5 tips to help ensure that your business is ready for unplanned disasters
A recent survey shows the majority of small businesses are not prepared should a disaster strike and affect their operations.
Nationwide’s Small Business Indicator survey reports that 68 percent of small-business owners don’t have a written disaster recovery plan even though 49 percent say it would take their business at least three months to recover from a natural disaster such as a flood or tornado.
The U.S. Small Business Administration says businesses that are forced to shut down after a disaster are at risk of not being able to re-open. It can be scary for business owners to think about their operations being shut down, but all businesses have potential threats and risks. As a result, owners and managers of all businesses big and small need to develop a plan for how to protect themselves in case of a disaster, the SBA recommends.
Building and inventory can be lost and destroyed, valuable records can be permanently lost, and business operations can come to an absolute standstill. This could be catastrophic to the business owner. A disaster might occur within the building if a computer system crashes or the system is infected with a virus or ransomware.
No one can control a disaster; however, business owners can take steps to ensure they are prepared to pick up operations or that operations can resume as quickly as possible. Here are some questions to ask:
1. Do I have a plan?
There are things business owners can do to lessen the effects and ensure the assets and personnel are protected. Part of recognizing there could be threats or risks is to make a list of any that could affect the company. This includes the death of a key individual, a cyber-attack or natural disaster.
The consequences of the threat or risk then need to be taken into account: Would there be a loss of sales and income? More expenses? Would customers be unhappy? Could the business receive fines? Do I know where to send payment for bills?
All of this will become part of the business’ continuity plan or disaster recovery plan. While the two are similar, there are slight differences.
A business continuity plan gives procedures and a plan of action to prevent negative consequences from the fallout of a business. It includes how employers and employees will stay in touch and continue to work if there is an event such as a fire at the office. The disaster recovery plan is more focused on how the business recovers after a disaster.
About a quarter of the small-business owners from Nationwide’s survey reported they did not have a written disaster plan because it wasn’t a high priority, yet 22 percent of small-business owners said they have been affected by a natural disaster.
The survey included 502 U.S. small-business owners of companies with fewer than 300 employees. Of these, 284 owners do not have a written disaster recovery plan.
The plan will include step-by-step instructions for how to execute it, and it will address what to do, who should do it and how. Each responsibility should be listed along with the name of the person who will handle it. The reverse also should happen: For each person, list his or her name and responsibility. This will make things easier to locate and is particularly important when it comes to the company’s data and insurance coverage.
“We find that a lot of businesses just assume they have a back-up, that their (information technology) person is handling it, but it’s astounding how many are wrong,” says Alex Romp, president of Artech Solutions Inc. in West Des Moines, a computer hard drive back-up company that specializes in disaster recovery solutions.
Any business continuity plan needs to include these four phases:
• How do critical services get back online if the building is destroyed? Who are the people who need access to the company’s system in order to make sure clients are billed, and vendors and employees are paid?
• How do I prepare for a disaster? Employees need to be trained to know what their responsibilities and duties would be in order to be prepared. Lists need to be made of external contacts and anyone who would need to be called to assist with operational issues.
• What would the new office environment look like? Is it ready to go if needed?
• How would the business transition back to its original state? Does this include a new building, or would the old one be renovated?
The plan will need to be put together in one central location, likely a three-ring binder. The business owner will need to make copies and give them to each individual who is considered key to the business’ operation. Extra copies also will need to be kept off site at the business owner’s home and in a safe-deposit box for safe storage.
2. Does my insurance cover a potential disaster?
Nationwide’s survey revealed that 71 percent of small-business owners don’t have business interruption insurance. This is particularly important to survival since an estimated 25 percent of businesses never reopen after a major disaster, according to a recent release from Nationwide.
Local insurance agents say business owners need to ensure they have the appropriate coverage in place. Business owners can determine whether they have the coverage they need by talking to their agent about any possible disasters and the costs associated with those. The business owner’s regular policy may not cover a flood or earthquake damage, so the owner needs to ask questions and determine whether a separate policy is necessary. It is recommended that business owners pay close attention to clauses, exclusions, values and limits, business interruption, depreciation and other similar issues when considering whether they have enough insurance to protect themselves in a disaster.
The Insurance Information Institute recommends business owners understand all policy details, their deductibles and limits. If a disaster would require the business to be rebuilt or the purchase of new equipment, know whether that is part of the policy.
A disaster can also mean loss of income or the inability to pay bills if the business has to shut down or interrupt operations. The business owner will want to know whether his or her policy covers payments to utility companies or suppliers, and purchase additional coverage if necessary, according to the III, a national organization that educates the public about insurance, how it works and what it does.
