While the phrase “disaster planning” typically invokes images of floods, hurricanes or other fits of Mother Nature, disaster comes in many forms—from the death of a CEO to a data breach or system failure; from workplace violence to the loss of a vendor; from a mechanical breakdown to a top sales rainmaker leaving the company.
Disasters—“events,” in professional parlance—fall into three categories: natural perils (earthquakes, hurricanes, wildfires); manmade perils (fire, terrorism, workplace violence); and technological perils (cyber breaches, software corruption, system failures), says Ken Katz, property risk control director at Travelers. And even small events can cause significant damage.
Whether the risk is large or small, most businesses are woefully unprepared. In a 2012 Travelers study, 48% of small business owners said they believe the world is growing riskier. But only one in four (24%) said that preventing, preparing for and responding to risk is a strategic priority.
“Disaster denial” can happen in businesses of all sizes—and even those with a plan are probably unprepared, says Harry Rhulen, CEO and cofounder of disaster planning consultant Firestorm. “Most don’t make it part of their culture, so even if they do have plans, they’re useless. A disaster planning book sitting on a shelf isn’t enough.”
Disaster planning is especially critical for agencies and brokerages, which during a large-scale disaster must help their customers as well as their own businesses.
The good news is that independent agents and brokers are perfectly positioned to educate and assist their customers and keep their businesses running before, during and after a disaster.
According to Travelers, creating a business continuity plan boils down to:
- Assessing the business’s risk: examining a business’s vulnerabilities and rating the potential impact of an event on employees, property, operations and the environment. This includes a review of the physical facility, gap analysis of insurance and risk plans, and determining employee training requirements.
- Conducting a business impact analysis: identifying the functions or processes necessary to provide goods and services to customers.
- Establishing controls for prevention and mitigation: developing a plan to prevent incidents that threaten life, property, operations and the environment and mitigating the consequences.
- Testing, implementing and adjusting the plan: including getting buy-in from management and training everyone on the plan.
Here are nine steps to help you get your clients on the path to true disaster preparedness.
1. A solid business continuity plan adds to a business’s value. It can be challenging to convince a business owner to invest the time and resources needed to develop a solid plan—which requires a detailed analysis of all facets of the business’s operations and input from employees. And management must be brutally honest about the company’s vulnerabilities and weak links, says Jeffrey Friedman, CEO of Building Intelligence Inc., a software developer specializing in operations and risk management. “Sometimes it’s like seeing a therapist—you’re talking about all the terrible things that could happen,” he says.
But a solid continuity plan actually gives a business a competitive advantage because it helps them get back on their feet quicker after a disaster (and in some instances, there are legal mandates: securities regulator FINRA requires business continuity plans for companies registering stock or investment banking, Friedman notes).
Well-prepared businesses can also realize financial incentives, says James Breitkreitz, vice president of property and B&M services at Zurich Services Corp. Insurers like Zurich consider pre-emergency planning as a differentiator of superior risk from the rest. “Ultimately, all these factors go into risk assessment, which has an impact on pricing and capacity,” he says.
2. Your existing business continuity plan probably won’t cut it.
Many companies think simply having an insurance policy is all the disaster planning they need. Others rely on stand-alone or process-oriented plans, focusing on a single area like data recovery. While important, neither are comprehensive, says Katz of Travelers. Even a strong emergency response plan does little to address the issue of how business will resume after the disaster.
Rhulen of Firestorm says most businesses lack planning in these critical areas:
- Analysis of supply chain weaknesses
- Training employees to the plan
- Thorough, in-depth vulnerability and threat analysis
- Conducting test exercises and updating plans to address weak points
- Crisis communications plan
- Monitoring plan and controlling social media.
3. Testing the plan is essential to success in a real disaster.
Anything can look good on paper but to ensure that a plan will work when it’s needed, it must be tested. This can be done in several ways, the simplest of which are one-hour “tabletop” exercises working with an underwriter and claims people to work through a simple disaster scenario, Rhulen says.
Then there are more elaborate tests. Rhulen cites an independent agency in Florida that shuts down the office for a day to conduct an exercise that simulates a hurricane hitting its 200 homeowner insureds, walking through the calls and paperwork that would arise from the event. In some industries, multi-day exercises are not only common, but required by regulators; in mining, for instance, cave-in scenarios with mine rescue teams and simulated exercises are typical, including simulation of the communication that must take place to shareholders, employees, the media, citizens and regulators.
Such intensive testing may be hard for smaller businesses, but it can be done during slow seasons, or by testing by department rather than the entire company, Rhulen says.
4. Insurance is important, but mind the gaps.
Businesses of all sizes need comprehensive insurance to protect against disaster. Determining the appropriate amount of insurance can be done via property and risk assessments, along with the consideration of recovery options, says Jamie Miller, head of North America property for Swiss Re Corporate Solutions. There are many online resources to help businesses determine this, includingthe Institute for Business and Home Safety’s free “Open for Business” program.
