The Most Dangerous Thing a Small Business Can Say “No” To

There is an 80% chance you will be struck by a disaster or a major interruption at some point during your company’s lifetime. That is a sobering reality, especially since statistics show that small businesses without a disaster plan are playing a dangerous game.

It doesn’t matter if it is a brick and mortar business or an online company with a single owner and no employees. If you are interrupted by a disaster, and are not back in business within a month, your chances of survival are less than 1 in 10.

Unfortunately, I see this a lot in the disaster business.  Small businesses who still think they can just wing it and get through a major disruption. Why would you do that when every single Fortune 500 company has a robust disaster program? Not a single one of those companies would wing it. The reason is because they recognize that a disaster program is the company’s chance to make money, and not lose valuable customer relationships. 



So do you still need a disaster plan? Yes you do, for one reason: you have the most to lose.

When Wal-Mart has a store closed for a couple of days, it loses ten to twenty thousand dollars. For them, that’s nothing. They can easily make that back in just a few days, especially since their marketing position is such that they have broad appeal almost anywhere they are situated, and they know it.

Want to know a secret? 

Wal-Mart probably has the best disaster and business continuity plan of any brick and mortar company in the world.

They don’t care if they can make lost money back. They want to be open to show their customers, the community, and their competitors that they mean business. Wal-Mart won’t give an inch away that it doesn’t have to, because they take disasters seriously. Companies without disaster plans that do survive needlessly spend a lot of money to do so. 

I spoke a couple years in a row at a state restaurant association in an area known for massive disasters. After one of my presentations, a guy came up to me and told me that he was recommending to the association that they no longer have disaster management educational sessions.

When I asked why, he said it was because his restaurant had been struck by a disaster twice and he had survived both times without a disaster plan. After asking a few more questions, he said had spent about $18,000 on each one to completely return to normal.

I absolutely couldn’t believe it. There is no rhyme or reason why a small business restaurant should spend nearly $40,000 to be continuous after a couple disasters. What he doesn’t realize (or refuses to) is those losses will eventually catch back up to him.

Do you have $40,000 to spend on a disaster response? Do you want to spend that on a disaster response? Or would you rather have that to renovate your store, or buy more advertising time or invest in your employees?

What he also doesn’t realize is a disaster can cost you more than just money spent on responding. There are a host of intangibles that can’t really be quantified by money, such as public relations, brand perception, loss of future customers, and even the loss of qualified employees. I knew companies that lost great managers to other businesses because they weren’t open in time, while their competitors were ready to take their valuable skills.

The original company couldn’t pay them during the 8 weeks they were closed, and the employees still had bills to pay and mouths to feed. That compounds the problem because now your competitors have an edge on you, and you now have to either: hire and train new employees or make significant sacrifice to get the ones you lost back.


A good disaster program will make sure that you have a disaster plan that is tailored to your business, with training of your employees and periodic exercising of the program with realistic scenarios.

Your small business has the most to lose, so do what your Fortune 500 counterparts do: get a disaster program. It's not worth saying "No" to.



Patrick Hardy LL.M, CEM, ALEM, LEM-Pro

4 Signs Your Employees Aren't Ready for Disaster

During a disaster, you have a choice: either you can make money or lose money. There is no “breaking even” when a disaster strikes. But you have to have your disaster program ready, and employees are the critical element that makes or breaks a company’s response.
 

They are the ones who will get your processes back up, expand your client base, and get you back in business. But that means they have to be ready for the disaster. But how do you know if they are ready? Your employees aren’t going to tell you outright that they aren’t ready for a disaster.

Wondering if your workforce is prepared for a disaster?  There are 4 signs that you should look for that will help you answer this question:


Lack of Knowledge of Disaster Plan

This is an instant give away. When employees don’t have even a basic understanding of how the plan works, there is a 0% that the plan will function the way that it was designed. Disaster plans are technical documents that require constant training and employee readiness about them.

