By Sally Huggins

The people of Greensburg, Kan., didn't expect their town to be wiped off the map. The citizens of New Orleans didn't believe their city would be submerged and homes and businesses damaged beyond repair. The Waldo area in Kansas City didn't expect a fire to destroy several businesses.
Everyone knows disasters happen, but no one expects them to happen to their business. Businesses that have a contingency or disaster strategy in place are much more likely to survive intact if disaster strikes.

Statistics show that more than a quarter of businesses experience a significant crisis in a given year. And of those businesses without a disaster plan, more than 40 percent won't reopen.

A common misconception is that a small business doesn't have the same need for an emergency plan as a large corporation. But any size business can experience a disaster. It doesn't have to be a flood, tornado or fire. A disaster can be when hardware fails and you are a technology company or a power outage causes disruption in your business. Or, it can be a situation of workplace violence that keeps customers away.

"Imagine if everything you worked hard for in your business all disappears. How long would it take for your organization to be back up and functioning? That's what a business needs to ask," said Patrice Manuel, president of P/Strada.

Deidre Langseth, owner of Deidre's Travel Service in Waldo for 11 years, has firsthand experience with the unfathomable. Fire destroyed her business in February 2007.

"My books now start on February 16, 2007. Everything before that was lost," Langseth said.

No matter how small or large your business, you should conduct a business impact analysis to determine what parts of your business need to be up and running as quickly as possible and how to get them there.

A company needs to understand how it is going to survive if the unthinkable happens, said Manuel, whose company provides emergency preparedness consulting. Companies should determine what they need in place to be prepared in case of a disaster.

Often a company won't develop a plan because it doesn't want to incur the cost. But planning for a disaster need not be expensive. And, experts say not planning will be more expensive because it will take longer to recover-if the company recovers.

Assess the Risks
The first step is to identify potential hazards and assess their risk, said Curt Riggs, a risk consultant with IMA of Kansas. The risks can be natural or manmade.

"An event cannot be prepared for if it has never been considered, and it is pointless to waste resources preparing for an event that has little or no consequences," Riggs said.

While a company in Kansas may not have a pressing need to have a contingency plan for an earthquake or a hurricane, it should have one for a tornado. All companies should have plans for power outages or theft.

Remember also that it doesn't need to be a natural disaster for the occurrence to cause an interruption of business. A power outage in which your stock rots because of lack of refrigeration or a broken pipe that floods your inventory are situations where an emergency preparedness plan is important. Theft of a company's server could be a disaster, too.

Nick Crossley, interim director of Johnson County Emergency Management & Homeland Security, said he uses examples of the 2007 Greensburg tornado to make the point with companies about why they need a disaster plan. Johnson County provides a template so companies can develop a plan on their own.

"I tell them to make a plan. If you don't do something to ensure you still have your business in place after a disaster, its not going to make any difference what your business is," he said. "Make sure your plan fits your business and that it is financially reasonable. It doesn't have to be expensive."

Business Impact Assessment
Part of developing a plan is conducting a business impact analysis (BIA) to determine the impact on the business if various scenarios occur-from loss of key people, to loss of vendors or of a major system, said James Myers, president of Contingency Now.

"What is the cost to the business if they should lose an application or a person?" Myers said. "The BIA gives you a project plan and a good idea of where you should spend your money and why on mitigating your risks."

After the fire in Waldo, Langseth was able to begin operating immediately from her home, but all of her paper files and the company's data backup were lost. She had secured her data backup in a fireproof safe onsite, but it was crushed when the building collapsed and the data was damaged.

"I didn't have a plan. Everything on my computers was backed up, but I kept the backup in the safe. I didn't know that the safe needed to be crush resistant as well as fire resistant," she said.

Companies will spend considerable money on things that are not a top priority in getting a company back up and running after a disaster.
"Eighty percent of your business is from 20 percent of your clients, so that's what you want to focus on. That's what's going to save your business," Myers said.

