Businesses

Ready Business will assist businesses in developing a preparedness program by providing tools to create a plan that addresses the impact of many hazards. This website and its tools utilize an “all hazards approach” and follows the program elements within National Fire Protection Association 1600, Standard on Disaster/Emergency Management and Business Continuity Programs. NFPA 1600 is an American National Standard and has been adopted by the U.S. Department of Homeland Security.

The preparedness program is built on a foundation of management, leadership, commitment and financial support. Without management commitment and financial support, it will be difficult to build the program, maintain resources and keep the program up-to-date.

It is important to invest in a preparedness program. The following are good reasons:

• Up to 40% of businesses affected by a natural or human-caused disaster never reopen. (Source: Insurance Information Institute)
• Customers expect delivery of products or services on time. If there is a significant delay, customers may go to a competitor.
• Larger businesses are asking their suppliers about preparedness. They want to be sure that their supply chain is not interrupted. Failure to implement a preparedness program risks losing business to competitors who can demonstrate they have a plan.
• Insurance is only a partial solution. It does not cover all losses and it will not replace customers.
• Many disasters — natural or human-caused — may overwhelm the resources of even the largest public agencies. Or they may not be able to reach every facility in time.
• News travels fast and perceptions often differ from reality. Businesses need to reach out to customers and other stakeholders quickly.
• An Ad Council survey reported that nearly two-thirds (62%) of respondents said they do not have an emergency plan in place for their business.
• According to the Small Business Administration, small businesses:
  • Represent 99.7% of all employer firms
  • Employ about half of all private sector employees
  • Have generated 65% of net new jobs over the past 17 years
  • Made up 97.5% of all identified exporters

How much should be invested in a preparedness program depends upon many factors. Regulations establish minimum requirements and beyond these minimums each business needs to determine how much risk it can tolerate. Many risks cannot be insured, so a preparedness program may be the only means of managing those risks. Some risks can be reduced by investing in loss prevention programs, protection systems and equipment. An understanding of the likelihood and severity of risk and the costs to reduce risk is needed to make decisions.

A preparedness policy that is consistent with the mission and vision of the business should be written and distributed by management. The policy should define roles and responsibilities. It should authorize selected employees to develop the program and keep it current. The policy should also define the goals and objectives of the program. Typical goals of the preparedness program include:

• Protect the safety of employees, visitors, contractors and others at risk from hazards at the facility. Plan for persons with disabilities and functional needs.
• Maintain customer service by minimizing interruptions or disruptions of business operations
• Protect facilities, physical assets and electronic information
• Prevent environmental contamination
• Protect the organization’s brand, image and reputation

Program Committee and Program Coordinator

Key employees should be organized as a program committee that will assist in the development, implementation and maintenance of the preparedness program. A program coordinator should be appointed to lead the committee and guide the development of the program and communicate essential aspects of the plan to all employees so they can participate in the preparedness effort.

Program Administration

The preparedness program should be reviewed regularly to ensure it meets the current needs of the business. Keep records on file for easy access. Lastly, where applicable, make note of any laws, regulations and other requirements that may have changed.

• Gather information about hazards and assess risks
• Conduct a business impact analysis (BIA)
• Examine ways to prevent hazards and reduce risks

The planning process should take an “all hazards” approach. There are many different threats or hazards. The probability that a specific hazard will impact your business is hard to determine. That’s why it’s important to consider many different threats and hazards and the likelihood they will occur.

Strategies for prevention/deterrence and risk mitigation should be developed as part of the planning process. Threats or hazards that are classified as probable and those hazards that could cause injury, property damage, business disruption or environmental impact should be addressed.

In developing an all hazards preparedness plan, potential hazards should be identified, vulnerabilities assessed and potential impacts analyzed. The risk assessment identifies threats or hazards and opportunities for hazard prevention, deterrence, and risk mitigation. It should also identify scenarios to consider for emergency planning. The business impact analysis (BIA) identifies time sensitive or critical processes and the financial and operational impacts resulting from disruption of those business processes. The BIA also gathers information about resources requirements to support the time sensitive or critical business processes.

This information is useful in making informed decisions regarding investments to offset risks and avoid business disruptions

• Write a preparedness plan addressing:
• Resource management
• Emergency response
• Crisis communications
• Business continuity
• Information technology
• Employee assistance
• Incident management
• Training

Implementation of the preparedness program includes identifying and assessing resources, writing plans, developing a system to manage incidents and training employees so they can execute plans.

Resource Management: Resources needed for responding to emergencies, continuing business operations and communicating during and after an incident should be identified and assessed.

Emergency Response Plan: Plans to protect people, property and the environment should be developed. Plans should include evacuation, sheltering in place and lockdown as well as plans for other types of threats identified during the risk assessment.

Crisis Communications Plan: A plan should be established to communicate with employees, customers, the news media and stakeholders

Business Continuity Plan: A business continuity plan that includes recovery strategies to overcome the disruption of business should be developed.

Information Technology Plan: A plan to recover computer hardware, connectivity and electronic data to support critical business processes should be developed.

Employee Assistance & Support: The business preparedness plan should encourage employees and their families to develop family preparedness plans. Plans should also be developed to support the needs of employees following an incident.

Incident Management: An incident management system is needed to define responsibilities and coordinate activities before, during and following an incident.

Training: Persons with a defined role in the preparedness program should be trained to do their assigned tasks. All employees should be trained so they can take appropriate protective actions during an emergency.

You should conduct testing and exercises to evaluate the effectiveness of your preparedness program, make sure employees know what to do and find any missing parts. There are many benefits to testing and exercises:

• Train personnel; clarify roles and responsibilities
• Reinforce knowledge of procedures, facilities, systems and equipment
• Improve individual performance as well as organizational coordination and communications
• Evaluate policies, plans, procedures and the knowledge and skills of team members
• Reveal weaknesses and resource gaps
• Comply with local laws, codes and regulations
• Gain recognition for the emergency management and business continuity program

When you hear the word “testing,” you probably think about a pass/fail evaluation. You may find that there are parts of your preparedness program that will not work in practice. Consider a recovery strategy that requires relocating to another facility and configuring equipment at that facility. Can equipment at the alternate facility be configured in time to meet the planned recovery time objective? Can alarm systems be heard and understood throughout the building to warn all employees to take protective action? Can members of emergency response or business continuity teams be alerted to respond in the middle of the night? Testing is necessary to determine whether or not the various parts of the preparedness program will work.

When you think about exercises, physical fitness to improve strength, flexibility and overall health comes to mind. Exercising the preparedness program helps to improve the overall strength of the preparedness program and the ability of team members to perform their roles and to carry out their responsibilities. There are several different types of exercises that can help you to evaluate your program and its capability to protect your employees, facilities, business operations, and the environment.

• Identify when the preparedness program needs to be reviewed
• Discover methods to evaluate the preparedness program
• Utilize the review to make necessary changes and plan improvements

There are opportunities for program improvement following an incident. A critique should be conducted to assess the response to the incident. Lessons learned from incidents that occur within the community, within the business’ industry or nationally can identify needs for preparedness program changes. Best practices and instructional guidance published by trade associations, professional societies, newsletters and government website can be resources to evaluate and improve your preparedness program.

Gaps and deficiencies identified during reviews should be noted and addressed through a corrective action program. Reviews, evaluations and improvements should be documented and maintained on file.

• Preparedness Planning for Your Business - Ready.gov 
• Emergency Preparedness - Small Business
•  American Red Cross Ready Rating