There are a variety of commercial insurance options, according to III:
• Building coverage, which provides coverage for the building in case of wind or hail or another covered loss. It does not typically cover floor or storm surge damage, or earthquake or landslide unless added.
• Business personal property covers the contents and business inventory damaged or destroyed by a covered loss.
• Tenants improvements and betterments coverage is for fixtures, alterations, installations or additions to the building that the insured occupies but does not own and has made at his or her own expense.
• Additional property coverage pays for fences, pools, awnings and other items.
• Business income can cover lost revenue and normal operating expenses if the business is uninhabitable during the time repairs are being made.
• Extra expense does what it implies. It covers extra expenses that are incurred such as temporary relocation or leasing business equipment.
• Ordinance or law coverage allows for the rebuild or repair of the building in compliance with local building codes.
3. Would my information be lost?
Any company that uses a computer — and its business operations would be affected if that computer wasn’t working — needs to have a data back-up system in place, data experts say.
“No matter what, people need to have a solution and get the data out of the four walls of their business,” Romp with Artech Solutions says. “If you have some sort of disaster strike — a flood, fire, theft, ransomware — it’s really easy to replace your equipment. Your insurance company will write a check for that. The one thing we can’t recreate is your data.”
About three-fourths of small businesses have duplicated and stored their company’s vital records, according to Nationwide’s survey.
Romp says each business owner needs to have a dedicated employee or service provider who ensures the company’s data is backed-up on a regular basis. The frequency of a back-up will occur depending upon how quickly the company would need to recover should its system go offline. The business owner also needs to ensure his or her information is backed-up to an appropriate, commercial grade system.
Storage of physical back-up data also is important. Some businesses use tapes to back-up their system. Those also need to be stored off-site because fire-proof boxes do not always prevent electronics from melting, Romp says.
Offsite physical storage is important for critical documents such as articles of incorporation and other legal papers, utility bills, banking and human resources information, lease papers, tax returns and more.
Back-ups also will help protect business owners in case their system is attacked with ransomware and they are required to pay a ransom to have their data returned.
“It’s amazing how many places have had to pay ransoms in order to get their data back because when it came time to recover from that their back-ups were incomplete or inexistent or old,” Romp says.
4. How will I continue operations?
Business owners need to consider how they would continue operations should their main worksite be affected. It will help to identify what the business’ most critical activities are and the resources needed to perform them.
This may include taking the steps necessary to allow employees to work remotely in case of a disaster or securing a second workplace site that can be used.
Nationwide’s survey showed that 82 percent of small businesses have plans like this in place.
Part of the plan will include key personnel who perform functions without which the business cannot operate. The plan will include these individual’s contact information and any way they can be reached during an emergency situation.
The back-up location could be at a hotel, contractor’s office, an attorney’s office, or even a storage rental facility that is set up as an office. If a designated location has been determined, include a map of this site in the business continuity plan.
Business owners also should keep a thorough inventory of their equipment, which includes values and serial numbers, and off-site storage of receipts. This list will include all critical equipment and software and how to access it with passwords, identification data and the location of important files. If this equipment were to be compromised or lost, the plan should include information for how the business will function without it.
The contingency plan also will consider what services are critical to the everyday operations of the business and how the owner will locate those. For example, will the company need to rent trucks or other equipment to be used for everyday business, or will they have to rely on external business services for basic items such as photo copies, faxes and printing?
Business owners also need to remember their customers. One of the most important actions they’ll take is devising a communications strategy that will consider of contacting clients by phone, email, mail or a newspaper notification to inform them what has happened and what actions the business will take as a result.
5. Are there external resources that can help?
The Small Business Administration has a template for disaster preparedness and recovery plans available on its website: www.sba.gov.
The SBA provides resources that business owners may be eligible for in time of disaster. Field Operations Centers are a resource for business owners who may need to apply for a disaster loan, which can help repair damage or help sustain cash flow.
The SBA recognizes the importance of helping small businesses recover and calls them the “local economic engine” that are critical to a community’s character.
Government authorities monitor some businesses more closely than others, so business owners will need to incorporate this in their disaster plans. Fire departments may want to know what a business’ evacuation plan is and whether employees know how to safely exit the building.
The Federal Emergency Management Agency or local municipality might become involved depending on the severity of the disaster. Making contact with those agencies and receiving a contact ahead of a disaster can help the business owner more quickly access their building and receive information in case something happens. Determining all parties that might be involved can help the business owner recovery more quickly. ♦