Is Your Business Prepared for the Worst?

ow can a CPA help a business prepare for a potential nightmare such as the one that took place at the World Trade Center on September 11? If a business was vaporized within the course of an hour, how would a company deal with the human loss, confusion, communications breakdown, data privacy and retrieval, among other issues? No matter how small or large the catastrophe, being prepared with a detailed plan can improve a company’s chances of survival. A plan should include an immediate response—the actions a business takes when confronted with a significant emergency—as well as crisis management, which focuses on the long-term steps that will ensure the company’s recovery and ongoing viability. This article offers advice to companies on how to select a team and develop a plan that will ensure they’ll be able to remain in business if disaster strikes.

STEP ONE: CHOOSING A TEAM

The most effective disaster plans are those company personnel developed, tested and implemented. Companies with existing disaster-response plans should review them to make sure they are up-to-date and take into account all possible contingencies. Those leading the planning effort must ensure that all company constituencies are adequately represented on the team that develops the disaster response. Senior executives should select a team that is qualified to address the overall needs of the business. Each of the disciplines listed below needs one regular and one backup or substitute member on the crisis response team, in case the regular team member is unavailable when a crisis occurs. Executives should select team members who are experienced, reliable and adaptable, with proven track records at working well under stressful conditions.

In a medium to large business, here are the disciplines requiring a voice in the planning process, including details of their role on the crisis management team:

The company’s corporate executive leadership, with one or more of the most senior officers involved. These individuals should lead the company’s overall recovery operations as well as communicate to Wall Street and national media outlets details about the company’s status, plans and contingencies following a disaster.

A senior accounting or financial officer. He or she is responsible for restoring business critical financial functions and would establish access to any crisis-based financing resources the company needs.

A senior human resources representative. This person’s responsibility is to facilitate the health, safety and welfare of the surviving workforce, provide support to the families of injured or deceased personnel and monitor employee well-being during the recovery and eventual return to normal operations.

A senior manufacturing or operations representative. He or she should provide an immediate assessment of what the company needs for business continuity, schedule a return to production and oversee the implementation of alternative facilities if necessary.

A senior information systems or technology officer. This individual is responsible for preserving data operations, testing connectivity and integrity of all electronic databases, communication systems and systems integration.

A senior insurance or risk management representative. He or she will gather and disseminate claims details to facilitate prompt submission and payment of property and business interruption insurance entitlements.

Public relations/media relations representatives (both inside and outside). Their task is to gather and disseminate as much accurate information as feasible while maintaining regular contact with all media to best communicate the company’s situation.

Legal counsel (both inside and outside). These people will address potential liability issues and assist and support all of the other functions listed above with advice on contracts and other legal issues.

Senior management should designate a single team leader—a crisis management director or officer. He or she may or may not have overall responsibility for a particular discipline as well. An assistant or associate crisis management director should also be named in the event the senior leader is not available.

As with any complex multi-discipline corporate undertaking, the leaders should meet and map out

Their respective crisis management strategy and tactics within each discipline.

How to integrate their respective disciplines at the time of a crisis.

A testing and evaluation protocol that will allow a methodology for adjusting the plan as needed.

STEP TWO: CREATE A RISK MANAGEMENT PLAN

Successful business continuation will hinge in large measure on a company’s precrisis planning. Advance planning by the disaster management team should incorporate procedures intended to first prevent or mitigate disasters of all kinds. This is essentially a risk management function, addressing issues pertaining to structural conditions, facility operations procedures, preemployment screening and all other tasks that can help a company identify and reduce the likelihood of a crisis.

For each potential crisis, risk management will seek to remedy, to the extent possible, any vulnerabilities the company faces. For example, in evaluating a facility’s exposure to acts of workplace violence, risk management might limit ingress and egress to only a few locations or even to only a single locked entrance. Other options include installing informed and trained security officers or establishing employee and visitor identification cards or passes.

If a facility is located in an area prone to floods, hurricanes or tornados, risk management professionals should be sure all employees are familiar with evacuation routes and the location of the company’s preselected alternative site in the event of serious damage or destruction to the main facility.

Careful preemployment screening of prospective workers will serve several risk management/crisis response functions. First, ideally, all applicants with any history of violent or criminal antisocial behavior can be eliminated from the hiring process. Second, the company can identify in advance any employees with special evacuation needs so that if disaster strikes, it can dispatch special assistance.

Any plan a company formulates should prepare it for damage to its own facility as well as to other locations. Disastrous losses in remote locations can still have a direct and grave impact on a company’s business operations. Losses affecting vendors, suppliers and customers also may jeopardize a company’s ability to obtain raw materials, data or a market for its products.

Identifying constituencies. One key to success in developing a viable crisis response and management plan hinges on carefully identifying the constituencies inside and outside a company that will require information immediately following a crisis. These include

Employees, particularly those at the affected location, but also any employees at locations remote to the crisis site.