They should know how the company will communicate in a disaster, where the alternate site locations are, how to reestablish basic company functions, etc.  A couple years ago I was talking to a colleague once in the recreation industry, and she had no idea where the business would go in a disaster, even though the company had spent tens of thousands of dollars to set up an alternate location!


Indifference to the Disaster Program

In other words…no one cares. I can tell instantly when employees are indifferent to a disaster program: as soon as the disaster program is brought up in a meeting, people start to yawn, or open their smartphone, or show renewed excitement for that upcoming dental appointment.

When the leadership isn't actively engaging with employees, the disaster program is at risk of becoming obsolete. An adaquately trained workforce will keep an eye out for changes in the company that will affect disaster operations.

They also hold regular discussions with the employees in meetings specifically devoted to the disaster program. These are programs that will last in the long term.

Lack of Questions

When employees aren't asking questions about the plan that means they have never been engaged in the disaster program. No disaster program, regardless of its mechanisms and the expense that went into its creation, is perfect.

Employees that are ready for disaster ask questions about the program and the implications for themselves and their families.


Empty Exercises

Employees who are ready for a disaster understand how critical it is to participate in disaster exercises. I have seen companies that hold an exercise from 8AM to Noon, and half the employees don’t bother to show up because they think it’s an optional vacation day!

The leadership and the employees need to understand that exercises are critical to the disaster program, and that management means business. And they don’t have to be boring!

If management takes the time to create a fun exercise, everyone will want to participate.

 
If you are worried that your employees aren’t prepared, make sure you engage a disaster manager who can help develop a customized program unique to your workforce! This is the most effective way to Reverse Disaster.

Prepare for Technology Crashes

Yesterday, a hacker from the group Anonymous took credit for a coordinated cyber attack against Internet domain registrar and web hosting company Godaddy.com. The denial-of-service attack caused a complete company-wide outage for several hours, and was the largest in the company's history.

The result was chaos. Millions of small business websites were down, including shopping carts and e-mail accounts. 

Regardless of your position on Godaddy or Anonymous,  September 10th cyber attack should be a wake up call for your business to prepare for these types of major outages, or one of the casualties is going to be your business. Outside of non-state groups like Anonymous, there are a number of nations that are known to recruit and train hackers with state complicity or encouragement: North Korea, China, Russia, among others.

Godaddy is unlikely to lose its company because of the outage. However, as a small company, you probably do not have the substantial financial resources to ressurect lost business. And if you do have the money, why not spend it in a way that ensures you can take advantage of your competitors' lost business?


Website/Shopping Cart

Simply put: If your site is down for hours, your competition is going to be cheering! Even if it is for a short time, your reputation can be damaged, and potential clients will go elsewhere. However, if your competitors are not prepared and yours is, this is a chance for you to increase your business and gain ground on them! But you have to have the adaquate preparation first.

If you aren't ready for a cyber attack, you risk wasting a lot of money, particularly if you have an online advertising presence. You will still be paying for the clicks and online time, but you will get ZERO conversions. That is money thrown away. Even if you do turn the advertising off in time, you will be losing valuable face time with potential clients.


E-mail

Using a personal e-mail address to send professional correspondence looks amateur and rookie. Not only is the e-mail address going to be foreign to clients, vendors and others, it might be placed automatically in the spam folder by a message server. This is the case with Hotmail addresses, because the server will associate the word "hot" with pornographic material.

One of the other issues is the content of personal e-mails are not appropriate to the professional setting, and are rarely corrected in time. More than once I have seen disaster-striken companies who (inadvertently) send out a client e-mail with something like this in the signature line:



Jon "Bubba" Smith
"As always, EAT the MEAT, TOSS out the BONES"




Is that the impression you want to make with a new client? In business we talk a lot about first impressions, and a signature line with "eating meat" and "tossing out the bones" is not a way to foster a professional, long-term relationship under any metric. This is a reason we create a clear differentiation between professional and personal e-mail addresses. During a disaster, this line does not need to be blurred.

This also does not account for the fact that you will now have to forward all the e-mails from the personal box to the professional box, will have to delete the message in the personal box, make sure you have not violated your privacy or terms of service, and then hope that your clients aren't e-mailing your people on their personal address.

