14.1 Icebergs

Learning Objectives

  1. Understand the kinds of disasters that can face a small business.
  2. Understand why disaster planning is important to a small business.
  3. Describe the process of disaster planning.
  4. Describe the sources of disaster assistance for small businesses.

A natural or a man-made disaster is but the tip of the iceberg. Planning for the complexity of what lies below the tip is important for every small business. Small- to medium-sized businesses are the most vulnerable in the event of a disaster.“Planning Can Cut Disaster Recovery Time, Expense,” US Small Business Administration, accessed February 6, 2012, archive.sba.gov/idc/groups/public/documents/sba_homepage/serv_da_dprep_howtoprep.pdf. It has been estimated by the US Department of Labor that 40 percent of businesses never reopen following a disaster. At least 25 percent of the remaining companies will close within two years. The Association of Records Managers and Administrators estimated that over 60 percent of small businesses that experience a major disaster close by the end of two years.Darrell Zahorsky, “Disaster Recovery Decision Making for Small Business,” About.com, accessed February 6, 2012, sbinformation.about.com/od/disastermanagement/a/disasterrecover.htm.

Given these odds, planning for disaster recovery makes great sense—even if, in the end, walking away makes the most sense. If a small business owner decides to rebuild, the process can begin after human health and safety are restored, the electricity is back on, and transportation is up and running. Everyone will want life to return to normal following the destruction, but that may not be possible for every small business. The market may change. Conditions may change, and a business must change to succeed in disaster recovery.Darrell Zahorsky, “Disaster Recovery Decision Making for Small Business,” About.com, accessed February 6, 2012, sbinformation.about.com/od/disastermanagement/a/disasterrecover.htm.

Disaster Planning

In the film Apollo 13, astronauts and engineers went through seemingly endless simulations of what might go wrong on a flight to the moon. The astronauts complained that some of the scenarios were unrealistic and almost impossible to occur. But when a near disaster occurred on Apollo 13, the engineers and astronauts were confronted with a problem that had never been considered; however, because of their prior experience with disaster training, they were able to develop a solution.

Rather than being negative, anticipating what can go wrong can be profoundly positive through either prevention or quickly responding to a crisis. The wise small business owner should appreciate Murphy’s Law (“Anything that can go wrong will go wrong”) and Murphy’s first corollary (“And it will go wrong at the worst possible moment”). The most pragmatic small business owner will also realize that Murphy was an optimist.

The Federal Emergency Management Agency declared 741 natural disasters in the United States for the period 2000 to 2011. Of that number, 66 percent were declared across the following six states: Texas (#1), California, Oklahoma, New York, Florida, and Louisiana (#6). However, every state and territory was represented.“Declared Disasters by Year and State,” Federal Emergency Management Agency, accessed February 6, 2012, www.fema.gov/news/disaster_totals_annual.fema. Planning for the aftermath of severe storms, flooding (e.g., perhaps snow melts too fast), fire, a hurricane or a tornado, a terrorist attack, or—in some areas—an earthquake is the key to getting back to business with a minimum of disruption. Not all businesses will face the same likelihood of these disasters occurring, but everyone faces the possibility of fire, severe storms, and flooding. Every situation will be unique, with the complexity of issues depending on the particular industry, size, location, and scope of a business.“Planning Can Cut Disaster Recovery Time, Expense,” US Small Business Administration, accessed February 6, 2012, archive.sba.gov/idc/groups/public/documents/sba_homepage/serv_da_dprep_howtoprep.pdf. The widespread nature of a the typical disaster means that public services, such as police, fire fighters, and medical assistance, will be unable to reach everyone right away. A business might be going it alone for a while.F. John Reh, “Survive the Unthinkable through Crisis Planning,” About.com, accessed February 6, 2012, management.about.com/cs/communication/a/PlaceBlame1000.htm.

