Business disasters can strike at any time, often with little or no warning. Yet, according to a recent
study by a national non-profit organization,* more than half of small businesses have no disaster
recovery plan, and of those that do, the vast majority spend very little time making sure that their
information is updated and understood by all who need to implement it. Not having a plan, and
not exercising the plan, is almost like making the same mistake twice—and the result can be
devastating to your business. Creating, updating, and testing your plan are all critical to responding
successfully to a natural disaster or other business disruption.
To get you started, the Insurance Institute for Business & Home Safety (IBHS) has created OFB-EZ™ (Open for Business-EZ), a free, downloadable business continuity planning toolkit, to help you recover, re-open quickly, and reduce losses, available at http://www.disastersafety.org/open-for-business/. OFB-EZ gives business owners tools to better understand the risks they face; keep in touch with key suppliers, vendors and employees; make sure their information technology systems continue to function; and improve their ability to make quick, informed decisions after a disaster. Creating a plan is only the first step in disaster preparedness. The focus of this article is on making sure that the plan you create is up-to-date and actionable when you need it most.
Business continuity planning is an evolving
exercise that should be regularly reviewed
and updated because your business is
constantly changing. You may have new
products and services; upgrades to technology;
people coming, going, and changing
their responsibilities; and new priorities. All
of these affect your business and therefore
your business continuity plan. Preferably, your
plan should be updated as soon as changes
in your business occur. That way, the work
won’t pile up and you won’t forget something
At a minimum, your plan should be reviewed and updated at least once a year—but every six months is ideal. Once the plan is updated, be sure to redistribute it and make your employees aware of the changes, as this will help when they need to put the plan into action during an emergency when reflexive action may be needed.
Time and resource constraints make maintaining and updating your plan challenging. To simplify the process, the following is a list of questions to consider when reviewing your plan.
As soon as you have updated your plan, make sure it gets to the right people, and that they know their responsibilities. Here are some action items:
Can you imagine a group of actors
performing a play with no previous script
review or rehearsal? Yet, in the event of a
business disruption, most businesses expect
their employees to perform under pressure
without ever practicing their roles or testing
the overall plan. Without testing, you will
never know if your plan will work when you
need it most, and without exercising your
staff, you will never know if they understand
their roles and responsibilities and are able
to perform them. In addition, testing various
scenarios will teach staff what to do if some
resources are unavailable.
Periodic testing also will enable you to find the gaps that need to be addressed. Without testing, those gaps will stay hidden until it’s too late. Once identified, make sure your plan gets updated to account for those gaps and weaknesses. Then, practice again as soon as practical to make sure that the solutions really work. Testing is the only way to translate the elements of your plan into effective action.
When determining how often and how extensively you should test, consider that most business continuity experts advise businesses to test as often as possible, and at a minimum, on an annual basis. To keep your employees and business resilient, set up a testing schedule and share it with your staff to ensure full participation.
Most businesses use one of the following methods to test their business continuity plan. Regardless of which method you select, it is important to understand that the testing is not a fault-finding mission; there should not be a passing or failing grade. The objective is to learn and to ensure your plan is fit for any type of disruption.
The following are some important questions to consider when preparing for your next exercise, drill or test. Prior to any exercise or test, be sure your plan has been reviewed and updated, and is ready to use.
After the test, drill or exercise, you should document what worked well, what areas needed improvement, and any action items. Based on these findings, your plan should be modified to include the recommended improvements.
Disaster exercises provide opportunities for you to
test company disaster readiness; train employees
through practice; improve employees’ ability to
make informed decisions when responding to an
emergency; identify what needs to be done during
and after a disaster; and examine a specific
scenario or situation more closely.
OFB-EZ includes an exercise dealing with a common business disruption—an extended power outage. The scenario is available in the OFB-EZ toolkit at www.DisasterSafety.org. After accessing the scenario, gather your team, key employees and anyone else who would benefit from the exercise, and begin the discussion with the questions provided. This can be done informally, such as during lunch or as part of a staff meeting. The “final exam” for any business continuity plan is whether it works when needed during an actual disruption. What seems like a great amount of work to update, test, and improve your plan now may be what saves your business following a disaster. And, in the meantime, your business will be stronger and your employees better prepared for the unexpected.