In December 2008, an ice storm crippled the Northeastern states. The ice closed roads and brought down power lines, leaving some areas without power for the best part of two weeks. The winter of 2009/2010 has brought record-breaking snow and rainstorms across the country. The west coast states live with the threat of earthquakes and are regularly visited by wildfires and mudslides. Tornados tear up towns in the heart of the nation. Hurricanes batter the southeastern states.

Natural disasters are headline-makers. But for a small business, a disaster does not have to be as impressive. A failed hard disk drive with no backup of the data, a burst water pipe flooding the basement where your server and your paper files live, or a road accident involving a critical employee, any one of these can bring a small business to its knees or force it to close for good.

Many, if not most, small businesses are not adequately prepared for problems. According to a September 2007 BtoB magazine survey, almost two-thirds of all companies do not have a disaster plan. The Institute for Business and Home Safety estimates that a quarter of affected businesses do not reopen following a major disaster. Being prepared with a disaster plan can help you to avoid problems that you can anticipate, lessen the impact of events that occur without warning, and help you successfully recover your business.

A thoughtful disaster plan shows others that your business is efficient and organized. This is a rarely considered but significant further benefit of the plan in that it may help reduce insurance costs and increase your chance of a small business loan.

Planning for disaster is basically a three-step process. First you identify and analyze the risks. Then you identify the various ways that you can mitigate those risks. Lastly, you write a disaster plan to inform you, your employees, and other interested parties of necessary actions and information if an emergency should occur.

Analyzing Risk

Risk analysis is mostly a thought exercise. Brainstorm, on your own or with others who know your business such as your employees or your spouse. Write down all the risks that you can think of, no matter how unlikely or disastrous you consider they may be. Don’t dismiss a risk as just too disastrous to contemplate or so rare as to not be worthy of inclusion. Just adding it to the list may trigger other thoughts.

The following list is not exhaustive but will serve to spark your thoughts:

  • Loss or theft of critical business data. This is the most common business disaster.
  • Natural disasters. Hurricane, tornado, earthquake, wildfire, mudslide, snow and ice storms.
  • Geographic location. FEMA publishes data on the relative risks of natural disasters in each state.
  • Ongoing financial responsibilities. For example, are you responsible for rental payments even if the property becomes uninhabitable?
  • Flooding. Burst water pipe, burst dam, or rain storm.
  • Riots and civil disobedience. Do you live next to or serve an abortion clinic or another possible target of public anger and violence?
  • Legal action against you, an employee, or your business. Libel, personal injury, property damage, and so on.
  • Terrorism. Bomb, toxic contamination, cyber warfare, and so on.
  • Illness affecting you, your employees or other companies that you serve or that serve you.
  • Road or other accident rendering you or a critical employee unable to work.
  • Jury duty or military service rendering you or a critical employee unable to work.

Once you have your list of risks, rate each one in terms of the probability that it will occur and the severity of the occurrence to the business. You will then have a league table of the risks, with the most likely and most damaging risks at the top.

Mitigating Risk

Take your list and start to think of things you can do to eliminate the risk or reduce its impact on the business. Start with the most important items at the top of the list. Once more, it is helpful if you can share the process with others, and write down all the ideas that occur to you, no matter how extreme.

Mitigation strategies may or may not involve cost. Installing hurricane-proof windows will be far more expensive than fitting plywood over the windows when a storm is forecast. Insurance costs vary depending on your location, the depth of coverage, and how much deductible you are prepared to accept. Moving your server and files from the basement to the second floor will cost your time over a weekend.

This list of mitigation strategies offers you ideas on which to build:

  • Assess your insurance coverage. It is vitally important, even if you are insured already, to examine the policy thoroughly. Too many people only find out too late that their flood insurance only covers damage to the building and fixtures, but not personal and business belongings and equipment, loss of business, and so on.
  • Take a photographic record of property and equipment.
  • Establish regular property and equipment maintenance. Is this the responsibility of a landlord?
  • Establish regular and offsite data backup and storage.
  • Consider alternative means of communications. Telephone, internet, alternative mail address.
  • Keep offsite copies of important paper records. Insurance, contracts, estimates, receipts, and so on.
  • Establish a disaster survival kit. Radio, food, water, camera, first aid kit.
  • Purchase a portable generator and fuel.
  • Set up an alternative business location.

Writing and Publishing a Disaster Plan

Many of the mitigation steps that you will identify will be things that you or others can do to increase personal safety once the disaster is forecast or has occurred. For example, what are the escape routes from the building in a fire, what are the actions to take when a tornado hits, how near must the anticipated hurricane landfall be to take various actions, and so on.

An effective up-to-date, and well-communicated disaster plan can save lives, reduce injury, and make the difference between being shut down for a few days and losing your livelihood.

In writing your disaster plan for your business, remember that lives come first, families come second, the business comes last. This is true for you as well as your employees. Your business may mean everything to you, but people are more important. So the first actions in meeting any risk are to protect people from death or injury. When you are convinced that everything has been done in this regard, then address the needs of families. Particularly in a disaster, families need information on loved ones that may be away at work, and employees need information on the safety of their families. Don’t forget that your employees may have important personal issues to deal with so you cannot depend on employees reporting for work. Conversely, if the business is in a condition such that employees should not come to work, then you should inform them as soon as possible.

In the aftermath of a disaster, your employees’ thoughts will quickly turn to the future. Will they still have a job? If not immediately, then when will the business be back in operation? If the business is down for a week or two, will they still be paid in the meantime? You may wish to address these questions in the plan, particularly if you are dependant upon certain key employees. However, it is difficult and probably foolish to make commitments on questions such as this when dealing with the uncertainties of the scale and effects of possible disasters.

Here is a list of some of the topics to consider publishing in your disaster plan:

  • Important numbers and addresses. Your own, your employees, hospitals and medical centers, local fire and police, insurance company, local small business administration, federal emergency management agency, and so on.
  • A designated central point of contact for employees, families, vendors, customers, and other interested parties.
  • Location of back-up records and authority for access to those records.
  • Usernames and passwords for communications systems, backup records, and so on. This should be a separate record held with a trusted employee, family member, or attorney.
  • Employee’s roles and responsibilities with backup for missing people
  • Clear communication of business status to employees – have they still got a job?
  • A designated person or PR company to publicize, if valid, that your company is still open and on the road to recovery, to dispel rumors of business failure.

Keep the Plan Current

Doing this exercise is a complete waste of time if you do not then keep the plan current. Reassess the risks and mitigations at regular intervals. Things change frequently in business. Personal circumstances change. Employees come and go. Insurance policies change. The local fire station may close.

Revisit your disaster plan often. Make a regular monthly appointment to review the plan and update the contents with any changes to the information it contains. Risks and mitigations change less frequently, but keep up the discipline. Review your notes every three or six months to see if anything has changed in your determinations.

Keep the words of President Dwight D. Eisenhower in mind:

“In preparing for battle, I have always found that plans are useless but planning is indispensable.”