According to a recent poll conducted by the National Federation of Independent Business, man-made disasters affect 10 percent of small businesses, and natural disasters have impacted more than 30 percent of all small businesses in the United States.Darrell Zahorsky, “Disaster Recovery Decision Making for Small Business,” About.com, accessed February 6, 2012, sbinformation.about.com/od/disastermanagement/a/disasterrecover.htm. Man-made disastersA disastrous event caused directly and principally by one or more identifiable deliberate or negligent human actions. are disastrous events caused directly and principally by one or more identifiable deliberate or negligent human actions.“Man-Made Disaster,” BusinessDictionary.com, accessed February 6, 2012, www.businessdictionary.com/definition/man-made-disaster.html. They include such things as arson, radiation contamination, terrorism, structural collapse due to engineering failures, civil disorder, and industrial hazards.“Anthropogenic Hazard,” Wikipedia, accessed February 6, 2012, en.wikipedia.org/wiki/List_of_man-made_disasters. The better prepared a business is, the faster it will be able to recover and resume operations…if that is the decision. Having a disaster plan can mean the difference between being shut down for a few days and going out of business entirely.“Disaster Preparedness: FAQs,” US Small Business Administration, accessed February 6, 2012, sbaonline.sba.gov/services/disasterassistance/disasterpreparedness/serv_da _dprep_howcaniprep.html.

A Disaster Planning Success Story

Joe Bogner of Dodge City, Kansas, learned the importance of disaster planning firsthand. He owns Western Beverage, Inc., a beverage distribution company serving twenty-nine counties in western Kansas. In 2002, Western Beverage sustained millions of dollars in fire damage. Yet the company resumed deliveries after just three days. Bogner was named the Kansas City Small Businessperson of the Year for 2006, partially because of his company’s ability to respond to adversity. As his nomination package stated, “Setting up plans of action and following through are Joe’s way of life. He has proven and is continuing to prove that dreams can come true.”“Planning Can Cut Disaster Recovery Time, Expense,” US Small Business Administration, accessed February 6, 2012, archive.sba.gov/idc/groups/public/documents/sba_homepage/serv_da_dprep_howtoprep.pdf.

Four key facts about disaster planning must be kept in mind: (1) disasters will occur, (2) an owner must have a plan before the disaster occurs, (3) react with urgency but do not panic, and (4) ride it out.F. John Reh, “Survive the Unthinkable through Crisis Planning,” About.com, accessed February 6, 2012, management.about.com/cs/communication/a/PlaceBlame1000.htm. If an owner is committed to having a disaster plan for a business, the plan and process can be structured in a variety of ways. For this section, however, the recommendations on Ready.gov serve as the structure for our discussion. These recommendations reflect the Emergency Preparedness Business Continuity Standard (NFPA 1600) developed by the National Fire Protection Association and endorsed by the American National Standards Institute and the Department of Homeland Security.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. The recommendations are divided into three areas: plan to stay in business, talk to the people, and protect the investment. The topics discussed here are presented in Figure 14.1 "Disaster Planning". They have the greatest immediacy for a small business.

Figure 14.1 Disaster Planning

Plan to Stay in Business

A business owner has invested a tremendous amount of time, money, resources, and emotions into building a business, so he or she will want to be able to survive a natural or man-made disaster. This requires taking a proactive approach so that the chances of the business surviving are increased. Unfortunately, nothing can be done to guarantee the survival of a business because there is no way to know what kind of disaster may occur—or when. There is also no way to know what kind of business environment the owner will face after the disaster. There are, however, several things can be done to increase those chances of survival. Resist the temptation to put emergency planning on the back burner.

Be Informed

It is important to look realistically at the types of disasters that might affect a business internally and externally and prepare a risk assessment. Consider the natural disasters that are most common in the areas where the business operates and think about the business’s vulnerability to man-made disasters. Fires are the most common disasters in the United States, and they are extremely destructive to businesses,“Fires,” American Red Cross, accessed February 6, 2012, www.sdarc.org/HowWeHelp/DisasterPreparedness/Fire/tabid/81/Default.aspx. but an owner may not be aware that a community is very vulnerable to flooding from snow melt or that the proximity to a chemical plant makes a business vulnerable to the results of explosions. This is why it is important to prepare a risk assessment so that the business can plan accordingly.

