While technology and innovation are constantly changing and improving business operations, they can't always stand up to the wrath of Mother Nature. According to the Insurance Information Institute, businesses incurred more than $7 billion in insured losses in 2008 at the hands of natural disasters. Some areas of the country may be more prone to natural disasters than others, but no location is immune. Along the Gulf Coast, there are hurricanes; in the central part of the country, tornadoes; in the West, wildfires and earthquakes; and in the East and North, snowstorms and ice storms. These come along with terrorism and pandemics such as H1N1 influenza, growing threats that can strike any location anywhere in the country.
Aside from physical defense mechanisms and disaster-hardening projects, experts say a strong comprehensive disaster preparedness plan is critical. By identifying the threats, analyzing critical operation needs, and planning for worst-case scenarios, companies can dramatically increase the chances that they will survive.
Identifying Risks and Threats
When it comes to disaster planning and preparedness, "business continuity" is the most common phrase heard today. A business continuity plan is a practiced plan for how an organization will recover and restore its operations in the event of a disaster. Bill DiMartini, practice leader of Business Continuity and Disaster Recovery at PPT Consulting in Newtown Square, Pennsylvania, says that identifying potential threats is the first step in disaster planning. "A lot of things are really determined by the type of business that you are in, whether you are heavily regulated and what your commitments are to your customers," he says.
A business impact analysis will look at processes and dependencies to determine what needs to happen to continue meeting technology, people, and outside vendors. It then identifies what would happen to the company if it were not able to recover those processes in the event of a disaster. Once that is established, a company can determine and establish its recovery time frame objective (RTO) and its recovery point objective (RPO) - both of which can vary dramatically depending upon the nature of the business.
Identifying key functions that generate cash flow is critical to continuity, says Ken Wilson, founder and CEO of Wilson Marketing Group in Wayzata, Minnesota. "You want to identify the key essential services that will generate the cash flow and keep the company operational," he says, adding that business owners should not only identify those functions internally, but also with suppliers who could impact the business in the time of a disaster. Because certain disasters like hurricanes and ice storms can affect large regions, companies should look at all external contributors to the organization.
With the recent outbreaks of H1N1, more companies have been taking a closer look at threats from pandemic influenza. Wilson's firm has trained more than 400 companies and 1,000 people in pandemic planning. Unlike natural threats that can sometimes be predicted, a pandemic threat can often strike without much warning. "If some companies got hit with a severe pandemic influenza in their organization right now, there's a good possibility that they wouldn't survive," he says.
Wilson says a pandemic influenza plan typically has four major components: a health and safety plan, a communications plan, an essential services plan, and a response plan. Companies can learn more about preparing for pandemic influenza by hiring a consultant or visiting www.flu.gov, a website run by the U.S. Department of Health & Human Services.
Anticipating and Re-evaluating
Many site selectors say that disaster preparedness starts before a site is even selected, but in many cases, companies must locate in risky areas. This is especially true for businesses that move heavy durable goods and must be located in ports or on waterways that are prone to flooding. When a business has to be in a risky area, plans must clearly highlight threats and risks that aren't just anticipated but are expected.
Tucked away in the eastern part of New Orleans on a deep-water canal near the Gulf Intracoastal Waterway and the Mississippi River Gulf Outlet, the Michoud Assembly Facility is an 832-acre site owned by NASA. Used by Lockheed Martin to construct the space shuttle's external tanks, it is one of the largest manufacturing plants in the world and is also home to a number of other businesses.
During Hurricane Katrina in 2005, New
Orleans East was one of the hardest-hit parts of the city. Despite the
fact that Michoud sits below sea level and was right in the path of
destruction, the facility completed a space shuttle tank on time just
six weeks after the storm, at a time when most businesses were still
picking up the ruins. Director of business development Raymond Vogel
credits that success not just to the durability of the physical
infrastructure, but the fact that they anticipate the risks and
constantly prepare and re-evaluate their plans to handle such
disasters.
One can't necessarily prepare for a disaster of
such magnitudes, and only by going through it can a company learn where
improvements need to be made. Experts in the industry say that the
best-made plans are worth nothing if they aren't frequently practiced,
tested and updated. "You are constantly doing these tests and want to
make sure these plans are reflecting your business," says DiMartini.
"Your plans should change as your business does." Philip Jan Rothstein,
president of Rothstein Associates, Inc., a Brookfield,
Connecticut-based firm specializing in disaster recovery and planning,
says the exercise process is the biggest part of a business continuity
program, and one that some businesses forget. "An unexercised
contingency plan is worse than no plan at all," he says. "You are going
to assume it works and that could be a fatal mistake. Exercising is the
single biggest factor." He says business continuity planning is an
ongoing process where the plan stronger with each test.
Shifting People and Processes
The
specifics of business continuity plans and how businesses prepare for
disaster can vary according to industry. Manufacturers might have
excess inventory stockpiled in another location. Retailers might have
inventory ready to flow in if a disaster destroys what is on hand. Call
centers might simply transfer calls to another location.
Matt
Szuhaj, director of strategy and operations for Deloitte Consulting,
says that some companies use the "lifeboat" scenario, which entails
partial or complete building of an alternative site in a different
location. In the event of a disaster, that site can quickly be finished
and made operable to house operations from the old location. "If you
have a catastrophic failure, you can actually finish the facility and,
within a short order, get things up and running," he says.
Rothstein
says that while geography can often dictate what types of threats a
business has to prepare for, the fundamentals of emergency and
continuity plans are usually very similar. He estimates that roughly 80
percent of a business continuity plan will be written to deal with
non-specific disasters. Plans to handle business interruption, work
force support, and continuing operations can be applied to any
disaster, whether it's an ice storm, tornado, or terrorist attack.
"It's about building a structure that will address categories or
classes of threats and vulnerabilities, some of which you can't even
imagine," he says.
Aside from the physical threats that a
natural or manmade disaster can pose, there are big risks in what can
happen to a work force. During Hurricane Katrina and the September 11,
2001 attacks, many companies had facilities that survived the disaster,
but they were out of operation for weeks because their employees
couldn't get to work. Because large disasters can affect entire
regions, the damage to transportation, housing, and infrastructure can
disable a work force, even more than on the company itself. "The
company also needs to take a look at the risk to [its] work force and
ensure that there's going to be enough people coming in to make it
operational," says Wilson. He suggests along with making plans to
potentially house and feed employees, companies can also institute
cross-training programs or set up some employees to work from home.