Fall World 2014

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

‘What If That Don’t Work?’ Some Timely Thoughts for Small Business

My thoughts were swirling during the chaos and devastation as tornadoes marched across Mississippi, Alabama, and Georgia during the last week of April. Small businesses suffered catastrophes ranging from total loss of their facilities to the inconvenience of not opening because of lost power. They were shaken, and shaken badly. Flood waters drifting down the Mississippi River will also affect unknown hundreds of small businesses this summer – family tragedies, loss of inventory, even loss of facilities.

While we criticize our teenagers’ driving attitude that says “it’ll never happen to me” but some of us do the same things when we conduct a risk assessment. Do these thoughts sound familiar?
  • We’re not in a flood zone, so we don’t need to worry about floods.
  • Hurricanes occur along the coast, not here. We don’t have to plan for them.
  • We have a generator, so we’ll always have backup power.
  • We’re not in tornado alley, so our probability of occurrence is really low.
  • We’ll always have plenty of staff to open.
  • We’re not a shelter. We don’t need a supply of water or food.
  • We have vendors to supply our inventory, supplies, and some of our critical services.
  • We have insurance to cover any physical damage.
Maybe there is a basic systemic problem that most small businesses don’t have a full-time business continuity planner. They relying on education by osmosis and hope to get enough information to begin thinking about building a business continuity plan.

The problem, however, is that natural disasters don’t care one iota about your auditors, profit line, employees, or customers. Mother Nature can be a cruel task-master, and, as Murphy’s Law No. 1 states, “Anything that can go wrong will go wrong, at the worst opportune time.” Neither Mother Nature nor Murphy is concerned about your supply deliveries, your landscaping, your vacation schedules, or your ability to get fuel, regardless of the interruption.

Disasters don’t have to be big to cause easily mitigated problems. Have you ever stood in line at the grocery store with ice cream melting in your shopping cart, correct change in-hand, and been told “the computer’s down?” A simple off-line cashier procedure would save a lot of ice cream.

And that’s where good planning comes in. All the best practices in the world won’t help you while you are standing in your parking lot after the tornado has blown off your roof, or after the flood waters pour into your lobby. That doesn’t mean you shouldn’t seek out assistance at the time of the crisis, but wouldn’t it have been a lot better to have planned for the disaster and known ahead of time what actions you would take in the event of a crisis?

Every small business needs to take a few minutes to ask one critical question with respect to your current planning environment, “What if that don’t work?” This will help guide the program to make the operations really resilient. Honest answers are critical.

Take a second to reflect on the tsunami crisis in Japan that exposed the four nuclear reactors. Nobody asked the question, “What if that don’t work?” Here’s what I mean.

Build a reactor along the coast in an earthquake zone, so we make sure we build in strong enough to survive any quake, say 8.5 magnitude, the largest we’ve ever seen.

“What if that don’t work?”

Magnitude 9+ quake cracks the containment housings. OK, but we built fail-safe mechanisms in to automatically shut the reactors down by extracting fuel rods automatically in a water cooled region. Electric power from the grid feeds back into the reactor to keep the cool water circulating.

“What if that don’t work?”

You mean, like, a tsumani that wipes out the grid? That’s easy, we have a bank of emergency generators to provide electricity until the grid power is restored.

“What if that don’t work?”

That’s OK. We just keep adding fuel to the generators.

“What if that don’t work?”

In fact, there are no refueling trucks. The entire community was wiped out. Even if the grid weren’t wiped out, refueling trucks couldn’t keep the generators running, because the streets are gone.

“What if that don’t work?”

Oh yes, it really doesn’t matter. Did I mention the generators were wiped out as well by the 30-foot wall of water? It isn’t just a matter of restoring the grid power, the entire grid in the community was wiped out by the tsunami.

Meltdown ensues.

OK, let’s apply this same methodology to a small business, and analyze our previous risk assertions:
  • We’re not in a flood zone, so we don’t need to worry about floods. “What if that don’t work?” Maybe you aren’t in a flood zone, but does your IT equipment, teller stations, or vital records care where water damage can come from? I don’t think so. It could be a burst water main, blocked storm sewer, section of roof missing. Water damage mitigation can take many forms: dry pipe extinguishers in your data center to complement an FM200 system might prevent one type of flood; manual cashier procedures to ensure you can still service your customers; off-site copies of vital documents, or electronic document backups to mitigate a file cabinet full of paper mache following the flood.
  • Hurricanes occur along the coast, not here. “What if that don’t work?” Violent storms occur everywhere, not just along the coast. The difference with a hurricane is that there’s usually less warning for inland storms. Your mitigations should include things like sheltering, emergency rations of food & water, provisions for staffing, procedures for working off-line in the event of wide spread power outages.
  • We have a generator, so we’ll always have backup power. “What if that don’t work?” It’s OK, we’ve got a fuel contract. “What if that don’t work?” The generator is under preventative maintenance. “What if that don’t work?” Manual, off-line processing can mitigate wide-spread lack of power. You can’t just pack up your marbles and go home if your generator quits.
  • We’re not in tornado alley, so our probability of occurrence is really low. “What if that don’t work?” Every state in the union has had tornadoes. Mitigations can include shelter-in-place, provisions for staff who lose their homes, off-line operations in the event of wide spread power or infrastructure interruptions. This one’s just waiting for Murphy’s Law to be implemented.
  • I’ll have plenty of staff to open. “What if that don’t work?” Check your pandemic plan and figure out how you’ll operate if you only have half your staff. What if the tornados hit where your staff live. What’s your plan? Just leave the doors closed? I hope not, and I’m sure your customers hope not as well.
  • We’re not a shelter. We don’t need a supply of water or food. “What if that don’t work?” How long can you operate in your offices with no water. Consider simple things like flushing toilets, which is where most of your water bill goes. An emergency supply of water can keep your doors open.
  • We have vendors to supply our inventory, supplies, and some of our critical services. “What if that don’t work?” Remember, during any crisis, your customers need you even more. Their loyalty rapidly disappears if you can’t supply your niche. Cash is king! Your customers often can’t use plastic in a crisis because your comm lines are down, your or point of sale systems won’t operate if they can’t talk to a centralized inventory control or the financial institution to get approval. Cash demands increase significantly during a disaster. In extreme cases, many of your suppliers can’t get through.
  • We have insurance to cover any physical damage. “What if that don’t work?” Can you wait to rebuild your facility until an insurance claim is settled? (Some Katrina claims still aren’t settled!) Do your customers care? They want access to your services, and during a crisis, they want it NOW!
See where this is going? Your mission is to provide your customers the goods and services you’re organized to supply, especially during a disaster. That means you should have a rudimentary business continuity geared toward one thing: Supporting your customers. It doesn’t matter what the disaster is, they need your support. From my perspective, that should lead to some really basic considerations as you build your business continuity plans:

1. Always have duplicate copies of your vital records. Hard copies in a storage facility or electronic copies on a computer. Regardless, they have to be secure, and they have to be accessible.

2. Always have cashiers (or other critical customer service staff) able to operate off-line (from folding tables in the parking lot, if necessary.) By the way, that won’t happen if they don’t practice it.

3. Always have a plan to manage your cash. When a disaster strikes, your normal methods of securing or handling cash may not work.

4. Always have staff cross-trained to fill in for missing staff, especially for critical functions such as cashiers and floor managers.

We’ll talk about moving your business from this provisional planning to a real business continuity plan another time.

Ken Schroeder, CBCP, is vice president for business continuity at Southeast Corporate.