Make a Continuity Plan

It is said that a business continuity plan is the least expensive insurance any business can have—especially a small business—because it costs virtually nothing to produce.“How to Create a Business Continuity Plan,” wikiHow, accessed February 6, 2012, www.wikihow.com/Create-a-Business-Continuity-Plan. The better the continuity planning is before a disaster, the greater the chances that a business will survive and recover. There are many things that can be done.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business; “How to Create a Business Continuity Plan,” wikiHow, accessed February 6, 2012, www.wikihow.com/Create-a-Business-Continuity-Plan. The following is not an exhaustive list:

  1. Carefully assess how the business functions. Document internal key personnel and backups (i.e., the personnel without whom a business absolutely cannot function). The list should be as large as necessary but as small as possible.
  2. Identify suppliers, shippers, resources, and other businesses that are interacted with on a daily basis. Document these and other external contacts, such as bankers, attorneys, information technology (IT) consultants, utilities, and municipal and community offices (police, fire, etc.) that may be needed for assistance.
  3. Identify people who can telecommute. Take steps to ensure that critical staff can telecommute if necessary.
  4. Plan for payroll continuity.
  5. Document critical equipment. Personal computers, fax machines, special printers and scanners, and software are critical to most businesses. An accurate inventory will help a business restore critical equipment.
  6. Make sure that all data and critical documents are protected. Critical documents include articles of incorporation and other legal papers, utility bills, banking information, and human resources documents; all these will be required to start over again. The Small Business Administration (SBA) recommends that vital business records—information stored on paper and computer—should be copied and saved at an offsite location at least fifty miles away from the main business site.“Disaster Preparedness: FAQs,” US Small Business Administration, accessed June 1, 2012, http://archive.sba.gov/services/disasterassistance/disasterpreparedness/serv _da_dprep_howcaniprep.html. Companies such as Carbonite can store records “on the cloud.”
  7. Identify a contingency location where business can be conducted while the primary office is unavailable. Many hotels have well-equipped business facilities that can be used, but remember that other businesses may need to do the same thing. It is good to have a contingency plan for a contingency location.
  8. Put all the information together. The continuity plan is an important document, a copy of which should be given to all key personnel. Do not distribute the plan to people who do not need to have it. The plan will contain sensitive and secure information that could be used by a disgruntled employee for inappropriate purposes.
  9. Plan to change the plan. There will always be events that could not have been factored into the plan. For example, the contingency site is damaged beyond use or the business’s bank is in an area that will be without power for days. Situations such as these will require immediate changes to the plan.
  10. Review and revise the plan.

Talk to People

Without good communication, the internal and external structure of a business—and its daily operations—will face challenges that may ultimately lead to its downfall.Kristie Lorette, “Importance of Good Communication in Business,” Chron.com, accessed February 6, 2012, smallbusiness.chron.com/importance-good -communication-business-1403.html. Strong communication skills are, therefore, a vital part of business success. When first starting out, the owner will need good communication skills to attract and keep new customers. As the business grows and new employees are required, these skills will be needed to hire, motivate, and retain good staff.Leslie Schwab, “Small Business: The Importance of Strong Communication Skills,” Helium, June 20, 2009, accessed February 6, 2012, www.helium.com/items/1486526-strong-communication-skills-are-required-for-success-in-small-business. It is for this reason that the employees of a business should play a central role in creating a disaster plan.

Involve Coworkers

Providing for the well-being of all employees is one of the best ways to ensure that a business will recover from a disaster. A business must be able to communicate with them before, during, and after a disaster. There are several recommendations for doing this, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

  • Employees from all levels in the organization should be involved.
  • Internal communications tools, such as newsletters and intranets, should be used to communicate emergency plans and procedures.
  • Set up procedures to warn people, being sure to plan how to warn employees who are hearing impaired, are otherwise disabled, or do not speak English.
  • Encourage employees to find an alternate way of getting to and from work in case their usual way of transportation is interrupted.
  • Keep a record of employee emergency contact information with other important documents.

Write a Crisis Communication Plan

The owner must decide how the business will contact suppliers, creditors, other employees, local authorities, customers, media, and utility companies during and after the disaster. One easy way to do this is to assign key employees to make designated contacts. Provide a list of these key employees and contacts to each affected employee and keep a copy with other protected contacts. Each key employee should also keep a copy of the list at home. In addition,“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. do the following:

  • Make sure that top executives have all the relevant information needed to protect employees, customers, vendors, and nearby facilities.
  • Update customers on whether and when products will be received and services rendered.
  • Let public officials know what the business is prepared to do to help in the recovery effort.
  • Let public officials know whether the business will need emergency assistance to conduct essential business activity.

Support Employee Health—and the Owner’s Health

Disasters often result in business disorientation and environmental detachment, with the psychological trauma of key decision makers leading to company inflexibility (perhaps inability) to deal with the change required to move forward.Darrell Zahorsky, “Disaster Recovery Decision Making for Small Business,” About.com, accessed February 6, 2012, sbinformation.about.com/od/disastermanagement/a/disasterrecover.htm. If the owner or other key personnel experience posttraumatic stress disorder, it can cripple a business’s decision-making ability.