Employee’s families, who will require immediate access to information about the safety of their loved ones, as well as the steps the company or public officials are taking in terms of rescue efforts, transportation to trauma centers or hospitals or other arrangements.

The local community and government entities, including health care organizations, that will require prompt, accurate information about conditions at the scene; the risks of off-site damage or injuries; the need for any community response such as evacuations or closures of schools, residential areas or large commercial complexes such as shopping malls.

Government agencies at the local, state and federal levels, that will need complete details about a crisis. Specifically those agencies requiring immediate notice include departments of public safety; law enforcement including both local law enforcement, state police and potentially the FBI; environmental agencies and highway authorities.

Customers the business serves, who will need immediate information about the state of the enterprise; the status of orders, deliveries, and good faith advice as to whether they should seek alternative manufacturers of goods or suppliers of services.

Suppliers and vendors, who will need information about the future delivery of goods or services to the affected company; the viability of the company; whether orders should be delayed, modified or canceled.

The media— local, regional or national—which will need information on what happened; what is known to date about the facts and circumstances leading to the crisis; the status of employees; risks to the community; and a detailed accounting of the steps the company is taking in response to the crisis.

Shareholders, particularly in a publicly held company, who will clamor for information as to whether the crisis will affect sales, revenue, growth, profit projections, capital, creditworthiness and other measures of corporate viability.

Insurers of the affected enterprise, generally, and by the specific terms and conditions of their insurance policies, who are entitled to prompt reporting, preliminary estimates and other details of significant property losses to the company’s own buildings and equipment; potential workers’ compensation claims arising out of injuries and/or deaths and potential claims from third parties against the affected company.

Another key to developing a successful crisis management plan is to analyze carefully all potential disasters and provide a detailed written response to personnel throughout the company—before a crisis occurs. The crisis management team should provide two written copies of the plan to all employees, suggesting they keep one at work and the other at home. The company should review the plan regularly and discuss it at staff meetings attended by all employees. A meaningful plan will provide employees with a sense of confidence that the organization has carefully weighed, analyzed and prepared for the full range of potential crises.

STEP THREE: THE MOMENT OF CRISIS MANAGEMENT

To prepare a comprehensive plan capable of handling a real crisis, company leadership must carefully consider a wide variety of theoretical what-if scenarios. When conducting a what-if analysis, consider these questions:

What if we have to evacuate the building? Where should we meet to determine that all employees are safe?

What if we are denied all access to our premises or facilities for a period of days, weeks, months or permanently?

What if our premises or facilities are completely destroyed by the disaster?

What if one of our vehicles is responsible for a massive explosion, spill or other significant catastrophe?

What if one or more senior management officers dies either in an on-site or off-site accident?

What if there are significant numbers of deaths among midlevel and entry-level personnel? How can a company be prepared to handle the consequences and the eventual need to replace these workers?

How a particular company handles a crisis will depend in large part on the nature of the business. Companies engaged in manufacturing will have a different response than service businesses. In many respects, a service enterprise is a far more mobile and flexible operation. If the crisis response plan saves the people and preserves the data, a service enterprise can most likely relocate with relative ease. A manufacturing facility with specialized machinery, equipment and production lines may require careful preplanning and potentially far more recovery time following serious damage to its plant.

Similarly, an entity with multiple locations throughout a region or the nation will have different issues to consider than a business with a single site. Multiple locations afford an organization the opportunity to provide crisis response facilities at preexisting alternative sites that already belong to the company. A business with a single location must, by necessity, establish a new off-site facility.

A disaster plan should outline chronologically the procedures the company will follow and the measures it will take in the event of a crisis. Among other factors, the plan must address

The safe evacuation of employees, visitors, clients, customers and vendors.

Postcrisis communication with employees, customers and suppliers.

Preservation of hard copy and electronic media.

The personnel and contractors needed to restore damaged facilities.

Contingency plans for an alternate facility.

Contingency plans for alternate sources of material or information that are required for normal provision of services or product.

Additional measures required to resume normal operations such as developing a postcrisis business plan with target dates for

Partial resumption of operations.
Full resumption of operations.
Processing employee life insurance, health insurance and accident claims.

Simulated disaster drills and exercises are useful ways to test each component of the company’s disaster plan. Critical evaluations of such drills by the disaster planning team will identify potential shortfalls and serve as blueprints for constructive changes. Simulations should, to the fullest extent possible, mirror crisis conditions including

Use of safety wardens during evacuation exercises.

Physical evacuation of premises.

Marshaling of evacuted personnel.

Activation of alternative site facilities.

Use of emergency e-mail or other alternative communication networks.

Testing of messaging capability to vendors, suppliers and the media.

START PLANNING TODAY

Few businesses can survive a disaster without advance planning. Since it’s impossible to know when and how a disaster will strike, a company must be ready for anything. Companies that don’t have a disaster plan, or have one they haven’t reviewed recently, should act immediately to build a team and develop a crisis response that will ensure the safety of employees and the ongoing survival of the business.