Preparing For The Worst

As strange as it sounds, a sailboat torn from its moorings on the Chesapeake Bay nearly sank operations at a Maryland bank.

That was in October 2003, when the remnants of Hurricane Isabel clobbered the Bay. At the storm's peak, winds ripped the sailboat from its slip and drove it into a power station, sparking a fire that knocked out power to a nearby branch of BankAnnapolis, a community bank based in Annapolis, Md.

"But we were ready," recalls Mike Haske, the bank's vice president of technology. "We had a disaster plan in place, and we were prepared to deal with whatever Isabel threw at us."

Not all small businesses are as fortunate, however. Consider the devastation along the Gulf Coast brought on by the wave of hurricanes—particularly Katrina and Rita—in late summer, and you soon realize the impact a disaster can have on a business.

Even so, only 38 percent of small businesses in this country have any type of emergency preparedness plan, according to a study by the National Federation of Independent Businesses, a small-business advocacy group in Nashville, Tenn. The other 62 percent will have to weather disasters on the fly.

To prepare for a disaster, whether natural or man-made, a company must have a three-pronged strategy. The first part is the physical plan, which must include both a response and a recovery approach to ensure the welfare of the company's people and assets. Secondly, a business needs an economic plan that takes into account the long-term and day-to-day needs of maintaining the company in the wake of a disaster. And finally, there must be a dissemination plan to make sure the company's employees know the disaster strategy and are kept abreast of any changes.

Working without such a strategy is a bad gamble, says Kristen Noakes-Fry, disaster planning research director for the Gartner consulting company of Stamford, Conn. A ready-to-roll disaster recovery plan can make the difference between a manageable business interruption and financial catastrophe, Noakes-Fry says.

"It's something that everybody needs to have in place," she says. "A hurricane can hit a small business just as easily as a large business."

Averting a Crisis

Any disaster plan should detail how to respond in three areas: physical, economic and financial.

At a minimum, a company should plan for the immediate physical safety of its employees and business site, says Richard Breazzano, a counselor for the Orlando, Fla., chapter of the Score Association, a nonprofit organization in Washington, D.C., that provides small-business advice and training. Business owners, Breazzano says, need to ask themselves a series of questions: "Do we have a flashlight with batteries in it? A power generator? Some tarps?"

Depending on the type of business and its customers' service needs, a company also might want to consider purchasing a generator to provide temporary power to keep systems up and running before, during and after a disaster. If a company calculates the cost of lost business for set periods and considers its disaster risk factors (such as its location in a major hurricane zone, for example), then it can evaluate the investment value of a generator.

The physical-response plan needs to include procedures for regrouping the workforce. Employee coordination is important to business recovery, says Donna Childs, CEO of investment firm Childs Capital, whose New York headquarters was shuttered for weeks after the Sept. 11, 2001, terrorist attacks. Business owners need to assign duties to specific employees. "You need to note who has the data backups, the keys and the knowledge to get a business restarted," she says.

Businesses should also make sure that critical data is routinely backed up and stored in a safe location.

Although Stephan, Oringher, Richman and Theodora, a Los Angeles law firm, has never suffered a disaster worse than an occasional computer failure, IT director Chad Cooper is well prepared for whatever fate may throw at his company. The law firm has invested in technology to back up and safeguard its critical data, including uninterruptible power supplies and line filters to keep its systems running even if power fails or falters—as it did in September when a utility employee cut a power cable and caused a sweeping blackout across Los Angeles. Cooper also has installed software to secure and replicate data.

"We have a strong earthquake potential, as well as the risk of having a power outage at any time," Cooper says. "Also, being in a high-rise building, we're susceptible to things that happen above and below. If the water main breaks above you, it becomes your problem."

The physical recovery plan should include a current list of office furniture, business machines, and IT and telecommunications equipment. It's a good idea to designate someone in the company to update this list regularly. "These things change constantly, and if you don't have an official list somewhere of everything you have, you're going to have a problem," Gartner's Noakes-Fry says.

Navigating Rough Waters

An economic plan must emphasize how to keep a business afloat in the wake of a disaster. It should list and describe insurance coverage—including claims contact information—as well as various government agencies and utilities that can help the business. You'll need all this information for your systems and your IT service providers, too.

Some companies establish a rainy-day fund with enough cash to sustain the business—buy new IT gear and acquire temporary processing services through third-party IT vendors—for a month or so without revenue. Your business executives need to consider what resources are available for an emergency loan if you need to finance long-term operations or reconstruction, Noakes-Fry says. You'll want to talk to your banker about these possibilities in advance so that the policies and loans can take effect quickly, she adds.

The financial plan is the day-to-day counterpart to the broader economic plan. To support the financial response, a company should analyze the effect various types of short- and long-term shutdowns will have on its ability to remain open for business. With that information in hand, a company can identify steps to minimize the impact for distinct scenarios, Noakes-Fry says. As part of the analysis, Gartner recommends that a company develop a flowchart for all its processes, so that any manager can take over in a pinch. Maybe, for instance, a business can limit some of its IT services to support primary work and keep revenue coming in. A final suggestion: Include a list of contacts among customers and suppliers who can help the business restructure its production and delivery schedules.

Perhaps the most important aspect of a disaster recovery plan is its dissemination. A plan won't help if no one knows there is one or what it entails. Discuss the plan with employees and make sure everyone has a copy. And keep copies of the plan in several places to increase the chances that managers can get to it after a disaster.

Disaster is a subject no business owner or manager likes to think about. Yet inaction won't make a disaster less likely to happen and will, in all probability, heighten its impact.

BankAnnapolis' Haske likes to believe in the maxim that action can ward off danger: "If you plan for the worst, it never happens."