No matter the disaster, there will be psychological effects (e.g., fear, stress, depression, anxiety, and difficulty in making decisions) as well as—depending on the nature of the disaster—physical effects such as injuries, burns, exposure to toxins, and prolonged pain.John H. Ehrenreich, “Coping with Disasters: A Guidebook to Psychosocial Intervention,” Toolkit Sport for Development, October 2001, accessed February 6, 2012, www.toolkitsportdevelopment.org/html/resources/7B/7BB3B250-3EB8-44C6-AA8E -CC6592C53550/CopingWithDisaster.pdf. As a result, the owner and the employees may have special recovery needs. To support those needs, do the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

  • Provide for time at home to care for family needs, if necessary.
  • Have an open-door policy that facilitates seeking care when needed.
  • Reestablish routines as best as possible.
  • Offer special counselors to help people address their fears and anxieties.
  • Take care of yourself. Leaders tend to experience increased stress after a disaster. The leader’s own health and recovery are also important to both family and the business as a whole.

Protect the Investment

Last but certainly not least, take steps to protect the business and secure its physical assets. Among the things that can be done, having appropriate insurance coverage; securing facilities, buildings, and plants; and improving cybersecurity are at the top of the list.

Insurance Coverage

Having inadequate insurance coverage can leave a business vulnerable to a major financial loss if it is damaged, destroyed, or simply interrupted for a period of time. Because insurance policies vary, meet with an insurance agent who understands the needs of a particular business.“Insurance Coverage Review Worksheet,” Ready.gov, accessed February 6, 2012, www.ready.gov/sites/default/files/documents/files/InsuranceReview_Worksheet.pdf.

  • Review coverage for things such as physical losses, flood coverage, and business interruption. Normal hazard insurance does not cover floods, so make sure the business has the right insurance.“Disaster Preparedness: FAQs,” US Small Business Administration, accessed June 1, 2012, http://archive.sba.gov/services/disasterassistance/disasterpreparedness/serv _da_dprep_howcaniprep.html. Business interruption insuranceProtects a business in the event of a natural disaster, a fire, or other extenuating circumstances that affects the ability of a company to conduct business. protects a business in the event of a natural disaster, a fire, or other extenuating circumstances that affect the ability of a company to conduct business.“Business Interruption Insurance,” Entrepreneur, accessed February 6, 2012, www.entrepreneur.com/encyclopedia/term/82282.html. Small business owners should seriously consider this type of insurance because it can provide enough money to meet overhead and other expenses while out of commission. The premiums for these policies are based on a company’s income.“Business Interruption Insurance,” Entrepreneur, accessed February 6, 2012, www.entrepreneur.com/encyclopedia/term/82282.html.
  • Understand what the insurance policy covers and what it does not cover.
  • Add coverage as necessary.
  • Understand the deductible and make adjustments as appropriate.
  • Think about how creditors and employees will be paid.
  • Plan how to pay yourself if the business is interrupted.
  • Find out what records the insurance provider will require after an emergency and store them in a safe place. It would be a good idea to take pictures of your physical facilities, equipment, buildings, and plant so that insurance claims can be processed quickly. These pictures will also provide a good basis for putting the operation back into working order.

Secure Facilities, Buildings, and Plants

One cannot predict what will happen in the case of a disaster, but there are steps that can be taken in advance to help protect a business’s physical assets, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business.

  • Fire extinguishers and smoke detectors should be installed in appropriate places.
  • Building and site maps with critical utility and emergency routes clearly marked should be available in multiple locations—and they should be protected with other important documents.
  • Think about whether automatic fire sprinklers, alarm systems, closed circuit television, access control, security guards, or other security measures would make sense.
  • Secure the entrance and the exit for people, products, supplies, and anything else that comes into and leaves the business.
  • Teach employees to quickly identify suspect packages and letters, for example, packages and letters with misspelled words, no return address, the excessive use of tape, and strange coloration or odor. Have a plan for how such packages and letters are to be handled.

Improve Cybersecurity

Many, perhaps most, small businesses will have data and IT systems that may require specialized expertise. They need to be protected. The industry, size, and scope of a business will determine the complexity of cybersecurity, but even the smallest business can be better prepared.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. Small businesses are the most vulnerable to cybersecurity breaches because they have the weakest security systems, thereby making them easier online targets.“CyberSecurity by Chubb,” Chubb Group of Insurance Companies, accessed February 6, 2012, www.chubb.com/businesses/csi/chubb822.html.

