Disaster Ahead: Planning for the Worst | business continuity plans

While technology and innovation are constantly changing and improving business operations, they can't always stand up to the wrath of Mother Nature. According to the Insurance Information Institute, businesses incurred more than $7 billion in insured losses in 2008 at the hands of natural disasters. Some areas of the country may be more prone to natural disasters than others, but no location is immune. Along the Gulf Coast, there are hurricanes; in the central part of the country, tornadoes; in the West, wildfires and earthquakes; and in the East and North, snowstorms and ice storms. These come along with terrorism and pandemics such as H1N1 influenza, growing threats that can strike any location anywhere in the country.

Aside from physical defense mechanisms and disaster-hardening projects, experts say a strong comprehensive disaster preparedness plan is critical. By identifying the threats, analyzing critical operation needs, and planning for worst-case scenarios, companies can dramatically increase the chances that they will survive.

Identifying Risks and Threats
When it comes to disaster planning and preparedness, "business continuity" is the most common phrase heard today. A business continuity plan is a practiced plan for how an organization will recover and restore its operations in the event of a disaster. Bill DiMartini, practice leader of Business Continuity and Disaster Recovery at PPT Consulting in Newtown Square, Pennsylvania, says that identifying potential threats is the first step in disaster planning. "A lot of things are really determined by the type of business that you are in, whether you are heavily regulated and what your commitments are to your customers," he says.

A business impact analysis will look at processes and dependencies to determine what needs to happen to continue meeting technology, people, and outside vendors. It then identifies what would happen to the company if it were not able to recover those processes in the event of a disaster. Once that is established, a company can determine and establish its recovery time frame objective (RTO) and its recovery point objective (RPO) - both of which can vary dramatically depending upon the nature of the business.

Identifying key functions that generate cash flow is critical to continuity, says Ken Wilson, founder and CEO of Wilson Marketing Group in Wayzata, Minnesota. "You want to identify the key essential services that will generate the cash flow and keep the company operational," he says, adding that business owners should not only identify those functions internally, but also with suppliers who could impact the business in the time of a disaster. Because certain disasters like hurricanes and ice storms can affect large regions, companies should look at all external contributors to the organization.

With the recent outbreaks of H1N1, more companies have been taking a closer look at threats from pandemic influenza. Wilson's firm has trained more than 400 companies and 1,000 people in pandemic planning. Unlike natural threats that can sometimes be predicted, a pandemic threat can often strike without much warning. "If some companies got hit with a severe pandemic influenza in their organization right now, there's a good possibility that they wouldn't survive," he says.

Wilson says a pandemic influenza plan typically has four major components: a health and safety plan, a communications plan, an essential services plan, and a response plan. Companies can learn more about preparing for pandemic influenza by hiring a consultant or visiting www.flu.gov, a website run by the U.S. Department of Health & Human Services.

Anticipating and Re-evaluating
Many site selectors say that disaster preparedness starts before a site is even selected, but in many cases, companies must locate in risky areas. This is especially true for businesses that move heavy durable goods and must be located in ports or on waterways that are prone to flooding. When a business has to be in a risky area, plans must clearly highlight threats and risks that aren't just anticipated but are expected.
Tucked away in the eastern part of New Orleans on a deep-water canal near the Gulf Intracoastal Waterway and the Mississippi River Gulf Outlet, the Michoud Assembly Facility is an 832-acre site owned by NASA. Used by Lockheed Martin to construct the space shuttle's external tanks, it is one of the largest manufacturing plants in the world and is also home to a number of other businesses.

During Hurricane Katrina in 2005, New Orleans East was one of the hardest-hit parts of the city. Despite the fact that Michoud sits below sea level and was right in the path of destruction, the facility completed a space shuttle tank on time just six weeks after the storm, at a time when most businesses were still picking up the ruins. Director of business development Raymond Vogel credits that success not just to the durability of the physical infrastructure, but the fact that they anticipate the risks and constantly prepare and re-evaluate their plans to handle such disasters.

One can't necessarily prepare for a disaster of such magnitudes, and only by going through it can a company learn where improvements need to be made. Experts in the industry say that the best-made plans are worth nothing if they aren't frequently practiced, tested and updated. "You are constantly doing these tests and want to make sure these plans are reflecting your business," says DiMartini. "Your plans should change as your business does." Philip Jan Rothstein, president of Rothstein Associates, Inc., a Brookfield, Connecticut-based firm specializing in disaster recovery and planning, says the exercise process is the biggest part of a business continuity program, and one that some businesses forget. "An unexercised contingency plan is worse than no plan at all," he says. "You are going to assume it works and that could be a fatal mistake. Exercising is the single biggest factor." He says business continuity planning is an ongoing process where the plan stronger with each test.

Shifting People and Processes
The specifics of business continuity plans and how businesses prepare for disaster can vary according to industry. Manufacturers might have excess inventory stockpiled in another location. Retailers might have inventory ready to flow in if a disaster destroys what is on hand. Call centers might simply transfer calls to another location.

Matt Szuhaj, director of strategy and operations for Deloitte Consulting, says that some companies use the "lifeboat" scenario, which entails partial or complete building of an alternative site in a different location. In the event of a disaster, that site can quickly be finished and made operable to house operations from the old location. "If you have a catastrophic failure, you can actually finish the facility and, within a short order, get things up and running," he says.

Rothstein says that while geography can often dictate what types of threats a business has to prepare for, the fundamentals of emergency and continuity plans are usually very similar. He estimates that roughly 80 percent of a business continuity plan will be written to deal with non-specific disasters. Plans to handle business interruption, work force support, and continuing operations can be applied to any disaster, whether it's an ice storm, tornado, or terrorist attack. "It's about building a structure that will address categories or classes of threats and vulnerabilities, some of which you can't even imagine," he says.

Aside from the physical threats that a natural or manmade disaster can pose, there are big risks in what can happen to a work force. During Hurricane Katrina and the September 11, 2001 attacks, many companies had facilities that survived the disaster, but they were out of operation for weeks because their employees couldn't get to work. Because large disasters can affect entire regions, the damage to transportation, housing, and infrastructure can disable a work force, even more than on the company itself. "The company also needs to take a look at the risk to [its] work force and ensure that there's going to be enough people coming in to make it operational," says Wilson. He suggests along with making plans to potentially house and feed employees, companies can also institute cross-training programs or set up some employees to work from home.