After two hurricanes struck the eastern United States this year, many business owners realized they weren’t prepared.
Although the focus in the news is usually on residential property destruction, businesses often suffer crippling damages as well.
Too often, disaster recovery planning concentrates on the technology aspects of the organization. How long will the network and systems be down? Were backup plans sufficient? How quickly can sales and customer service resume? But there’s much more to it than that.
Continuity of mission-critical functions
The challenge for the business owner and risk advisor is to look at continuity of mission-critical functions of all types, no matter what the cause and in which department the functions reside.
Many owners expect everything to return to business as usual after a disastrous event, but the reality is much more devastating and longer lasting. According to the U.S. Department of Labor, more than 40 percent of businesses never reopen following a catastrophic event. Of those that remain, approximately 25 percent will close within two years.
Written disaster plan is key
Having a written disaster plan can provide direction and increase the chance of survival for your clients’ businesses, hopefully with minimal disruption. And even though a study by Touche Ross indicates that companies without a recovery plan have a survival rate of less than 10 percent, only about 35 percent of small businesses have a business continuity plan (BCP).
A written BCP is a comprehensive plan for the continuation of critical business operations after a disaster to minimize decision-making during an event and make recovery more effective. This is a great opportunity for insurance risk advisors to fulfill their role of trusted advisor.
On the following pages are four phases to help businesses develop and maintain a BCP:
Evaluate potential events that are the greatest threat to a company's operations. (Photo: iStock)
Work with your clients to assemble a team of the people who understand the operational aspects of their business so together you can identify and evaluate which potential events can create the greatest threats to their organization. Although we tend to think first of natural events such as hurricanes, tornadoes or floods, hazards also include technological events such as cyberattacks, utility outages or fires.
Ask the right questions to determine what would cause disruption. (Photo: iStock)
2. Business impact analysis
This type of analysis is a systematic process of gathering information about critical business functions to determine the most important elements of the business as well as those that have the greatest risk potential. Owners and managers shouldn’t waste time or resources on functions with minimal impact on operations. However, a business impact analysis goes far beyond a risk assessment, and concentrates on the impact of the disruption, whatever the cause. Remember that key employees and management succession are important aspects of their BCP.
For example, does the company have a policy that prevents key employees from traveling together? What might be the impact of the departure of key staffers? What happens if a key leader is incapacitated and cannot respond in the event of a disaster? The essential part of this phase is asking the right questions. Although clients may think the process is overwhelming, there are a number of tools available online and your checklists and advice will be of great assistance in keeping them focused.
Identify people who will communicate recovery plans. (Photo: iStock)
3. Develop recovery strategies
In an effective business continuity plan, people come first. It’s essential for owners to communicate successfully with employees, customers and vendors. For some companies, contact with media may be part of the plan. They should designate a spokesperson and have a consistent and clear message. After they’ve determined the business impact of each critical function or process, it’s time to advise them on how to develop their recovery capability. This includes identifying the people, facilities and assets required to achieve the four “R’s” of response, resumption, recovery and restoration.
A business continuity plan must be periodically tested through pratical applications. (Photo: iStock)
4. Implementation, testing and monitoring
To be effective, the business continuity plan must be written and communicated to all employees on an ongoing basis. Risk is not static and personnel, assets, potential threats and critical functions change over time. A BCP must be validated periodically through testing or practical application and then kept current and communicated.
As a risk advisor, you should assist with identifying and managing the proper insurance coverage for your clients. Not all insurance policies are created equal, so it’s important that you evaluate your clients’ exposure so you can design the insurance program that meets their needs — before they need it.
It’s always better to be intentional rather than random, whether you’re talking about your clients’ business success or their business survival after a catastrophe. Never forget that others are depending on their survival and continued success after a catastrophe: employees, their families, customers, suppliers and vendors — and even their community. Now is the time to help them prepare. It’s an important role — their survival may depend on it.