Why and How to Use this Toolkit
As a small business operating in California’s Capital Region, you’re exposed to a number of natural disaster risks. Whether that risk comes in the form of a fire, flood, drought or severe storm, your best response is to be prepared ahead of time. With Federally declared national disasters increasing in frequency and severity, it’s never too early to get started on a plan to make your business more resilient to disaster. While many resources are available to support you in this quest, the challenges for small business often include how to start and how to prioritize the time to make your plan. Strategic planning is important to every business venture regardless of its size, and disaster preparedness planning should be considered an important element of every strategic plan.
This toolkit is designed with the small business in mind, and provides a concise, accessible, action-oriented, easy-to-use guide to creating a resiliency plan for your business.
As a small business, you have limited time and resources, so it’s important to prioritize your use of both. A Hazard Vulnerability Assessment (HVA) provides a way to do that for your resiliency planning work. It helps you identify the greatest risks facing your business – by combining the likelihood of a hazard occurring in the first place, with the expected severity of that hazard’s impact on your business.
Once you have a prioritized set of risks or hazards, you can develop a resiliency plan targeted at those on the top of that list, making most effective use of your investment of time and money.
The Kaiser Permanente HVA worksheet is a widely-used standard, available for free download as an Excel spreadsheet. While this is a comprehensive tool developed for a healthcare-related business, it can easily be customized to reflect the realities of your own business. Find it online.
County/City Hazard Mitigation Plans: Cities and counties are required by law to assess the hazards to which they, and their residents, are vulnerable. You can use these analyses to inform your own hazard vulnerability assessment, and could consider simply adopting the hazard assessment of the city or county in which your business operates. These public documents are, in most cases, available for download from the city and county websites. You’ll find links to these documents in the Resources section of this toolkit.
Risk Assessment Worksheet (FEMA): FEMA’s tool is a slight variation on the Kaiser Permanente HVA tool, providing a more qualitative analysis. Find FEMA’s Risk Assessment worksheet online.
State Hazard Mitigation Map (Cal OES): The California Governor’s Office of Emergency Services (Cal OES) has an online mapping tool showing the reach of a range of potential natural hazards for the entire state. Find the Cal OES Hazard Mitigation map online.
The American Red Cross has developed and makes available the Red Cross Ready Rating program, which is a free, self-guided program designed to help businesses become better prepared for emergencies. The design of the Ready Rating program resulted from a comprehensive review of preparedness recommendations conducted by the American Red Cross National Office of Preparedness and Health and Safety Services, the national Ready Rating team, and the American Red Cross Scientific Advisory Council. All Ready Rating program steps and recommendations are grounded in scientific research, best practices and/or expert opinion from respected professionals representing multiple disciplines and perspectives.
– Are you committed to being better prepared?
– Do you know what hazards we’re vulnerable to?
– What actions have you taken to be prepared?
– What additional actions can be taken?
– What is your plan for responding in an emergency?
Develop a business continuity plan:
So at this point, you know your risks, and you know how ready you are should one of those risks become reality. Now it’s time to do the sustained work of developing a business continuity plan, ready to put into action when needed.
The good news is that there is a wealth of information about business continuity planning available online, as well as a wealth of expertise available in person via consultants, and finally a host of businesses that provide support and recovery services to their clients. So, there are lots of ways to get hands-on help and support for developing your plan, if you want that. It’s also entirely doable to develop a continuity plan with your company’s own resources and the information provided in this toolkit.
In this section, we walk you through Agility Recovery’s concise, user-friendly approach to business continuity planning, “Definitive Guide to Disaster Planning.” We profile this company so prominently because, in our research, we found their materials to be accessible, simplified, and comprehensive – all of which we think is important. But, of course, theirs is not the only approach, and therefore we also provide information about many other sources of similar information in the listing of Additional Resources at the end of this section.
1. Pull together a disaster planning team
This group will do two things: lead the development of your business continuity plan; and also act as the emergency management leadership group during a disaster. The team will consider both internal and external dependencies that keep your business running and your customers happy.
