When your business is faced with disaster, how will you keep up day-to-day operations? Preventing disruption is key, since any interference with daily business activity means lost revenue and reduced profit. Still, 51 percent of organizations across the world do not have a business continuity plan, according to a study based on Mercer's "Business Responses to the Covid-19 Outbreak Survey."

A business continuity plan provides a framework for addressing how to operate during a disaster, how to communicate, and how to recover. Covid-19 has shown many businesses the fallout that can result from not having a business continuity plan. It's late in the game to develop one now to address the pandemic; however, this is the right time to start planning for the next crisis—which can and will come, given time. Disasters will eventually arise in many forms other than infectious disease. The next crisis may take the form of a cyberattack, workplace violence, or natural disaster.

Whatever shape the next crisis takes, businesses need a plan to help ensure they're prepared in advance. Developing a business continuity plan that addresses all possible risks may seem overwhelmingly daunting. Following these six steps will help.

1. Assess the hazards. A sound business continuity plan should start with an evaluation of the risks and exposures that are unique to the business. This evaluation (risk assessment) is a great opportunity to foster collaboration among key stakeholders of the business, to determine vulnerabilities and estimate the potential impact of interruptions to critical business processes.

Start by identifying all the types of emergencies the business may face. This can be a great chance to think outside the box and expand the conversation beyond standard hazards like fire, weather, and utility outages. The analysis should include every component of the business's operations and detail how each type of emergency would affect each component, including impact to offices, jobsites, and customer or supplier locations.

2. Develop an emergency action plan. An emergency action plan (EAP) includes step-by-step procedures to address the potential impacts of the disaster. The EAP should list specific individuals to notify and should assign specific tasks to each individual. Document the EAP in writing, keep it in the workplace, and make sure it's available for periodic review.

Each potential emergency needs its own response plan. After all, it wouldn't make sense to respond to a fire in the same way you respond to a tornado.

To envision what an EAP might look like, consider how a company might prepare in advance of anticipated springtime storms. The action plan could include instructions for employees in the event of a tornado, such as:

• Immediately go to your designated on-site shelter.
• If there is no on-site shelter, go to a windowless interior room or a hallway on the lowest floor of the building.
• Stay away from outside walls and windows.
• Use your arms to protect your head and neck.
• Remain sheltered until emergency personnel arrive.

The EAP could also include instructions for response if the storm were to result in an extended power outage:

• Designated personnel turn off unnecessary electrical equipment and appliances.
• Designated personnel turn off and drain:
  • the fire sprinkler system,
  • standpipes,
  • potable water lines, and
  • toilets.
• Designated personnel move equipment containing fluids that may freeze.

Thinking through all the potential disasters the company might face, along with the appropriate response to each contingency, takes time. Without an EAP, though, lives might be at risk during some future emergency, making a treacherous situation even worse.

3. Build a crisis communication plan. When a crisis occurs, communication needs to be swift. Responses to customers, employees, stakeholders, suppliers, the community, and the news media must be fast and accurate, both during the emergency and throughout the recovery.

A global survey by Peppercomm and the Institute for Public Relations found that 55 percent of corporate communications executives think they were unprepared for Covid-19. Forty-four percent said their crisis communication plan does not specifically address infectious disease, and 10 percent don't have a crisis communication plan at all.

A crisis communication plan should name the staff member(s) responsible for communicating to each group of stakeholders and responding to media inquiries. The crisis communication plan should be activated in any emergency situation.

"When a crisis strikes, it's difficult to quickly assemble a plan for communication and roles, so planning ahead and having a crisis communication plan in place before a disaster is critical," according to Kelly Fletcher, CEO of Fletcher Marketing PR. "Now is a good time to meet with your organization's leadership and establish roles, spokespeople, and determine the necessary alerts and action plan. Prompt and clear communication can often mean the difference between a problem and a full-blown crisis."

4. Plan for recovery. A disaster recovery plan is another important document. It describes how a business will resume operations following a disaster—and how it will mitigate the follow-on impacts in the aftermath of the event. For example, remote work set up hastily during a crisis might result in a cyberattack. It's possible that data loss could have a larger effect on the organization than the original disaster.

It's important to have a plan in place that covers all the possible facets of disaster recovery.

5. Implement your plans. Once a company has developed a detailed business continuity plan that outlines requirements and responsibilities in the event of a specific type of emergency, it needs to distribute the resulting document to employees. If possible, employees should also receive formal training on the plan so that they understand expectations and responsibilities in the event of an incident.

The training should cover:

• threats and hazards at the workplace, including hazards unique to each employee's particular location or jobsite;
• the appropriate emergency response procedures by incident type;
• procedures for notification, warning, and communication;
• location of evacuation routes and on-site shelters;
• the location of fire extinguishers, alarms, and other emergency equipment;
• practice drills; and
• specific duties for each individual, including medical, rescue, or shutdown responsibilities (e.g., performing post-evacuation headcounts, operation of fire extinguishers, disconnection of utilities/equipment).

6. Measure the effectiveness of the business continuity planning process. It's often difficult to know whether planning and response for a hypothetical future crisis is adequate. Only after the disaster actually occurs can management gauge the effectiveness of the pre-event planning. Take Covid-19, for example. Businesses can now see and measure their level of preparedness for a global pandemic and the effectiveness of their crisis communication plan.

Nevertheless, companies can use the following key metrics to get a rough idea of their readiness before disaster strikes:

Don't Set It and Forget It

Without practice, even the best-laid business continuity plans can fall apart. One of the best means of preparation is the execution and completion of "tabletop" sessions. Tabletops are group exercises in which key stakeholders or responders run through a simulated scenario to practice response protocol, then evaluate their own performance to increase efficiency and help reduce the likelihood of loss. Tabletop exercises are also a great way to determine gaps in plans that may have gone previously undetected or may have been overlooked.

Scenarios used in a tabletop exercise should be predetermined and realistic, with responses conducted in real time. For example, perhaps one of the company's facilities is located near an active railroad track. The tabletop exercise should explore what would happen in the event of a derailment. Another scenario might consider how the company should respond if business were interrupted by a customer threatening violence or damaging property. What if the assailant were a relative or spouse of an employee?

The development and implementation of an effective business continuity plan can help leaders identify weaknesses and uncover vulnerabilities in the organization's operations. Proper implementation and successful training can help eliminate confusion surrounding responsibilities, reduce poor decisions, lessen the duration and impact of loss, and save lives.

See also:

• 5 Steps to Protect Your Business Amid Economic Uncertainty
• Bad Things Do Happen to Good Insurance Customers
• Who's Legally Liable for a Risk Management Failure?
• Emerging Risks: Get Ahead of the Unexpected
• Why Be Vulnerable?

Nate Reznicek serves as director of operations for CIC Services, LLC. He maintains an active leadership position in the captive industry and sits on the Captive Insurance Companies Association (CICA) Programming Committee, The Self Insurance Institute of America's (SIIA) Captive Advocacy and Captive Committees, as well as the International Center for Captive Insurance Education (ICCIE) Curriculum Committee. He is also a faculty member for ICCIE, where he teaches the "Forming and Operating a Captive" course. Reznicek serves as a subject matter expert on captive insurance for strategic advisers across the United States.