In 2020, wildfires, hurricanes and a global pandemic were among the unanticipated events that disrupted both lives and businesses.
For many business owners, the stream of disasters served as a wake-up call, alerting them to be better prepared for unexpected occurrences, from accidents to natural disasters. But where to start?
Staples Business Advantage asked two experts about steps to take now to help your business cope with, and recover from, future crises. Isaac Monson, senior risk consultant in insurance brokerage HUB International’s risk management services division, and Leah Sawyer, MBCP, CEM, head of business continuity at Staples, share their insights.
Many business owners are looking for ways to be better prepared for emergencies. How can they get started?
IM: Having high-level support, such as the business owner or a C-suite executive, who can build awareness, promote buy-in and oversee the planning process, is a huge help. Without that support from the top, it can be hard to get a project team assigned and resources allocated toward building a program.
LS: Once you’ve found your high-level support, gather lessons learned from the pandemic and other recent crises your organization dealt with. Cultivate a mindset of being thankful when gaps are discovered. These lessons help make your organization safer and better.
Once you have a list, review it with your key partners, and make a plan to start closing the gaps. Then, review and update your existing business continuity program, if you have one, or start building one.
IM: This is also a great time to start building a plan because the pandemic has taught people the importance of having basic preparedness strategies in place for a wide variety of potential issues. We’ve learned a lot about how to manage through disruptions. Now is the time to capture and formalize those lessons.
The first thing we advocate, regardless of industry, company size or geography, is a needs and risk assessment. That’s essentially identifying all the various exposures or hazards—from natural disasters to workplace accidents that may impact your business.
In doing a risk inventory, you’ll want to take things like geography and industry into account. For example, when looking at natural disasters, if you have office space in Florida, you are obviously anticipating hurricane season, flooding issues and tropical storms, whereas if you have an office in Washington, you’re planning for hurricanes or potentially deadly earthquakes.
Are there best practices for addressing the various emergencies that most businesses face?
LS: Absolutely, there are so many resources when you know the right terms to look for. You don’t have to start from scratch. A good resource for identifying local risks is FEMA; put in your location’s zip code and it will show past disaster declarations.
In addition, “business continuity” is a profession that helps organizations survive when things go wrong. People aren’t always aware of the impact of crises on organizations. In 2018—pre-pandemic—more than 37,000 US business closed permanently following a natural disaster. There are many other kinds of crises that can also shutter a business.
IM: The goal is to tailor the response actions to your company’s needs, so it’s not a good idea to just pull generic policies and processes from the internet into a plan and put your company’s name on it. You want to put some thought into what makes sense for what you do and where you are. For example, a 10-person professional services office has a very different risk and response picture than a public hospitality business open until 2 a.m.
Does that apply to businesses of all sizes? That is, does a small business need the same level of planning?
LS: That’s one of the most important factors when working to make your organization resilient. What a business continuity program looks like can absolutely depend on what kind of an organization you are.
IM: Most smaller businesses have little more than an informal word-of-mouth understanding about what to do in an emergency. If there’s a storm, we go to the basement; if there’s a fire, we evacuate—that kind of thing. More sophisticated approaches and the other levels—crisis management and business continuity plans—materialize as businesses grow and scale.
Take into account how many people you employ and serve in developing a plan, and then revisit and adapt it as your company grows or as new risks come to light. In the example of fire risk planning, you might begin things like doing an annual fire drill and, if you own the building, a fire suppression system. The policies and processes should be written up in detail, including roles and responsibilities and any necessary training elements. That then becomes a living, breathing document that is reviewed and updated regularly.
So how do you go about making your company more resilient?
LS: In a nutshell, you want to have a clear idea of what work absolutely has to keep going no matter what, and make sure that you have the resources and people ready to do it. That’s the heart of business continuity.
A large organization may have a whole team of business continuity experts writing plans, conducting training and tests, managing the company through crises and updating plans with lessons learned. For a large organization, I’d verify that your business continuity program follows international standard ISO 22301 and the industry best practices of Disaster Recovery International’s (DRI) Professional Practices for Business Continuity Management. If you don’t have a program, consider hiring a professional with key certifications to build a business continuity program and get the organization prepared.
At smaller organizations, business continuity may be a side task for a team of people in addition to their main jobs. For this kind of team, access resources like the Ready.gov business site for work-focused preparedness advice and templates. I’d also encourage you to write up your building processes and laminate them—how do you evacuate, where do you gather, how do you turn off sprinklers before they destroy equipment or inventory, that kind of thing. The Ready.gov personal and family preparedness site can also help individuals make a plan for their families and build an emergency kit.
Being prepared is about taking time to make plans and connections in advance, so when things go wrong you are ready. Investing in preparedness helps protect your people, buildings and operations. It’s all very doable, and worth doing.