Besides the basic building and content insurance, companies need business interruption and contingent (supply chain) business interruption, especially in today’s global economy, Miller says. Business owners should understand what events are covered under their policies. Flood and storm surge is covered under most standard insurance policies, and a separate flood-specific policy should be purchased from either a commercial insurer or the NFIP. “The perception of flood risk is constantly changing as new floods occur,” he says. “Even business owners located in areas that are now thought of as low flood risk should consider flood insurance.”
The gap between insured losses and total economic loss is increasing, with more of the uninsured component falling to the government, Miller says. Swiss Re offers specialized index-based (parametric) products that settle on an event’s characteristics rather than the loss, allowing for fast payment. For example, an energy company facing a major hurricane can buy an insurance product to receive a payout if the storm makes landfall as a Category 3 hurricane or higher.
A business’s need for such specialized products must be determined by an expert—and that expert is an agent or broker with a vested interest in seeing their client thoroughly protected, Friedman says. “If you don’t want to be a commodity salesman, you must explore their risk with them and show them ways to strategically minimize that risk,” he says. Ultimately, that exploration will lead to a stronger client relationship, greater retentions, and can open the door to selling more insurance products as well.
5. Employees are essential.
“Business continuity begins with people and what’s best for them,” says Brietkrietz of Zurich. Employee buy-in and training is essential for any successful disaster plan. They’re not only necessary to help guide you through the troubleshooting process, but they are essential to recovering the business and helping their own clients through a large-scale disaster.
That’s why if you do nothing else, make sure your people are safe when implementing a disaster plan. “In the 48 hours before a hurricane, a business must do many things to get the facility ready for the storm’s arrival. Make sure they’re doing it safely,” such as using proper precautions for employees that must secure roofing or using proper lockout-tagout procedures.
The other element to consider in a major disaster is when employees suffer severe losses of their own. “If they can work from home during the storm, it’s probably better for them and the company. They’ve got their own personal issues to deal with from the storm, but they must still keep business running,” Breitkrietz says. “This also spreads the risk because employees aren’t concentrated in one area.”
6. The weakest link: Your supply chain.
A large part of determining a business’s vulnerabilities is taking a close look at its vendors and suppliers, and the earlier this is identified, the better, says Breitkrietz. “You have to consider not just whether you can operate, but whether your upstream suppliers will have product.” Line up alternative suppliers, especially if a natural disaster is approaching, and check in with them regularly to make sure you’re at the top of their list if you need to use them.
The unusual weather events of the past several years are indicative of global climate change, which can disrupt a business’s supply chain in the short and long term, says Miller of Swiss Re. Businesses and their supporting infrastructures have “a multi-decade lifetime” that must be able to withstand extreme events, today and over the course of its lifetime. “As the climate system changes and sea level rises, considering this new risk landscape of the future in today’s planning will lead to more sustainable communities and less destruction and disruption,” he says.
7. Communication is key.
Communication is essential during a disaster—from a basic employee calling tree to the nuanced messaging on social media. Firestorm, which was involved in disaster management for the Virginia Tech campus shooting, helped the school maintain some control of how the event was perceived. Disaster planning can help manage the consequences of an unavoidable event, and the outcome is long-term, Rhulen says.
8. Use a consultant—or not.
Consultants can be invaluable in helping a business plan, finalize, test and implement a disaster plan. In many instances, they work with a business’s insurance agent or broker—sometimes in a crisis situation.
“When a company has a crisis, the first people they call is their insurance agent and their lawyer,” Rhulen says. “Agents often don’t know the answer because they’ve sold a product that provides financial remuneration but doesn’t help the company manage the crisis.”
Consultants can also help agents. Agility Recovery, which provides services including power, office space, staff and technology in a disaster, worked with two of the three biggest insurance agencies in the New Orleans area during Hurricane Katrina, Andre Selvyn, a sales executive from the company. Agility reps were on the ground well before the storm hit, and the agency staffers were taken out of New Orleans in mobile units before the storm, enabling them to service clients immediately after the storm.
But while consultants can help, “it’s gotta be your plan, or it isn’t money well spent,” says Katz. Companies need to tackle the project themselves first, then bring in experts if they need them.
9. Don’t overlook the basics.
Now that we’ve regaled you with the complexities, a reminder: part of disaster mitigation often comes down to something as simple as cleaning your gutters.
The two most common claims seen by Grange Insurance each year are either fire or wind/hail related, accounting for about 78% of all annual commercial claims and racked up $20 million in claims for its policyholders in 2012, says vice president Ken Kozek—claims that are frequently preventable.
To protect against electrical storms, unplug expensive electrical equipment and use surge protectors, and consider a lightning protection system or commercial generator if your area is prone to storms.
Regular roofing inspection and maintenance can protect against losses, especially in early spring when melting ice can cause leaks. If a storm is brewing, inspect the roof for loose debris, which can be hazardous in high-wind conditions.
And don’t skimp on general maintenance and housekeeping. “You’d be surprised how many small businesses have overloaded surge protectors in the coffee break area, electrical cords in high traffic areas and sprinkler systems that haven’t been inspected in years,” Kozek says. “These things might see like common sense, but we settle thousands of dollars in losses every single year from disasters caused by these very things. In fact, electrical fires are consistently ranked by our industry as one of the top causes for commercial fires.”