Commercial Insurance: What’s In Your Business Disaster Recovery Toolbox?

FIVE PLANS TO HELP YOUR BUSINESS PREPARE, SURVIVE AND RECOVER FROM A DISASTER

We are all too familiar with the images –– business owners sifting through the rubble left after a disaster; food service firms coping with spoilage due to an extended power outage; retailers blocked from their customers due to a water main break which floods the street outside their location. As unfortunate as these events are, they do not need to result in a long, difficult recovery or worse, a permanent closure. In fact, many businesses successfully respond to and recover from natural disasters and other disruptions – in large part due to advance preparation and a planned response.

To effectively and successfully prepare for and respond to unexpected events, a business should have a recovery toolbox. It should contain the right tools to assist with the three phases of a disaster: preparing, responding, and recovering. The goal is to make sure all phases of a disaster have been considered and are incorporated into the business’ plan. Discussed in this article are five types of plans that all businesses should have to ensure a successful disaster recovery.

#1 PREPARE – Business Continuity Plan

A business continuity plan is a proactive strategy with a step-by-step process to minimize a business’ downtime. It gathers needed information and defines the steps required to keep the business running during any type of disruption. These steps allow for continuation of critical business functions within an acceptable timeframe; provide clear and specific recovery responsibilities for key staff members; and assure access to resources such as technology applications, hardware, software, and vital records to respond to the business disruption. An effective business continuity plan also will identify a business’ risks and threats, as well as ways to reduce the disruptions associated with those risks and threats. Documented workarounds and manual processes that should be executed by staff also are key to ensure critical processes are recovered in a timely fashion. The end result is a business that can continue to deliver its critical products and/or services at an acceptable level, even if there is damage to its physical location, inventory, or customary operations.

This tool is easy to find and put into practice. The Insurance Institute for Business & Home Safety (IBHS) has created OFB-EZ™, a free business continuity planning toolkit to help businesses translate professional continuity concepts into an actionable plan. By using OFB-EZ, a small business can take advantage of many disaster planning and recovery best practices without the need for a large company budget. OFB-EZ provides a simple eight-step process, which does not require users to be an expert in business continuity planning.

#2 RESPONSE – Emergency Response Plan

An emergency response plan deals with immediate disaster response needs that are specific to a business’ employees and work site, both during and after events such as severe weather, internal fire, chemical spills or other manmade disasters, civil disturbance, or building system failures. The same risk and vulnerability analysis that serves as the starting point for a business continuity plan will help focus an emergency response plan on things that matter most, and is the first step in this planning process.

The next step is to inventory the business’ work site layout, structural features, and emergency systems in order to describe the detailed actions and steps to be taken immediately after a disaster or disruption. The main areas of focus are:

• protecting and ensuring the safety of employees and on-site visitors;
• initial inspection of buildings and surrounding areas for damage and hazards;
• damage control to minimize further impact to the business’ assets (including buildings, any vehicles and equipment); and
• proper emergency notifications and internal (management and staff) communications.

As an effective planning tool, an emergency response plan should include detailed instructions about how to conduct each of these activities; key staff assignments, along with alternates or backups; and critical time intervals in which each activity should be undertaken. Because an emergency response plan will be activated in a time of crisis, it is important it is written in a way that is easy to understand and implement and kept in a place where it can be easily accessed when it is needed most.

#3 RESPONSE – Crisis (Incident) Management Plan

Once an emergency situation is stabilized and basic operations have resumed, a crisis management plan helps a business move forward. It provides an organizational structure and brings together the right people to make critical decisions, such as prioritizing needed activities and resources and giving direction that will allow staff to work through a disruptive incident.

Although large companies often are able to structure a crisis management team from various areas of the business such as operations, I/T, human resources, communications, legal and finance, smaller businesses generally have to rely on team members who wear multiple hats—with one person serving as the leader. Team members (or at a minimum, the team leader) should be authorized to make decisions on behalf of the business in an emergency capacity.

While business continuity plans document how to continue offering a service or product and emergency response plans deal with staff safety and damage mitigation, a crisis
management plan takes the next step beyond the initial emergency and details immediate actions that should be taken based on how the emergency is affecting people, property, operations, and reputation. The goal is to avoid panic, reduce confusion, and restore normalcy as quickly as possible. Additional information on creating a crisis management plan is available from the nonprofit Emergency Response and Crisis Management (ERCM) Technical Assistance Center at www.ercm.org/crisis-management-plan/.

#4 RESPONSE – Crisis Communications Plan

Information is critical during a crisis; therefore, a crisis communications plan is essential for all businesses large or small. A crisis communications plan is very different from a crisis management plan; it describes how to process information related to the incident and then communicate it to the business’ internal and external audiences. The plan’s goal is twofold:

1. Maintain the business’ brand and reputation by minimizing the repercussions due to untimely or misleading information; and

2. Ensure timely and accurate communications with all stakeholders (employees, the media, customers, suppliers and vendors, key business partners, and the public).

A crisis communications plan identifies:

• Who to communicate with, and who should do the communicating/speaking;
• How to deliver the message, along with a means for communication (a telephone tree, an emergency notification system, website update, news release, social media – Facebook, Twitter, Linkedin, a call-in number, etc.); and
• What to say and what materials are needed (standard responses and scripts, message templates based on the nature of the crisis/disruption, contact information for the business’ internal and external parties, etc.)

Creating a crisis communications plan in advance of a disruption helps to minimize the likelihood of misinformation, ease the communications burden, and increase the timeliness of messaging. Although every disaster has some unique features, thinking about crisis communications in advance allows the business owner to identify what is likely to be needed and make preparations, freeing up time to handle the actual disruption when it occurs. The plan should include strategies, policies, templates and detailed procedures on how and when to share information and with whom. The goal is to gather all critical information in one place, so it is easily accessed and consistently communicated.

#5 RECOVERY – Information Technology

Disaster Recovery Plan Information technology (I/T) is a key component of most small businesses; therefore, it is necessary to have an I/T disaster plan in place to recover the business’ I/T systems, data, and communications if a hardware or software failure or the destruction of the facility should occur. An I/T disaster recovery plan documents the step-by-step procedures to recover the systems, data (e.g., documents, files, records and reports) and applications in an orderly way, based on the pre-determined critical business processes identified in the business continuity plan.

In preparation for a possible technology failure, a business should inventory and document all hardware, software, and vital records (e.g., payroll, tax, accounting and production records). Electronic data should be backed up regularly and stored off-site and, where possible, hard copies of critical electronic files should be kept off-site. In addition, it is important to create a secure copy of computer and Internet log-in codes and passwords. Anticipating that computer equipment may be damaged or destroyed, it also is important to make pre-arrangements with I/T vendors to quickly replace damaged hardware and software.

Information on implementing an I/T disaster recovery plan is available from the Information Technology Disaster Resource Center (ITDRC) at http://itdrc.org/. The ITDRC is an established non-profit organization, and is comprised of hundreds of volunteer professionals from many technology disciplines. They provide small businesses with free resources to continue operations and recover their technology infrastructure following a disaster.

CONCLUSION

Planning for unexpected events does not guarantee everything will remain calm or glitches won’t occur; however, having the right planning tools in place can help more smoothly guide a business through a disruption and its aftermath. Putting it all together – creating a complete toolbox – can help ensure your business becomes a success story rather than a picture of failure the day the unexpected arrives.