However, this can all be avoided with some simple preparation.


Reversing Disaster - Basic Tips


1. When your company is facing a disaster, your company should seek to look even MORE professional, not less. Every e-mail, every message, every client interaction should be given the highest professional feel possible.


2. Don't put all your technology eggs in one basket. If you use one vendor for all your IT needs, this is an invitation for trouble. Spread out your platforms (hosting, cart, e-mail etc.) between multiple vendors. This will ensure you have a resiliency for your business.


3. Purchase a disaster plan from a reputable source. Don't waste your time buying templates or getting disaster plans from some fly-by-night business you find online. Get their credentials, make sure they understand your long-term needs, and stick with them. They will keep your business resilient.

Commit to a little preparation, and your company can easily Reverse Disaster.


Patrick Hardy, LL.M., CEM, ALEM

Plan for Rain on Your Parade

Tropical Storm Isaac (which is not yet at hurricane strength at the time of this writing) has threatened to rain on the Republican parade at the National Convention in Tampa, Florida. The Convention organizers have already announced a shortened schedule, and a general interruption of the proceedings.
 While the Convention most likely won't be cancelled, for businesses that attend, host, sponsor, or organize conventions, expositions and large events, it's a good lesson. When your company commits valuable resources in time, effort and money into an event, ensure it also has an appropriate disaster and continuity plan. Many events around the US are interrupted or cancelled every year by natural or man-made disasters.

First, I would like to make a quick note on their relationship between event disaster plans, and comprehensive disaster plans for your business: they are not the same. The plan you have already codified for your business covers your employees, facilities and processes. Any large event should be considered a separate process from your company, and should be planned in juxtaposition to your current disaster program, whether you are an event attendee, or the event host/sponsor/organizer.

 

Event Attendee

 

Your business needs to consider its continuity in light of being an event attendee, as your loss can be significant. I knew a company that attended an annual conference in the midwest of the United States as an exhibitor. They brought large amounts of marketing materials, half their workforce, their largest truck, and samples of the product to be sold. As happens periodically, one year, a thunderstorm touched off a tornado that destroyed the truck, along with everything inside.

This became a serious problem. The company sold specialized metal beveling machines, which were purchased from one vendor overseas. That vendor was backlogged with orders, so it was over a month before the company could fulfill their existing orders, which meant those customers went to their competitors.

Furthermore, with half the workforce displaced, the company had a very difficult time rebounding. Insurance money did not cover overtime costs for their employees, and the loss of revenue stream was significant for a company like this in a niche market.

Event Sponsor/Host/Organizer

 

If you are the sponsor of the event, or host a recurring large gathering, your event preparedness should be a permanent addendum to your current plan. This is particularly true if your company is a non-profit or a trade association, because confidence in your ability to host the event is the critical factor in the draw for companies to attend. Questions your company should be asking include:

• What happens if your event has half the number of participants because of a disaster?
• What if they ask for refunds?
• What if they withdraw from the vendor exposition contract because of a storm, flood, earthquake or some other interruption?

 

And it isn’t just these natural risks that can affect your event. If your organization is tainted by a scandal, or some act of corruption, you can expect that your lead sponsors will pull out of your event.

Your disaster plan needs to have a contingency for your event so that it doesn’t sink your entire organization. Insurance may cover certain perils, but it will not cover loss of reputation, or the damage of future loss of revenue, or loss of potential clients.

 

Event Disaster Plan Considerations


Your event disaster plan needs to consider a number of elements. However, that plan should not be constructed in isolation. Your company’s overall disaster plan should be tied in closely to your event plan, discussing:

• Alternate Sites
• Crisis Communication
• Insurance (especially any covered and uncovered perils)
• Information Technology Contingencies
• Site Vendor Coordination

Your company should adopt a rule: if one is disaster plan is activated, the other should be activated.  This is because they will affect one another as you shift resources, personnel and money to one or the other as you reverse the disaster.

