State of Readiness

Katrina. 9/11. SARS. These are disasters of such great magnitude, they need only a word or symbol to remind us of the fear, loss and cost of these events.

Other events of a slightly less psyche-scarring magnitude occur on a regular basis — earthquakes, oil spills, hurricanes and pan-regional flooding. Millions, indeed billions, of dollars are lost each year to major disasters. Death and injury, property damage, lost business, rescue and recovery all contribute to their cost.

These are catastrophic events. But mentally at least, it’s easy to dismiss their potential: These will never happen.

Well, they have happened. According to an Angus Reid survey commissioned by American Express, more than two-in-five small business owners in Canada (41%) have previously experienced a significant disruption to their business. Of these, nearly half (46%) were affected for more than 30 days. Eighty per cent were affected for five or more days.

As intelligent beings, professionals, business owners and operators, homeowners and the like, we prepare for disasters and disruptions by creating emergency plans, business continuity plans and crisis plans. We protect ourselves and our investments. Or do we?

It seems we do not. Canadian Manufacturers and Exporters conducted a survey of its membership in May 2009. The results show “87% per cent of the companies participating in the survey indicate their businesses do not have a continuity plan in place to deal with an emergency situation like a pandemic, while 90% are not sure what steps to take to safeguard their operations, including their supply chain.”

If we extend these statistics to small businesses within the Canadian economy, 87% equates to just over 1 million businesses without a continuity plan in place. Here, ‘small businesses’ are considered to have fewer than 100 employees and have a Canada Revenue Agency payroll deductions account (this definition does not include family businesses, contractors and sole proprietors).

Despite the efforts of many emergency managers, disaster recovery specialists, business continuity directors, first responders, insurance professionals and their respective organizations, business continuity plans are not being created. Businesses are not protected. Communities are not resilient.

The Center for Preparedness — formerly the Canadian Centre for Emergency Preparedness — has developed a methodology and a service to help reverse this statistic. B-ReadyNow is aWeb site dedicated to the small business owner or operator. Its main purpose is to help create a basic contingency plan while at the same time addressing the three main challenges of small business operation: lack of time, lack of money or a lack of resources.

B-ReadyNow’s ‘Plan Builder’ allows the user to complete a contingency plan in a few short hours by simplifying the process into six basic steps: knowing the risks, knowing the potential effects of an exposure, developing risk mitigation strategies, completing a plan, coming up with ways to secure communications in the event of an emergency and reviewing and exercising the plan.

Know the risks

Every organization faces operational risks. Some of these risks are acceptable, many are not. This first step guides users to list the greatest risks to their operations, be they closures (due to fire, flood or ice storm), disruptions (by power outage, strike or G20 summits) or losses (related to data, equipment or supply chain). This stage serves as a reminder that some of the effects of a business interruption may not be direct.

Know the impact

Risk is not just about a single event. It escalates, with potentially broader effects on a business. An organization must therefore be able to answer these vital questions: What are the key products or services offered by the business? What are the critical inputs required to produce these key elements? If these critical elements are disrupted, how long can they remain ‘down’ before serious damage is done to the operation?

Develop strategies

You now know the threats, the risks, the critical inputs and their priorities. The boss is saying: “If you bring me a problem, bring me a solution!” What to do?

At this stage of the process, strategies begin to form. Can I afford to lose data? If the answer is no, I might install a back-up and recovery service. What happens if my only delivery vehicle becomes inoperable? I might develop an effective plan to rent or borrow a vehicle or hire a service. Could the power go out? It might be a good idea to practice manual processes such as issuing written receipts, carbon-copy order sheets, cash floats and accounting ledgers.

Complete the plan

This is the document that brings it all together, providing an overview of the problems, the strategies to combat the issues and steps to carry out the strategies. Strategies fall into two categories: mitigation and response. Mitigation strategies become the to-do list to enhance resiliency. Response strategies reduce the effects of a catastrophe should one occur.

Secure communications tactics

Communications media frequently fail in an emergency. How will you communicate with employees, clients and suppliers when these media go down? Every company should have contact lists, which are critical for operating during a disruption. An operation should also develop and practice alternative channels of communication such as phone, fax, e-mail, cell andWeb to ensure that communications are maintained.

Review and exercise

Because businesses are always changing, a regular review of the plan and its components is necessary. Has the operation changed? Do new policies or regulations require a different response or render a strategy obsolete? To keep up with the plan, all employees need to be aware of and practice — i.e. ‘exercise’ — their roles and responsibilities during a disruption. These roles and responsibilities might include the evacuation of a building, treatment of a ‘white powder’ envelope or simply ensuring data can be recovered from a backup. It is far better to learn lessons during an exercise than to fail during an emergency.

With B-ReadyNow (launched on Oct. 4, 2010), the small business owner will now have a viable means of developing effective mitigation and response plans that are basic, simple and action-oriented. Although it is not as comprehensive a plan as most consultants, crisis professionals and executive firms would create, this customized contingency plan might be the first — and only — plan the vast majority of businesses buy into.

———

Business continuity plans are not being created. Businesses are not protected. Communities are not resilient.

———

American Express-Commissioned Survey Conducted by Angus Reid (504 respondents)

Observations:

1) More than two in five small business owners in Canada (41%) have previously experienced a significant disruption to their business. Of these, nearly half (46%) were affected for more than 30 days, and 80% were affected for five or more days.

2) Question: “Which of the following would best describe your efforts to ensure the continuity of your business in the event of a disruption?”

Answers:

a) It is not on the radar — 18%

b) It is lower on the to-do list– 62%

c) It is a priority — 20%