Video Clip 14.1

Cybersecurity

(click to see video)

An overview of cybersecurity.

Video Link 14.1

Chubb Group of Insurance Companies

The Chubb Group of Insurance Companies provides a very good video discussion of cybersecurity.

www.chubb.com/businesses/csi/chubb822.html

Every computer can be vulnerable to attack. The consequences can range from simple inconvenience to financial catastrophe.“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business. There are several things that can be done to protect a business, its customers, and its vendors, including the following:“Plan For and Protect Your Business,” Ready.gov, accessed February 29, 2012, www.ready.gov/business; “Cyber Security Liability Insurance,” Wall Street Journal, March 18, 2010, as cited in Robert Hess and Company Insurance Brokers, May 6, 2010, accessed February 6, 2012, robhessco.com/183/cyber-security-liability-insurance/; Eric Schwartzel, “Cybersecurity Insurance: Many Companies Continue to Ignore the Issue,” Pittsburg Post-Gazette, June 22, 2010, accessed February 6, 2012, www.post-gazette.com/pg/10173/1067262-96.stm.

  • Explore cybersecurity liability insurance. This coverage is available at reasonable rates to protect against credit card identity theft, with limits up to $5 million. This insurance will cover the loss of digital assets plus expenses for public relations, damages, and service interruption. It will also protect customers. The notification of customers whose credit was compromised is included plus any legal costs and a year of credit monitoring for each individual affected. Although other cybersecurity insurance policies can cover data loss, applicants must break down loss estimates on an hourly basis because most breaches are resolved in hours, not days. This is not an easy thing to do.
  • Use antivirus software and keep it up to date. If an owner is not already doing this, he or she should probably have a mental examination.
  • Do not open e-mail from unknown sources. Always be suspicious of unexpected e-mails that include attachments, whether or not they are from a known source. When in doubt, delete the file and the attachment—and then empty the computer’s deleted items file. This should be a procedure that all employees know about and follow. The owner must do it as well.
  • Use hard-to-guess passwords. An application for cyberinsurance requires, among other things, answering the following question: “Are passwords required to be at least seven characters in length, alphanumeric, and free of consecutive characters?” (Check yes or no.) Whether or not a business plans to apply for cyberinsurance, instituting this kind of password policy is well worth consideration.

Key Takeaways

  • Small- to medium-sized businesses are the most vulnerable in the event of a disaster.
  • Some estimates claim that over 60 percent of small businesses that experience a major disaster close by the end of the second year.
  • Planning for disaster recovery makes great sense for protecting a business.
  • Every state and territory has experienced disasters. Planning for the aftermath is the key to getting back to business with a minimum of disruption. However, every situation will be unique.
  • Man-made disasters affect 10 percent of small businesses, while natural disasters have impacted more than 30 percent of all small businesses in the United States.
  • A man-made disaster is a disastrous event caused directly and principally by one or more identifiable deliberate or negligent human actions—for example, arson, terrorism, and structural collapse.
  • The better prepared a business is, the faster it will recover from a disaster and resume operations. Having a disaster plan can mean the difference between being shut down for a few days and going out of business entirely.
  • Even the smallest business should have a disaster plan.
  • The three main areas that an owner should focus on in a disaster plan are the plan to stay in business, talk to people, and protect the investment.

Exercise

Frank’s BarBeQue just missed being impacted by a tornado that ripped through southwestern Connecticut. Many small businesses were lost, never to reopen, while others sustained major physical and economic damage. Frank’s son, Robert, asked his father about whether he was prepared for something like that. Frank’s response was troubling. Although he kept some important documents in a safety deposit box at the bank, there was little planning or protection. Robert explained the importance of disaster planning, but Frank was overwhelmed by the prospect of the process.

Robert contacted a local university and arranged with its school of business for a team of five students to prepare a disaster plan for Frank’s BarBeQue. He presented the project idea to his father and was relieved that his dad was willing to participate. It was clearly understood that no proprietary or confidential information would be shared with the students.

  1. Assume that you are the leader of the team. Describe the approach you will take and the recommendations that you will make. It is expected that you will go beyond the information provided in the text. Creativity is strongly encouraged.