There is one other consideration for any event disaster plan. If your event takes place outside the jurisdiction of where your company is physically located, that means you will need to establish new relationships with the local government, first responders, etc.

These are not tertiary or unimportant relationships!

If there is a disaster at your event, and you have not consult the authorities, you are asking for trouble. Jurisdictions do not take kindly to event planners that ignore them because they will take the heat from the media and the public for any problems that arise. I remember when I was an EMT for an event at a large convention center some years ago. There were just two of us, with one ambulance, and a second backup crew. As the event progressed, we became overwhelmed and couldn’t handle the flow of participants coming out of the facility needing assistance.

The reason? Many of those at the event had checked out of cancer wards and hospices to receive some type of religious healing. When that did not work, we EMTs were stuck trying to get these people back home. The City was very unhappy that the organizers had not informed us of the demographic attending, which drew away resources from other 911 calls and emergency medical responsibilities.

Conclusion

Your company may have a terrific disaster plan, but if it is not also including those events you attend, sponsor, host, or organize, you are inviting a greater potential for business interruption. Make sure your business continuity company is planning accordingly. This is the only way to Reverse Disaster.

Patrick Hardy, CEM, ALEM, LL.M.

How does FEMA fit in?

I have no regrets saying that as an undergraduate I was a strongly-leaning libertarian. And I was vocal, too. As a political scientist, I had a lot of opportunities to inject myself into our Socratic Dialogues and make my opinions known about the postal service, social programs and NATO. I don’t know how my professors and colleagues put up with me, but they all showed remarkable restraint in not taking the bait (most of the time).

What makes that all the more ironic is that this year I officially became a federal bureaucrat. I accepted a rotation as the first business owner as the Private Sector Representative to the Federal Emergency Management Agency (FEMA). That role was originally set up by the Private Sector Division of FEMA to establish constructive relationships between the government and private industry in a disaster.

I accepted the rotation because I felt as though FEMA has a role to play in how companies respond to a disaster. This is the first part of an occasional series on FEMA and how they can assist you and your business in Reversing Disaster.

1. Money

This is the one people love to talk about, because the concept of “free money” is such a temptation, but it is also the one most subject to mismanagement and abuse. Remember the debit card-debacle in New Orleans? That was not an aberration. FEMA misallocates millions of dollars every year, and creates perverse incentives for people to do unsafe and reckless things. 

However, as a business owner, FEMA assistance can go a long way to help your employees and their families, so you can get back into business faster. FEMA offers a lot of different types of assistance for them which can supplement income, and provide temporary housing assistance.

2. Information


In my personal experience, this is something that FEMA does well…assuming you can find it. While I feel like FEMA information is mostly helpful, they have had a lot of trouble in the past with dissemination. Very rarely does FEMA provide a single-bottom line and communicate it well. This is the reason why the national press quickly catches on that the national office representatives and the field personnel are not singing from the same sheet of music.

For business, though, FEMA can provide information on mitigation measures, response activities, and provide safety information for you and your employees. They liaise with all the local and state agencies and responders, so you can minimize the risks to your employees and clients. They can also act as a conduit, in the sense that they can usually help you find the information you need on road closures, assistance updates, sheltering activities, etc. 


3. Crisis Counseling


Counseling after a disaster is not a new iteration. The Red Cross and other agencies were doing some kind of spiritual or psychological counseling for victims of disasters and wars since the First World War. FEMA now provides crisis counseling alongside these agencies, as they are able to mobilize mental health professionals quickly and efficiently to a disaster area.

In your company, your people are your most important asset. If you are a single-person business, the most important asset is you. And, of course, you need to be in a rational, steady-state of mind if you hope to keep your business continuous. You should know your limits and those of your employees so that they are not placed with undue stress

FEMA and other disaster counseling can help. The counseling is free, and could go a long way for your employees who are concerned about their family and friends. For example, disasters are very distressing events for children under almost any circumstances. Parents, guardians and other relatives can also be placed under additional stress from a disaster, and the counseling can provide a relief for them.