 Once a company determines its vulnerabilities, it can create a recovery plan.

Managing Risk
Managing risk is a commonly overlooked element in business planning, especially by entrepreneurs establishing businesses, said Ed Fritsch, counselor with SCORE. An important part of any company's business plan should be risk management insurance.

This can include insurance for fire, theft, business interruption, personal disability, key person, credit extension, power interruption, temperature damage, and the list goes on.

Important to remember is that you shouldn't count on government intervention to get your company back on its feet after a disaster.
"Don't assume that the issue will be automatically mitigated by the government, or any other entity. If the disaster is big enough, you may be on your own," Riggs said.

Consultation with a property/casualty insurance agent is an integral part of a disaster recovery plan, Fritsch said. With a reputable agent's assistance, the various vulnerabilities of your company can be examined and appropriate insurance policies issued. SCORE provides consultations for new businesses about insurance options.

"Insurance coverage is the first thing to look at," Fritsch said. "The business owner should do a risk analysis. Find out what threats they have to their business and prioritize those threats."

Flood Assessment
In Kansas City, floods are a reality. And assuming that your company will not experience a flood because it never has, is not good business, said Brian Bowman, spokesman for the Federal Emergency Management Agency (FEMA).

"A lot of people have a false sense of security because they have been there for 10 years and it has never happened. That is not an effective way to gauge risk," Bowman said. "You could be just outside the flood-prone area, but that doesn't mean you won't get flooded."

Flood insurance is available to anyone but is required for certain flood zones as designated by FEMA. Assuming that your company doesn't need flood insurance because you are not required to have it, or that federal assistance will help you if a flood occurs, is a dangerous assumption, he said.

"Disaster assistance is not designed to make you whole. Insurance is designed to make you whole," Bowman said.

FEMA strongly encourages businesses to have flood insurance because the stories are rampant about flooded areas that had never been flooded before. More than 25 percent of all flood insurance claims are from low- to moderate-risk areas, according to FEMA.

Both FEMA and most municipalities have maps that show flood plains, Bowman said.

Identify Key People
Part of assessing the risks is identifying the people, processes and technology that enable a company to continue to operate during a disruption.

Manuel said her company consults with clients through its homeland security division to help them plan strategically for continuation of business.

A plan will determine individual responsibilities during an interruption of business and set a course for recovery.

A current contact list is vital to a company's continued viability. The list includes information on employees and spouses or relatives, key vendors and suppliers, and community emergency services. The list should be updated frequently and easily accessible.

The information about whom to contact regarding employees is important for notifying families if someone is injured or if the staff cannot leave a workplace after a disaster.

The plan should include a process for communicating with employees, depending on the type of disaster. It may involve reaching them if the building is destroyed or may designate a place to meet if the disaster occurs during working hours.

Identify Physical Resources
Having a current inventory of physical property is important, especially for replacement purposes. Information technology is a primary area of vulnerability and companies need to have a plan for restoring data if equipment is lost, stolen or destroyed.

"Data backup is basic," said Crossley. "It should be off site. And you should have plans and procedures in place to work from an alternate location."

Data backup is about as basic as it comes, but often a company creates a data backup and leaves it onsite. When the building is flooded or burns, the backup is lost too. So storing backups in a separate location is important. Online backup services offer one solution.

With concern about electronic data, paper documents can be overlooked. Consider key records and documents, Myers said, and prioritize them in the plan.

Things to consider are what documents are required for business success, what is required for legal reasons, for a regulatory agency or to support recovery efforts. Another consideration is whether the record can be re-created and whether copies are available at a remote site. Vital records could include employee data, payroll, customer/client lists, production records and strategic plans.

Some experts recommend that a copy of vital information be stored 50 miles from your place of business. Routinely updating those files is essential, too.

A current videotape or photo record of your inventory also is important to bring your company back to whole after a disaster.

After the Waldo fire, Langseth had to create a list of what was in her offices from memory. She didn't have any physical records.