The size of your business absolutely determines how many people should be involved on this team. For the smallest companies, the owner/operator might be sufficient, who then trains his or her employees; in larger organizations, a lead person from each department or work area can be named, to create a truly cross-functional team.
Regardless of the size of your company, however, leadership from the top is essential to ensure that business continuity planning actually happens.
The disaster planning team will assign themselves specific roles in the event of a disaster, which could include:
- Retrieving emergency kit(s)
- Coordinating a building evacuation
- Accounting for all employees and communicating information to them
- Shutting down utilities and safeguarding the business location or building
- Keeping track of disaster-related costs
- Putting the emergency communications plan into effect
– If you’re an owner/operator of a small business, your planning team might consist of you and a few critical partners such as someone who provides you with computer/technical or bookkeeping support, and possibly your landlord if you’re leasing physical space.
– Larger organizations might want to designate a key employee from each department such as sales, operations, and customer service.
2. Develop or update your communications and contact list
Your ability to communicate effectively before, during, and after a disaster is possible the most important component of your business continuity plan, and includes both internal and external communications.
You’ll need to communicate with key groups such as employees and potentially their families; customers or clients; vendors, partners, and suppliers; the media and the community at large; public officials; and your insurance provider(s). Make sure your contact list includes not only primary phone numbers, but also alternate phone numbers for each contact type. Keep copies of your contact list on-site at your facility and at home. Storing a back-up copy online is also a good idea as is regularly updating your contact list.
A strong communications plan will include:
- Knowing who’s on the communications team, and what role(s) they play
- Having current (and regularly updated) contact info for all employees, and a single point of contact for employees to get in touch with
- Having a current master list of contacts in other key groups, including vendors, key customers, utility providers including electricity and water, local and state government, etc.
- Redundant communications. Identifying work-around lines of communications is important as standard approaches are often among the failure points in a disaster – for example, if your company’s telephone lines are down, how will you handle calls from customers, or necessary outbound calls?
Having a plan for communicating with your customers and suppliers is especially critical. Alternate communications options might include setting up a Google Voice account or leveraging existing social media sites like Face Book. Regardless of the communications alternatives you identify, be sure you fully understand their capabilities and be sure to test them to know how they’ll work for you in a disaster situation.
Make and keep a laminated emergency contact card to keep in your wallet. Include contact information for
- Local police and fire
- City or County Office of Emergency Services
- Utility providers (electric, natural gas, water)
- Alternate phone numbers for key employees and suppliers
3. Create or restock your business emergency kit
Make sure your business has an updated and well-stocked emergency kit with everything you and your employees may need in the event you’re asked either to evacuate or required to shelter-in-place. The purpose is to ensure self-reliance until help is able to arrive. Emergency kits typically include:
- Copies of important records and documents
- Basic office supplies, such as pens, notepads, stapler (and staples!)
- Software disks and licensing passcodes
- Petty cash
- Mobile chargers, especially solar ones for laptops and cell phones
- A spare set of keys (or key cards) to re-enter your premises
- Food and water for each employee for at least 72 hours
- Copy of the entire disaster recovery plan and of the disaster communications plans
- Flashlights and extra blankets
There’s plenty of information online about what should be included in emergency kits for businesses. You might want to check out sites such as Nationwide, the Rhode Island Emergency Management Agency, ready.gov, and more. There is also a plethora of already-assembled kits for sale from multiple vendors online, accessible via online search tools.
4. Ensure your data is backed up (protect your information)
Backing up your data is essential, and most businesses know that. However, it’s important to also know about retrieving and restoring it – what that process entails, and how long it is likely to take. Some backup services are better than others in supporting recovery and restoration. Be sure your data backup provider explains, and demonstrates, how their recovery process works.
Also, make sure that backups are actually happening with the frequency and completeness that you expect, and that the backups are tested, from different locations. The point of testing is to make sure you have all the essential business data you need in your back-up files and that you know how to access the information. Having more than one person who understands where and how to access your back-up data can be a key strategy for business continuity during a disruptive event.
