According to FEMA, 40% of small businesses never reopen their doors following a disaster, and as recent events have demonstrated, no company is immune from experiencing crises. However, those that prepare in advance by creating and testing response plans and then react quickly and decisively when faced with a crisis improve their chances of recovery and often emerge as more resilient and innovative companies. While chance certainly plays a role in many disaster events, as Louis Pasteur once noted, “chance favors the prepared mind”.
Part of the mission of the ’Cane Angel Network is to provide entrepreneurs and the investors who back them with the resources to best position them for success. Proper preparation for unforeseeable events is a sign of a well-managed business, and something investors should look for when assessing the riskiness of an investment. Below is an overview of two types of response plans – Emergency Response Plan and Business Continuity Plan – and best practices related that companies use to prepare in advance of disruptions to their operations.
Emergency Response Plan – Protection of people, property, and assets.
Your emergency response plan (ERP) should enable your company to prepare for and respond to disasters that affect your people, plant, or equipment. The ERP is a disaster-specific plan that should provide the step-by-step tactical response to each type of disaster your company might experience.
Business Continuity Plan – Maintain Critical Business Operations.
Once the protection of people, property, and assets is complete, your business continuity plan (BCP) should be activated. This plan identifies critical business processes and enables the company to maintain operational continuity after a disruption. The BCP is an incident-agnostic plan that should provide the overall strategy, governance, and recovery playbook to follow during a disaster.
Source
Step 1: Risk Assessments
- Conducting risk assessments will identify the threats your business is most vulnerable to and allow you to develop response plans and mitigation strategies for those most common and/or severe risks.
- A thorough risk assessment should explore the specific types of threats to your organization such as Natural (i.e. hurricane), Man-Made (i.e. active shooter), Biological (i.e. pandemic), and Technological (i.e. network outage).
- It should then rank the risks identified based on their Probability, Severity, Warning Time, and Duration to provide a prioritized list of the most disruptive risks to your organization.
- Your risk assessment results should form the basis for developing your incident-specific emergency response plan.
Risk Assessment Resources
Step 2: Business Impact Analysis
- A business impact analysis (BIA) aims to study your core operations (business processes) to identify which of those is most critical to sustaining operations.
- The BIA should identify the impact to the organization (from an operational, financial, and reputational standpoint) when a business process is disrupted and should identify all the supporting resources needed for each business process (technology, equipment, vital records, dependencies) in order to understand the components required for recovering and operating.
- Based on the BIA results, your organization should have a prioritized list of business processes (and their supporting resources) so that your response to a disruption follows an orderly, predictable, and prioritized recovery playbook.
Business Impact Analysis Resources
Step 3: Recovery Strategy and Plan Development
- Once the BIAs have been completed, each department should conduct recovery strategies for their business processes.
- The recovery strategies should provide a step-by-step playbook on how to operate that business process without your typical resources. These might include Relocation information (in the event your facility is inaccessible), Manual Workarounds (in the absence of key systems or records), Outsourcing instructions (if a vendor/third party can assist with your operations) or Transferring Work (if others internally can assist).
- Although each disaster is unique and will have certain unexpected nuances, the recovery playbooks should outline key tasks, recovery details, required resources, and personnel in as detailed a setting as possible. This will help to eliminate unnecessary surprises during a recovery and keep operational downtime to a minimum.
- Although no recovery plan is perfect, these pre-determined step-by-step playbooks will help to ensure your organization is better prepared to handle disruptions and make your response to disasters as efficient and repeatable as possible.
Business Continuity Plan Resources
Step 4: Testing, Training, and Maintaining
- Following the development of the plans, plan reviews, tabletop exercises, or full-scale exercises can be used to simulate a real disaster and put employees ‘through the ringer’ in as much of a realistic scenario as possible to rehearse response and recovery from a disaster.
- Having the plans and procedures in place are a great start, however the plans are only as good as they can be executed by the employees. All plans will have gaps in them – it is critical to understand and resolve these gaps as much as possible during the testing phase, in advance of an actual disruption.
- Any lessons learned during an exercise (or during a real disaster) should be incorporated back into your plans to create a cycle of continuous improvement and maintain as realistic and actionable plans as possible.
Testing and Exercising Resources
Source
“By failing to prepare, you are preparing to fail.” – Benjamin Franklin
“She stood in the storm, and when the wind did not blow her way, she adjusted her sails.” – Elizabeth Edwards
The two quotes above capture the importance of preparedness and resiliency planning. Companies that develop and exercise plans to prepare for disasters, while also maintaining a level of flexibility and agility to take decisive actions during, can better handle the unexpected during a disaster. The current COVID-19 disaster shows that no organization is immune from experiencing crises, but by creating a culture of preparedness within your organization you can position the company to persevere and innovate through the crisis.
This page was written by Aron Baigelman and Jeffrey Camp. Mr. Baigelman is a member of the Cane Angel Network investment team and is pursuing his MBA at UM graduating in 2021. Mr. Camp is the Managing Director of the Cane Angel Network.
