, Douglas G. "When Disaster Strikes … How to Manage a Successful Comeback." Site Selection. August/September 1997.
Levitt, Alan M. Disaster Planning and Recovery: A Guide for Facility Professionals. John Wiley, 1997.
Mansdorf, Zack. "Emergency Response and Disaster Planning." Occupational Hazards. May 2000.
Myers, Kenneth N. Total Contingency Planning for Disasters. John Wiley, 1993.
Naff, Kevin C. "Can You Plan For Disasters?" Business Credit. October 1995.
Strouse, Karen G. "What If Your Office Vanishes? Practical Advice on What to Do if Disaster Strikes." Industry Week. July 3, 1995.
Thaddeus, Jude. "Disaster Strategy: Bring Continuity from Calamity." Computerworld. February 12, 2001.
SEE ALSO: Crisis Management