5. Review your insurance coverage
Read your insurance policies carefully, and be sure to ask your insurance broker to clarify anything that’s uncertain. It can be helpful to run through some what-if scenarios with a broker: what if my building burns to the ground, or what if I end up under six feet of water? Talk not only about what’s covered (and what’s not!), and to what extent, but also about what to expect during the claims process, such as who you’ll be working with, how much time will lapse before reimbursement is made, how assets will be valued, and what proof the insurer will require. Reviewing coverage for the top priority risks you face in your business location is imperative.
Two kinds of insurance are most important in the event of a disaster: property insurance, and business interruption insurance. Property insurance secures the value of your business’s assets, including buildings, computers, equipment, office furnishings, and so on. Business interruption coverage reimburses you for income you would lose during an involuntary shutdown.
Keep track of your assets. Make a list and take pictures and videos so you not only know what you have before there are any potential losses, but you can prove it. Scan your receipts and keep everything together. During a regional disaster, insurance agents are likely to be overwhelmed with calls and claims. Having this information organized and to hand will help in your business’ claims process.
6. Determine and prioritize your essential business functions
Identifying your critical business functions and how long you can operate without them is the core of the effort of planning for business continuity during a disruption. This step requires the highest level of effort due to its critical nature. With your team, brainstorm each business process, system, and assets your business would need to restore operations back to their previous level after a disaster.
This will vary by business, naturally. A law office, for example, might need access to docketing software, conference rooms to meet with clients, a complete list of clients and courts, and a way to communicate with clients and courts even if the local city infrastructure is down, whereas an insurance company might need laptops or tablets with wi-fi, and portable printers for assessing claims in the field. Understanding your business essentials is a key step in planning how to get them operational again.
Begin by listing the broader business functions that come to mind and then narrow each one down to the essentials later on. It is easier to remove items from the list than to try to identify gaps later in the process. Document and prioritize those functions that are most critical for restoring operations, and then be specific about how many days your company can operate without that function. In many (but not all) cases, the answer will be zero.
Questions to ask yourself:
- What are your critical communications systems? (e.g., telephone, internet, e-mail).
- How do you communicate with customers and suppliers?
- What processes are critical to your top revenue streams?
- What functions need to be online immediately to operate your business?
- How long can you operate in the absence of each of your critical functions? For example, how long can you operate if a key supplier is unable to deliver supplies?
Be aware that this step of the process required a fairly high commitment of time, and can be complex. It’s also one of the easiest places to get distracted from the overall goal of a business continuity plan. You can keep all of this under control by working as a collaborative team, staying focused, and keeping it simple. For example, you might want to start with your five most essential business functions (as determined by revenue, profitability, regulatory requirement, or some other measure), and add others in later.
Business Impact Analysis (FEMA): A business impact analysis predicts the consequences of disruption of a business function and process and gathers information needed to develop recovery strategies. Find FEMA’s sample BIA worksheet online.
7. Find an alternate place to work
The time to consider where you might temporarily set up (or even permanently relocate) your business is before a disaster strikes – not once your facility has become inaccessible or nonoperational due to a disaster. These options should be part of your disaster recovery plan, and when an event happens, you simply tell your team to activate Plan A or Plan B, for example. With a well-planned and tested program, everyone will know what to do and will move into action.
Options for alternate facilities could include shared space agreements with another business, such as a neighboring facility or a partner; work-at-home plans (where possible, and generally for short-term solutions); or a previously-agreed, professionally-provided backup facility, either a mobile one or in a fixed location.
You should have more than one alternate location, in case your first-choice alternate is also affected by the disaster and not available.
Lesson learned: When their buildings burned to the ground, The River City Food Bank, a local nonprofit, and Party Concierge, a small local business, had the unenviable situation of looking for alternate work locations. Fortunately for them, the community rallied and provided access to space that helped them keep their businesses going while trying to rise from the ashes. Identifying potential alternate work locations in advance may help you keep your business going when disaster strikes.
