California wild fires. Hurricanes devastating the coasts of Texas, Florida, and Puerto Rico. Cyber security threats that hit every level of our local and national governments, corporations, and, yes, even small businesses.
When those breaking news headlines hit our television screens—what seems to be an almost daily occurrence—we think and talk about the people who are affected, the homes, the schools, often the hospitals. But how often do you think about the impact on businesses?
Creating a Disaster Preparedness Plan for Small Business
Whether natural or manmade, large or small, disasters and emergencies can have a dramatic impact on your company’s infrastructure, profitability, and ultimately your ability to keep your doors open. In fact, almost 40% of small businesses do not re-open after a major natural disaster. If you don’t want to fall victim to this statistic, you need a solid plan in place before disaster strikes.
If you don’t already have one, then the time is now to create your disaster preparedness plan. Let’s take a look at the steps you should take right now to evaluate potential threats to your business and keep your company safe in an emergency.
Assess and Prioritize Potential Threats to Your Business
To go about creating a disaster preparedness plan for your business, you first have to understand the problem. Start by thinking about those obvious situations that could pose a risk, such as a fire, flood, or other major weather event.
But what about the less obvious disasters?
Do you have protections in place against cyber threats? Do you know what to do in case of an active shooter or other criminal situation? Are there threats of bodily injury or contamination posed as supplies or equipment at your workplace?
The wide range of potential disasters facing your business can be enough to leave you paralyzed. In reality, though, different scenarios pose a different level of risk to your individual business depending on your location, industry, and other factors.
If you’re not sure where to start assessing potential risks, take a look at the U.S. Small Business Administration’s risk assessment checklist. It will help you evaluate each potential risk factor by probability and impact in order to better prioritize your disaster recovery planning.
Starting With Survival: Your Small Business Emergency Action Plan
In those critical first minutes when a natural or man-made disaster occurs, your immediate priority is always the protection of human life. So, the initial piece of your disaster preparedness plan should focus on creating and communicating procedures that will keep the people who make up your small business safe in an emergency situation.
Identify Emergency Response Requirements and Objectives
The exact needs of your emergency response plan depends on your industry, size, location, and the highest priority risks you’ve identified for your business.
As you develop your business’s response plan, consider the requirements that may be put in place through these three key factors:
1. Regulatory Requirements
Some aspects of your small business emergency action plan are dictated by local, state, or federal law. The U.S. Occupational Health and Safety Administration (OSHA), in particular, details required emergency response guidelines for any business with more than 10 employees.
Fortunately, OSHA offers extensive online tools that can help you follow their standardized guidelines, including fire safety requirements, evacuation plan regulations, and expectations for emergency preparedness kits for your facility.
In addition to OSHA guidelines, industry-specific regulatory agencies might have additional requirements for the handling of hazardous waste, heavy equipment, or other business specific materials or processes. If you were required to apply for an industry-specific permit when you opened your business, we recommend contacting the permit-issuing agency for more information about specific requirements that may apply to your business.
2. Public Emergency Services
Local public services such as your city fire department and police force are committed to helping businesses craft a disaster preparedness plan. As you develop your business’ emergency response plan, consider reaching out to these entities to provide guidance, review the plans you put in place, and share contact information and communications procedures for outside community resources.
3. Business-Specific Emergency Preparedness Needs
Although the guidance of regulatory bodies or emergency service personnel will go a long way toward helping you develop your emergency response plan, certain preparedness needs will be unique to your individual business and facility. To develop a plan that is actionable for your specific business and location, combine the guidelines of outside experts with what you know about your facility, your team, and how your business runs from day to day.
Consider, for example, the layout of your facility, the work schedules of various personnel, and in particular the best course of action for any individuals with special needs.
Assemble Your Written Disaster Preparedness Handbook
One of the most challenging aspects of preparing for an emergency is that you don’t know when disaster will strike and who will be available if a need arises. Overreliance on one or a few individuals can be dangerous, because you can never predict whether they’ll be available to communicate plans when needed.
Committing the details of your response plan to writing ensures that available personnel know what to do—even without direct communications with a specific individual or department.
To be most effective, your written emergency response plan should be clear, actionable, and well-organized, providing as much detail as possible while also allowing personnel to quickly access the information they need in any given scenario. If you’re not sure where to start, FEMA offers a 10-page, fill-in-the-blank template that can help you create a written version of your business’s emergency response procedures.