Conclusion


What is critical to remember is that FEMA cannot be all things to all people. Don’t expect it to be your Mommy or Daddy after a disaster strikes. They can only do so much.  By recognizing their strengths, and their limitations, you will find that FEMA does have a place in your disaster response. Utilize some of these resources available as they can be of great benefit to you and to your employees as you Reverse Disaster.

Patrick Hardy

Threat #2 (National Planning Scenarios) – Major Hurricane

June 1, 2012 was the inaugural day of the 2012 Hurricane Season. With that, I felt as though it would be appropriate to create an entry for a Major Hurricane. For many people living on the East Coast of the US, the Gulf of Mexico, hurricanes are a way of life. Luckily, however, for many other people in the US and abroad, the threat of a hurricane of any type is so remote as to be virtually impossible. 

I grew up in Orange County, California, where I am not sure I knew how to spell hurricane until I was 18. The conditions for a hurricane have to be just right: the temperature of the ocean, the wind, the humidity, the currents and the type of ocean topography all play a role. And, let me just say: on all fronts, California just doesn't have it.

My grandparents (rest their souls) lived on the islands of Hawaii, where the climate is humid and is perfect for hurricanes. But even there, storms of that type are relatively rare. However, when I graduated college, I soon found myself in Baton Rouge, Louisiana as a novice emergency manager, and discovered an entirely new type of disaster.

If you had the opportunity to view any of the coverage of Hurricane Katrina, Andrew, or any of the other major hurricanes that has struck in the last couple decades, you probably have a taste for their destructive potential.  However, like any major disaster, I tell people that they don’t fully comprehend an event unless they are actually there, experiencing it firsthand.

My third week living in Louisiana, the state was hit with a Category 1 hurricane. What I noticed about it was the completely anti-climactic nature of it. I was expecting complete devastation, flooded streets, and FEMA debit cards. What we got was…nothing. A little rain, a little wind, and that’s it. The lights were on, internet was working, and I went to work as normal.

Hurricanes severity is measured by the Saffir-Simpson Scale. The scale measures 1-5, with 1 being the lowest end and ascending in severity to a 5. Typically, a “Major Hurricane” is defined as a 3 or higher.

A couple summers ago, I was training a group of engineers about hurricanes in the Panhandle of Florida. One of the participants approached me later and said, “You know, I don’t even stop mowing my lawn unless it’s a 3 or higher.” To the rest of us, that may seem a bit cavalier, but that is the typical mindset for residents of Florida.

The reason for that is pretty simple: Florida gets them a lot.

Hurricanes typically give a long lead-time before landfall. We can now track storms all the way from their genesis out in Africa (where they begin to form off the coast) to their dissipation point. Sometimes the storms don’t make landfall at all. For example, the 2010 Hurricane Season was one of the least active, while 2005 one of the most active.

While the Gulf of Mexico is known as the hotbed for hurricanes, they can easily strike the East Coast. In fact, until Hurricane Katrina, one of the worst known hurricane landfalls struck New York City in the 1930’s. It almost single-handedly ground that city to a halt, and caused immense chaos. This was about 50 years before FEMA, but was an event that spearheaded the movement in the US for a more organized government response to disasters.

As a business owner, your employees need to have a family disaster plan. Hurricanes are incredibly disruptive events for your business.  Make sure your operations are reinforced with the following:

Emergency Response Plan

Make sure your plan covers a major emergency, and has contingencies for evacuations and communications. Remember, phone lines may be out, cell phone towers may be knocked down, and things may be difficult. Redundant communication methods are the key.

Business Continuity Plan

Make sure your BCP contains the operational contingency plans. Your facilities may be damaged, and I can 100% guarantee that you will be disrupted.

Training

Of course, your employees need to be trained on communications and hazards. But they also need to know your company's policies. They need to know what you expect from them when disaster strikes.

Exercises

If you live in a hurricane area, you should be running at least one exercise per year (preferably in the March/April area). The exercise should be for a major hurricane, should include flooding, and incorporate local responders. In your area, your local emergency management agency will hold an annual exercise. Work closely with them.