8. Prepare your employees
Employee preparedness may be the most important aspect of your disaster recovery plan – since without employees, there is no business. Help your employees feel prepared both at work and at home, since those who have taken the time to prepare themselves and their families are more likely to be effective and present during and following a disaster.
At work, make sure employees have a copy of, and understand how to implement, your disaster plan. Don’t just send an email – consider a lunch-hour briefing session, as well as live drills.
An evacuation plan will be a part of your overall disaster recovery plan. Make sure your employees are well-trained in the evacuation plan and know where to go and what to do if a disaster happens. Repeat the training at least annually, and integrate emergency preparedness into all new employee training and communications, such as the employee handbook and performance reviews.
Some specific ways to ensure that employees feel safe and are trained appropriately include:
- Maintain a list of all employees trained in first-aid and CPR, and make sure employees know how to access this list.
- Help each employee create his or her own emergency kit at work, in their vehicle, and at home.
- Offer emergency and disaster response skills training at the office.
- Conduct evacuation drills semi-annually. For larger businesses, the fire department can be a source of good ideas and assistance.
- Invite speakers to present on preparedness. Some good sources of speakers are local emergency management personnel, including the fire department the Red Cross.
SMUD encourages their employees to have their own personal emergency kits at home and in their vehicles. In a disaster situation, SMUD needs to count on their employees reporting into work. In order to do so, they understand that their employees will need to know that their families are safe and secure in order to dedicate time to their jobs and keep the lights on for the community.
Visit the Ready.gov website for a list of item to include in a personal emergency kit.
Testing your business continuity plan to make sure it works as anticipated is also critical. Unless you have tested your plan, you can’t possibly know if the recovery strategies you’ve identified will be successful. Your plan should be tested at least once a year. As your plan is tested, incorporate lessons learned to improve your plan over time.
It’s important to test all critical functions, particularly those that would be most vulnerable during a disaster.
Two types of tests you might consider conducting are drills and table top exercises. A simple tabletop exercise can help you analyze the effectiveness of your business continuity plan in an informal, stress-free environment. This approach is cost effective and focuses on your people and the tasks they will perform in a recovery. During a table top exercise, you will walk through various scenarios asking “what if” questions. This type of test will help you uncover holes to refine and improve your plan. It will also help you build confidence in your plan and improve disaster readiness.
After conducting a few table top exercises, you might consider running a drill. A drill is a way to test your plan that most everyone is familiar with. For example, a fire drill can be set up to evaluate how quickly you and your employees are able to exit your building and to make sure everyone is aware of the designated meeting location in the event of a fire. Running a drill is more complex than a table top exercise but is a good way to ensure that everyone knows what to do before an emergency occurs.
Planning for what you can control – within the four walls of your business, and for your employees – is important and essential. But you’re also part of the larger community, and reliant on various public infrastructure, which is outside your control – but not outside your influence. Moreover, simply connecting with neighboring businesses to create a business continuity network before anything adverse happens will make that network far more resilient and quick to respond in a disaster. As a region, we’re all in this together. We’re stronger together than we are on our own.
Consider ahead of time what role you and your business could play in supporting your community during a disaster. Some potential contributions are obvious: hardware stores, grocery stores, and health clinics will be essential resources in the aftermath of a disaster. Other contributions are less obvious: a car rental franchise might be in a position to provide important transportation options, or a children’s daycare could provide emergency shelter.
Next, reach out to your local (city or county) Emergency Services department. Governments at all levels, utilities, and non-profits such as the Red Cross are actively involved in planning for community-wide resiliency in the event of broad-based natural disasters. Ask for their Disaster Response plans, and also ask what opportunity there is for businesses (and citizens) to provide input to the updating of those plans. Let them know that you recognize your business’ reliance on public infrastructure, and that it’s in your own best interest that the disaster plans in your community be as robust as possible.
Finally don’t forget about the power of a good business network. Work within your local business community, either on your own or through an existing business organization like a Chamber of Commerce, to create “mutual aid” connections and commitments, either formally or informally. Having these relationships in place before they’re needed means they’ll be far quicker to swing into action when the time comes.