Discuss Your Emergency Response Plan With Team Leaders
A written response plan is a critical starting point for arming employees with the same information. Even so, at the moment when disaster strikes, a written handbook stuffed in a drawer will do little to keep you and your team safe. To be truly effective, your emergency response plan has to be communicated, refined, and tested so that all stakeholders know how to proceed.
Putting your emergency response plan into action should start with a conversation around the conference table with department leaders from all areas of the business. Walk through the plan for each scenario, and allow plenty of room for feedback.
At this stage, you want to approach the conversation as a brainstorming session, not an edict from the top. Remember, your business’s field supervisors, foremen, and shift managers are the best equipped to understand how a response plan will play out in action on the ground-floor of your business. They can spot holes in your processes and help to better communicate response plans among personnel. But in order to get full buy-in and benefit from this expertise, you must first show genuine interest in their point of view.
Run Company-Wide Emergency Response Simulations
Once you’ve completed a tabletop walk-through and implemented the feedback you receive, you’re ready for a more hands-on approach to testing your disaster preparedness plan. Depending on the size of your business, it’s wise to conduct live action drills at least once a year for each of the highest risk emergency scenarios you may face.
Follow each live action response drill with a post-mortem among team leaders to discuss challenges, miscommunications, and any potential changes. Also consider distributing a survey to non-management personnel to account for any miscommunications between team leaders and those who have no advance knowledge of the drill or how they are supposed to respond.
Getting Back to Business: Your Continuity and Recovery Plan
When an emergency or natural disaster occurs, your first and greatest priority as a business owner is of course to account for the physical safety of your personnel, your customers, and yourself. But once the initial danger passes, your business’s long-term survival depends on your ability to resume normal operations with minimal disruption.
For this reason, an emergency response plan alone is not enough to truly protect your business from disaster. You also need a longer term business continuity plan that lets you re-establish the most critical functions of your business quickly and with minimal financial impact.
Analyze the Business Impact of a Disaster
Every business exists to generate a profit, and that requires bringing in more revenue than you spend. But as you might imagine, recovering from a disaster tends to be a pretty expensive endeavor—one that can turn an otherwise financially stable company on its head. There are financing options available to businesses that have be impacted by disasters, like SBA disaster loans.
Let’s take a look at the seven most common business impacts that you should be prepared for in the wake of a major business disruption:
1. Lost Sales and Income
Obviously if your business is doors closed due to a disaster, the most immediate consequence is the loss of sales you could have been generating during that time. Calculate your business’s average daily sales volume times the number of days that you can expect to be closed for any given type of disaster. That’ll give you an idea of the immediate financial impact.
2. Delayed Sales or Income
Even once you manage to reopen your doors, the availability of personnel or disrupted supply lines might impact how quickly your sales return to pre-disaster levels.
3. Increased Expenses
Clean-up from a major disaster may require new equipment or materials, the replacement of damaged inventory, as well as overtime labor for your employees in order to get things back on track.
4. Regulatory Fines
Adding insult to injury, in certain situations your business might face fines or penalties from industry and government regulators for noncompliance— particularly if such noncompliance directly contributed to creating the disaster. If your business operates in a heavily regulated industry, consider in advance how compliance issues might impact your disaster recovery plan.
5. Contractual Penalties
Does your business carry major contracts as a vendor or supplier? You might carry a penalty or face the loss of a bonus because of a delay in providing your product or service. In the wake of a disaster, delays are inevitable—but you need to factor in how those delays could affect your contracted revenue.
6. Customer Dissatisfaction or Loss
We all hope that in the face unforeseeable natural disaster, customers would be patient in allowing small businesses to get back on their feet. Unfortunately, though, sometimes the customer simply can’t wait to obtain the product or service you typically provide. Expect a small percentage of regular customers to view your delay in products or services as an opportunity to check out a competitor.
7. Delay of New Business Plans
When you’re doing all you can just to get your business back on its feet, you can’t expect that you’ll have much time to pursue the new or expanded business ventures you may have previously been planning. You’ll have to put any new revenue projections on hold while you focus on getting your core business back in line.
With these potential financial disruptions in mind, it’s easier to imagine why, even among the 60% of small businesses that do open reopen after a major disaster, another 24% will find themselves out of business within two years after the event.
However, by fully realizing the impact that your business faces, you’re already well on your way toward overcoming that statistic with a comprehensive disaster preparedness plan.
