Don’t Ignore Mother Nature – Plan Now to Ensure Business Continuity When Disaster Strikes

It has been said that an “ounce of prevention is worth a pound of cure.” This advice is especially true when it comes to planning for business continuity during natural disasters. Given the many competing priorities facing company leader, it can be easy to assume, because severe weather events and natural disasters are rare, that anticipating them doesn’t require immediate attention. But such thinking is effectively gambling with your company’s ability to operate because if recent history is any guide, severe natural events are now occurring with alarming frequency.

Earlier in January, the United States experienced an Arctic blast that subjected many cities to sub-freezing temperatures for more than two weeks. Simultaneously, a “bomb cyclone” along the east coast of the U.S. left states from Georgia to Maine mired in ice and blizzard conditions. Last summer saw some of the most extreme tropical weather events ever before witnessed in North America when Hurricanes Harvey, Ima, and Maria devastated the Caribbean and the southeast United States during a single month.

As alarming as the frequency of these extreme events is their severity. When Hurricane Maria made landfall in Puerto Rico, it knocked out power and water to nearly the entire island. Today, roughly 40 percent of the island still has no electricity. Hurricane Harvey dropped more than 27 trillion gallons of water in Louisiana and Texas; more than 40 inches of rain fell in some areas of Texas over a 4-day period. The impact on just one industrial sector was significant: As much as 31 percent of total U.S. refining capacity had to be taken offline or drastically reduced in the wake of the storm.

Mother Nature is as unpredictable as she is unrelenting, and that is why companies are smart to have in place Business Continuity Management systems (BCM) sooner rather than later. As we all know, the longer a company experiences downtime, the more money it loses, not to mention reputational damage and loss of market share. Anticipating the likelihood of severe events and mitigating downtime that follows is a wise investment of time and manpower. But it is important not to equate emergency management or crisis response plans to a BCM system. The former is appropriate for specific catastrophic incidents, such as a computer network failure at a power plant, structural failure at an offshore oil rig, or a cyber-attack. While having such emergency management and crisis response plans in place is important, they are different from a BCM plan, which guides the business in the event of a large-scale, long-term disruption resulting from extreme weather and natural disasters – or man-made disasters such as terrorism.

A BCM system is a holistic management process that identifies potential threats and vulnerabilities to a company’s business and operations, develops strategies to make operations resilient to a large-scale event, and employs procedures to quickly restore services and continue operations. This is done through a comprehensive set of arrangements and processes that define specific measures a company can proactively follow to prepare for a crisis or disaster, hopefully, prevent some of the worst scenarios, respond during the actual crisis, and effectively manage the long-term recovery (see illustration on the next page). Its purpose is to restore mission-critical services and operations following a disruptive event as quickly and effectively as possible.

There are six key steps to building a BCM plan:

STEP 1

Establish Planning Roles and Responsibilities — Identifying and understanding who in the company is responsible for specific essential tasks during and after a severe event is critical to effectively responding and recovering from the event.

STEP 2

Conduct Risk Assessment — Understanding all the risks that can impact the business during a severe event is critical to effectively managing them. Companies should conduct a thorough risk assessment to identify and prioritize all risks that could arise during a severe event.

STEP 3

Conduct Business Impact Analysis — Determining the impacts of all identified risks on specific business processes will help companies appropriately prioritize available resources to mitigate the loss or disruption of key operations and services.

STEP 4

Develop Continuity Strategies — Having plans, procedures, and agreements, such as Memorandums of Understanding with emergency suppliers, in place ahead of time to prevent, detect, respond, and recover from severe events are fundamental building blocks to sustaining operations, no matter the disruption.

STEP 5

Plan Testing, Training, and Exercises — There’s an adage in the risk management business that says, “You must test to ensure success.” Once a business continuity plan has been developed, it is wise to take the time to train staff so they are familiar with their responsibilities, and conduct simulation exercises to put the plan into practice so that when a severe event occurs, the company will be prepared.

STEP 6

Plan Maintenance — Things inevitably change within a business over time, whether adding facilities, shifting personnel to different locations, or changing suppliers and vendors. It is therefore important to regularly review and update the business continuity plan, ideally whenever there is a change to the business or operations. This will keep companies in the best possible position to manage unforeseen severe events when they occur.

Severe weather events or other disasters that can cause a lengthy disruption in operations are bound to occur, so smart companies are taking the time to plan ahead and anticipate those situations. Having a BCM system in place, and regularly reviewing, updating, and practicing it, will help companies weather the storm and resume regular operations – and lose less money – when a severe event inevitably occurs.