Certification 

Like clockwork, every March or so, I start to see advertisements for disaster planners who are selling disaster programs. Do NOT invest in any disaster plan that does not have a Certified Emergency Manager and Certified Business Continuity Professional. Otherwise, you roll the dice with quality.

Conclusion

Remember, that very disruptive events like a Major Hurricane can be the crucible test for your business. It has the potential to disperse your employees, erode the infrastructure, create confusion, and prevent you from reopening quickly. Make sure your disaster program is ready for it. This is the only way to Reverse Disaster.

Patrick Hardy

Why does a business need a disaster plan?

Two weeks ago I was mixing with a crowd of chamber of commerce members, and I started talking to a guy who ran a local barber shop. I told him what I did, and he told me that he didn’t need disaster planning services, because he had insurance.

"So why does a business need one?" he asked. Oh boy.

There are a lot of reasons, of which just a few are below. What he doesn’t realize is that insurance just isn’t enough.  Don’t believe me? Just ask the businesses of New Orleans what they think. Insurance is a wonderful tool that can assist in controlling or financing risk, but it isn’t something to supplant a good disaster plan.


Recovering Operations

If your operations are interrupted as a result of a disaster, it is critical that you get those back on track as soon as possible. Simply stated, if your critical processes aren’t recovered, there is no way you can go back to making money, and without a disaster plan, there is no way for you to get back into business. Companies have tried for years to avoid disaster planning, and there is just no way around it.

Think about it in terms of your business: Would you start thinking how to develop your product after you got your first order for one? Of course not, that would be crazy. So why would you do that in a disaster?

Consider this as well: If you lose customers to the disaster, do you think they will come back to you?

Loss of income insurance only goes so far, and the covered perils aren’t always the ones your company is likely to face. In one of the Gulf Coast disaster areas where I worked a couple years ago, there was a beach wedding photography studio with 5-7 full-time employees.

When the disaster struck, the beaches were complexly quarantined and isolated. The studio executives had no idea what to do, but they tried to make alternate arrangements for the bookings they already had. Unfortunately, that was too late. About a year later, I found out the company had gone out of business and faced an equity loss of almost half a million dollars.


Protecting Employees


If you have employees (or are a single-person business) you owe it to them to have a plan in place. Many, if not all, your employees are relying on you to continue to be in business so that they can continue to make money. During a disaster, a family will be stretched financially and will require that income. If they don’t get it, there is a domino effect of losses from business to person.

Ironically, the problem could be the exact opposite, where employers are expecting employees to come in without communicating that to their workforce. A few years ago, I worked with a graphic design company that nearly found itself in legal jeopardy after they fired two employees because they didn’t show up to work after a disaster.

The employees were living in a rural area where cell service was almost nonexistent as a result of disrupted communication towers. The company was so infuriated that they didn’t come to work that they sent nasty termination e-mails. Within a week, though, the employees were threatening litigation, and the company relented. It was soon after that I got a call from them inquiring about a disaster plan.


Protecting Property

It is well-known that the majority of the damage during Hurricane Katrina occurred after the hurricane had left New Orleans. It was the flood waters and the resulting deluge that caused the majority of the property damage. This is why a good disaster plan can keep you out of trouble. A plan that determines evacuation of employees and property, and adequately budgets for resource protection and supplies has the best chance to mitigate damage after a disaster.

When I was growing up in Orange County, we were told to get sand-bags and prepare for possible flooding during El Niño, which is a weather system that periodically strikes California. I remember as a child wondering why people needed sand bags when we had the beach not 50 yards away! As an adult, I would ask why people didn’t buy the bags beforehand, and have an executed plan for filling them, and placing them in the most vulnerable areas of their property.


Conclusion


Remember, disaster planning is not just something you do after disaster strikes. Whether you are a barber, a wedding photographer or a graphic design company, your operations, employees, and customers are relying on you. Remember, if you aren’t there to fill orders and provide services, there will be another company with a disaster plan that will be ready to steal your clients, all because they had a better method to Reverse Disaster.