Plan Your “Get Back to Business” Strategy
In every aspect of your business, time is money. Once the immediate danger of a disaster has passed, every minute of disruption to your business’s regular operations is another dollar lost. It’s critical that your team has a plan in place to get back to business as quickly as possible.
But getting back to serving your customers and generating revenue doesn’t necessarily require that everything is immediately “back to normal.” Instead, you can maximize recovery efforts by focusing first on the individuals, resources, and processes critical to your business’s most revenue-centric core business functions.
To help you identify these most necessary assets, we recommend organizing your business’s needs according to the following categories:
If your business needs to operate with merely a “skeleton crew,” which individuals or roles are the most critical for serving customers? Make a list of your most critical personnel, as well as backup team members who have the skill set to fill each role if the need arises.
If you lose access to your primary facility for doing business, what kind of facility would your team need to function? Could you work from an alternate location or resume operations using only a part of your existing facility? Could certain team members to work remotely until your main office or facility is back to normal operations?
Connectivity to outside utilities or systems such as electricity, water, heating and cooling, and internet or phone service are just a few of the systems that might be necessary for your business to function normally. What contingency plans could you put in place in the event that one or multiple of these systems were non-functioning?
From computers to company vehicles and major manufacturing machinery, what pieces of equipment are most critical to your business’s core operations? In a worst-case scenario, what is the minimum equipment needed in order for your business to continue serving customers?
Materials and Supplies
Particularly when a major natural disaster occurs, your individual business might not be the only entity facing delays to normal operations. How might disruptions to your supply line of materials, supplies, and inventory impact your business’s ability to function? How much stock inventory or materials do you maintain on hand, and how long could your business continue operating in the wake of a shipment delay?
Data and Information Technology
As our businesses rely more and more on electronic records and accessibility, data security is more critical than ever to restoring the normal functions of a business after a disaster. In fact, the risk of a data breach is in itself among the most likely and the most significant emergency scenarios that your business may face!
How often is your business’s informational data backed up? Are electronic records stored locally, or through off-site “cloud” storage solutions? What protocols do employees follow for password protection and other security measures?
In addition to the implementation of a physical recovery plan, it’s important to develop a concurrent IT recovery plan that addresses technology-specific aspects of your business continuity efforts. The Department of Homeland Security’s Ready.gov resource guide is a great place to begin your IT recovery planning process.
Once you’ve identified and prioritized the most critical roles, facilities, equipment, and materials needed to re-establish core business operations, you’re ready to create a plan that addresses potential disruptions to each function. We recommend starting this process with FEMA’s resource requirements checklist. Then develop written protocols that detail how your team should go about restoring each critical function.
Test Your Disaster Recovery Process
While a regularly recurring company-wide drill might not be appropriate for longer term business continuity planning, it’s still critical that you talk through, test, and refine your plans for these longer term recovery efforts.
For each high-risk business disruption scenario you’ve identified, you need to gather the key personnel involved in the recovery effort to walk through the procedures. While this testing process may not re-occur as frequently as an evacuation or shelter-in-place drill, be sure that you do re-evaluate the protocols any time there’s a major change in your personnel or your business processes.
Obviously, frequent disaster recovery planning and testing of this magnitude can become a burden on any small business. To minimize the time and workload required, recovery plan experts recommend focusing on process failures instead of on specific events.
For example, your response to a power outage throughout your building will likely be relatively similar regardless of the type of event leading up to the outage. By focusing your testing on response to the power outage (rather than the tornado, winter storm, or downed power line), you’ll avoid repetitive testing of the same protocols.
Review and Refine as the Business Changes
The initial development and implementation of your business’s emergency response and disaster recovery plan will likely be the most time-intensive part of your process. But keep in mind that preparedness planning is not a one-time event.
Your business is an entity that is constantly evolving and changing. Personnel comes and goes. New facilities, equipment, or business processes will require changes to your contingency plans. At every step, your disaster preparedness plan should be seen as a living document that adapts to meet your business’s ever-changing needs.
For most business owners, the ultimate question is not if, but when you’ll be faced with a major emergency or business disruption. That’s why, although disaster preparedness planning is hardly any entrepreneur’s favorite topic, it is of critical importance for any small business that wants to succeed in the long term.
By following the steps to create a thorough disaster preparedness plan for your business, you are making the ultimate investment to make sure that the business you’ve worked so hard to build can continue to thrive for years to come.