Protect Operations

Gather critical documents and information needed for decision-making. These are the key documents that help you make decisions, such as:

• Legal documents
• Insurance policies
• Agreements
• Leases
• Floor plans

Although these documents are typically kept on hand by a company, they are not usually all kept in one place. This makes them difficult to locate during an emergency, especially if the person(s) most familiar with those documents and details are unavailable.

How you gather these documents will differ depending on how you back up and store your information, but it is best to store this critical information in more than one format (e.g., on a laptop or thumb drive, in a cloud environment that can be accessed via computer or smart phone, or in hard copy). Consider these as reference documents to be included in your plan’s appendix. Many will help you with your current planning process, and others will be needed to assist you during the recovery process.

Also, make sure that when any of these documents are updated (by the departments or people responsible for them), the new information gets incorporated into your disaster plan. Not having current information can impede effective decision-making and cause unnecessary delays and losses.

Identify your critical operations and processes. This will help you prioritize which pieces of your business must be brought back most urgently after a disruption in order to open your doors and minimize losses. For now, think only about how things work under normal, everyday conditions. Consider what it is that your business does, and list each process.

For each process, make a list of what you rely on to make that process happen. For example, maybe Process 1 requires that particular parts are shipped in, or that supplies are received from XYZ vendor. These are your inputs.

For each process, make a list of the outputs of that process. For example, as a result of Process 1, customers buy a product, or the products are shipped to a distributor.

Here are two ways to look at what you are identifying about your business:

Input → Business Process → Output

or

What/who do we rely on to begin? → What do we do? →
What/who do we rely on to finish a product or to whom do we provide it?

You may have multiple inputs and outputs for each process. After you have completed your list, then prioritize which you will need to restore after a disruption to minimize losses and keep your doors open.

After you have prioritized your list of processes, consider any timing that may affect each, thinking about which processes are dependent on other processes. Adjust your priorities if needed. For instance, suppose one of your critical processes is roasting coffee beans. One of the outputs of that process is to ship them to your customers. But if you haven’t identified the recovery of your mail room as a priority, your ability to fully complete your critical process will suffer.

Priorities are unique to every business, as no two companies are exactly the same. However, you can talk with businesses like yours and listen to stories about where they found gaps in their process planning and how they are addressing them.

This is also an area where the value of the Planning Team comes in. There are too many processes in a business for anyone to know all of them, as well as all of their inputs and outputs. The Planning Team members can pool their knowledge to come up with a complete picture of the business. Yes, this can be a complex task, and compiling this information is unlikely to get done in a single sitting. But putting in the time and effort required here will ensure that all aspects of your business are covered in your company’s disaster plan.

Pick times for your team to review your critical priorities and ensure they are in line with management’s vision for how the business should operate. If they are not, the identified gaps that exist in processes will become important areas to address so they can be recovered in a timely manner. Make a list of all gaps and vulnerabilities.

Once you complete this, you will see areas where potential vulnerabilities and gaps exist. Keep in mind that, for now, you are only looking at your processes as they occur under normal conditions, when the power is on and everyone can come in to work. During an actual crisis, you will have interruptions to your processes, inputs, and outputs, possibly all at the same time. The work you just completed will help you recover.

Identify the potential disruptions to your operations. Every business is vulnerable to something. This process helps you to determine which hazards can affect your most critical business operations so you know which ones you will need to protect in order to stay open. Now that you have prioritized your business operations when the lights are on and computers are working, it’s time to consider those hazards that may delay or disrupt your operations. The most likely disasters to hit a business are power outages and fires. A fire may not only disrupt your processes, but also may force you to relocate entirely, either temporarily or permanently.

Work with your team to list all the potential hazards to your business, both natural and man-made. Next, rank them by:

• Likelihood: How likely is the event to occur?
• Impact: What is the potential impact(s) to your business?

For instance, floods may occur all the time in the counties near ABC Corporation without affecting the business district directly. Hurricanes, however, while occurring less frequently, may expose ABC Corporation, because of its location, to potential damage from high winds that blow in from the coast.

Likelihood

You may not know the possible hazards that have occurred or may occur in your area. No problem! Rely on the experts at your county or state office of emergency management, or start by learning more on this site. Also consider hazards that can affect businesses specifically, such as sabotage, pandemic flu, fire, or other hazards that are unique to your company.

Impacts

Since you have already prioritized your critical operations, take your list of hazards and determine which may have the most significant impact on your business. Look beyond your four walls and consider the full scope of your business. For example, how will your employees get to work? How will your customers be affected? Do you have a primary supplier located in a high-risk area? If so, you are only as protected as that supplier. If you have no other supplier of that product/service, you now have what is known as a “single-point-of-failure.” This means that no matter what you do to prepare yourself, you will be impacted if they are impacted, and that can mean big problems for you.

From your list of critical operations, you now know the priorities that need to be addressed in order to minimize losses to your bottom line. Review your list and then select the solutions to help you reduce or mitigate the potential impacts. There are resources for different hazards to assist in doing this.

Do executives at your company need convincing to spend some money on addressing some of these issues? Calculate the costs of the mitigation measures required. Now calculate the financial impact of closing your doors: lost revenue, repairs, insurance deductibles, brand effects, and potential loss of customers. Now compare the two costs and see if mitigating the disaster impacts would help reduce the losses after a disaster. If there’s a cost benefit, executives should see disaster preparation as a way to protect their bottom line.

Create a Grab-n-Go case. This can be a binder, folder, box or actual case that will contain a hard copy of your disaster plan and any relevant documents that you may need during and after a disaster. This does not mean you will be reading your plan during a disaster – there will be no time – but you can use parts of it as a quick-guide for your decisions, especially if you have included relevant checklists, decision-trees, call lists, etc. This case will also hold the critical documents, such as floor plans, lease agreements, and insurance policies, which you gathered in an earlier step.

While business is moving away from hard copies, keep in mind that power outages may limit your access to computers and the Internet, and that smart phone batteries have a limited charge. A Grab-n-Go is your last resort copy when all else fails. Or, depending your business, it may be your preferred first source of information. Regardless, it needs to be somewhere you will have access to when you need it. Some businesses will have copies in the homes of key staff and executives, and possibly also in their cars. (Be careful when storing sensitive information, such as the CEO’s phone number, in a car, due to the possibility of theft.) Security is also important if the plan is loaded onto laptops, which can be easily stolen.

Depending on its size, you can choose to have your entire plan in your Grab-n-Go or just the most relevant information for helping you make decisions when responding to a disruption to your operations. Again, the most important lesson learned by other businesses hit by disaster is that the information in the Grab-n-Go case and your plan MUST be up-to-date. As the plan builder, set reminders for the critical information that needs to be updated (monthly, as needed throughout the year, but at least annually). Make sure those updated items are also put into your Grab-n-Go and saved to your thumb drive or wherever you keep your backups. Take it from those who know.