"I had to mentally sit in my chair and start going around the office and thinking of everything. That's hard to do. I still think of things that were in the office that I forgot about," she said.

And because she had not changed her insurance to reflect improvements to the office, she wasn't reimbursed for the full loss. She is meticulous about all of that now.

Business Continuity
Consider an alternative or recovery location in case your facility is damaged or destroyed, Crossley said. For instance, an insurance agent could make contingency plans to operate from a fellow agent's office temporarily, sharing space and equipment, he said.

Disasters that directly strike your business aren't your only concern. A small business can also be indirectly affected by disasters from two sources-upstream and downstream resources.

Upstream losses result from a supplier who is affected by a disaster and can't deliver the services or goods your company needs. If a supplier provides parts to you and its building is damaged, resulting in an interruption of your deliveries, your business in turn is disrupted.

Downstream losses occur when a key customer or people in that customer's community are affected by a disaster. If a company you sell to is damaged by a tornado, your sales will suffer.

Discuss emergency plans with your vendors-your plans and theirs. If all of your suppliers are local, it can be useful to purchase occasionally from one outside the area so you will have a source if a regular vendor has to shut down.

Having a list of vendors and contact information also is critical if your facility is damaged. For purposes of ordering replacement stock as well as informing them of an alternate location for deliveries, current information is vital.

Deidre's Travel still hasn't fully recovered because client files were lost. Langseth said she and her staff have tried to recreate files; however, for clients who hadn't recently worked with the company, all records were lost. Langseth's personal phone book of numbers going back 30 years, including direct lines to suppliers, was destroyed in the fire.

"If it happened again, I know exactly what I would take with me. I would have grabbed my phone book," she said.

Langseth was onsite when the fire started a few doors down. She didn't expect it to reach her offices and by the time she realized it would, she couldn't go back in.

Test the Plan
Once you have developed a plan, it is important to test it to see if what looks good actually works in reality.

Riggs, with IMA, said an emergency plan is only as good as the information it is based on and the ability of a company to implement it.

"A written plan that looks good on paper but which assumes certain response capabilities exist that actually do not, will be ineffective and highly detrimental to the company," Riggs said.

Testing the plan can be as simple as an evacuation and head count or can be an actual exercise involving outside organizations.

For example, a company could tell everyone to report to the conference room and then the staff discover that a couple of key people aren't there and won't be available. The plan should take you through how to continue operations without those individuals, as that could be a real scenario, said Myers.

"Have your plan in hand. It's not worth anything unless you run exercises. Test it. Make sure it works. It's a test of the employees' knowledge, whether they know what to do and when to do it," he said.

After the initial test, implement an ongoing schedule of tests so new employees are aware and changes in circumstances or facilities are incorporated.

"One of the common pitfalls in disaster planning is to forget that companies are dynamic-their needs and resources vary with time," Riggs said. "Out of date plans can be more detrimental than not having one at all."

Everyone should know the plan exists and where to find it. A copy should be stored off site. Having it on the company intranet also can be useful.

A Public Face
Planning for all the physical and information contingencies is paramount, but consideration also should be given to communication with the outside world. A public relations plan to explain your situation to customers will help keep them until you are fully functional again. Just designating a spokesperson or media contact in case of emergency is a plan, said Riggs.

While Langseth didn't have a plan for contacting clients, the news media helped by showing footage of her offices burning. She and her staff quickly recorded a message on the company phone to refer clients to their personal numbers.

It comes down to how quickly you can get your business back up and running. That is the key to recovery.

The objective is to keep you in business and shorten your recovery time as much as possible," said Myers.

Take the first step. Do you even have a flashlight and a first aid kit onsite?

A basic template for developing your disaster plan, is available from the Johnson County Emergency Management & Homeland Security Web site.

The U.S. Small Business Administration provides a disaster-planning guide for small business owners with information on emergency planning.

The Federal Emergency Management Agency provides information on disaster planning