Business Continuity Planning: Increasing Workplace Resilience to Disasters

By Brenda D. Phillips and Mark Landahl

Terrorism, natural disasters, or hazardous materials threaten the viability for all types of businesses. With an eye toward business scale, scope, and diversity, Business Continuity Planning: Increasing Workplace Resilience to Disasters, addresses a range of potential businesses from home-based to large corporations in the face of these threats, including the worldwide COVID-19 pandemic. Information on business continuity planning is easy to find but can be difficult to work through. Terminology, required content, and planning barriers often prevent progress. This volume solves such problems by guiding readers, step-by-step, through such actions as identifying hazards and assessing risks, writing critical functions, forming teams, and encouraging stakeholder participation. In essence, this volume serves as a business continuity planning coach for people new to the process or seeking to strengthen and deepen their ongoing efforts. By engaging stakeholders in a business continuity planning process, businesses can protect employees, customers, and their financial stability. Coupled with examples from recent disasters, planners will be able to inspire and involve stakeholders in creating a more resilient workplace. Designed for both educators and practitioners, Business Continuity Planning: Increasing Workplace Resilience to Disasters walks users through how to understand and execute the essential steps of business continuity planning.

• Presents evidence-based best practices coupled with standard operating procedures for business continuity planning in a stepwise, user-oriented manner
• Includes numerous examples and case studies bringing the ideas and procedures to life
• Provides user-friendly materials and resources, such as templated worksheets, checklists, and procedures with clear instructions, making the volume engaging and immediately operational

• Language: English
• Publisher: Elsevier Science
• Release date: Nov 24, 2020
• ISBN: 9780128138458

Brenda D. Phillips

Brenda D. Phillips, Ph.D., is the Dean of Liberal Arts and Sciences and Professor of Sociology at Indiana University South Bend. Previously, she taught emergency management at Oklahoma State University and has served as a subject-matter expert, consultant, and volunteer for multiple agencies, communities, educational institutions, and voluntary organizations. She is the author of Disaster Recovery, Mennonite Disaster Service, and Qualitative Disaster Research, the co-author of Introduction to Emergency Management, and the co-editor of Social Vulnerability to Disaster and co-author of the forthcoming Business Continuity Planning. She has written numerous peer-reviewed journal articles in the discipline of emergency management and disaster science with direct experience in researching hurricanes, tornadoes, earthquakes, tsunamis, and hazardous materials accidents, much of which has been funded by the National Science Foundation. Dr. Phillips has been invited to assist or speak at disaster programs in the United States, Canada, Mexico, People's Republic of China, Costa Rica, New Zealand, Germany, Sweden, and Australia where she has promoted evidence-based best practices for community safety. Dr. Phillips firmly believes in the extension of faculty expertise through volunteer service. With over thirty years of experience in the field of emergency management education, Dr. Phillips has volunteered for local emergency management planning committees and voluntary organizations, especially for high risk populations. She has served as an unpaid reviewer of city and agency emergency management plans and assisted with planning around disaster-time domestic violence, safety for people with disabilities, and elderly evacuation. She has led business continuity planning at multiple academic institutions and businesses. Her most meaningful volunteer activities have helped to rescue animals and rebuild homes (and docks that support sustainable livelihoods) after disasters.

Book preview

work.

Chapter 1: What is business continuity planning?

Abstract

Scenarios from real events will be discussed briefly in this chapter. The goal is to alert readers to potential events and their impacts such as the loss of workspace, impacts to payroll, challenges with inventory, disruption of customer traffic, and related matters for continuing businesses after a disaster occurs. Types of disaster planning will then be reviewed to separate business continuity planning from other types of planning related to disasters and emergencies. The chapter will then move into what business do – or, most likely, do not do – when disasters threaten. Concluding sections will set the reader up for the rest of the volume by providing a convincing argument to launch business continuity planning (BCP).

Keywords

Business continuity planning; Disaster; Preparedness; Mitigation; Response; Recovery; Business disruption; Pandemic

Introduction

Disasters disrupt the normal, everyday routines and functioning of a business, organization, or agency (Quarantelli, Lagadec, & Boin, 2006, see also Quarantelli, 1998; Perry & Quarantelli, 2005). Whether a natural disaster, a hazardous materials contamination, a terror attack, a pandemic, or a cyberattack, each has the potential to stop a business from customary operations and cause the business to fail. Not surprisingly, when productivity ceases, economic losses occur as business customers, patients, or clients leave, and employees face the loss of a paycheck, benefits, and a job. Surrounding communities discover their tax base has been eroded. Businesses that rely on each other for parts and services, to generate customer traffic, and to create an interdependent economy may find such partnerships undermined by the disaster. Government programs may be hard-pressed to provide sufficient resources to businesses including physical assets, loans, and economic stimulus funding.

Business continuity planning (BCP) addresses what industries of all sizes and kinds need to think through to stem such losses, maintain customers, support employees, and continue producing goods and services for the surrounding community and business sector (Paton & Hill, 2006). Business continuity planning thus represents an intentional, thoughtful, and stepwise process that focuses on the dangers a business might face and what can be done to reduce losses and survive.

Conducting business continuity planning starts with understanding the kinds of risks that businesses might face. In the first part of this chapter, readers will learn about the kinds of area hazards that might imperil their business operations or partners they rely on. The latter part of the chapter then situates business continuity planning and outlines basic practices for launching such an effort. The goal is to provide general guidance that can be scaled up from small to large businesses, and cover a range of types of businesses, agencies, and operations. Throughout the volume, readers will find a range of examples to inspire planning in their setting, whether they own and operate a traditional business like a restaurant, an agency that serves people who are homeless or home-bound, or a value-added community entity like a museum or university.

What most businesses do (not) do for a disaster

This volume should provide a red alert to the business community, in part because most businesses do the bare minimum to stay in operation (Orchiston, 2013; Webb, Tierney, & Dahlhamer, 2000, 2002). Other than a first aid kit and maybe a fire extinguisher, most businesses fail to prepare for significant losses and disruptions including efforts on how to adapt to a new normal (Webb et al., 2000, 2002). Restaurants may require training in the Heimlich maneuver, but they may not address what employees should do during a tornado, active aggressor event, or cyberattack. Smaller and micro-businesses seem to be particularly at risk in disasters given their levels of preparedness (Orchiston, 2013).

Beyond such basics, businesses largely fail to conduct any level of emergency planning (Orchiston, 2013; Webb et al., 2000). If they do, such planning is likely to be minimal such as a posted set of instructions on what to do if a tornado threatens. While some worksites engage in practicing response behaviors, like school and university fire drills or active aggressor training, most businesses do not undertake such essential actions. High rise building offices may include signage indicating which direction to evacuate, but rarely if ever practice exiting like Morgan Stanley's life-saving efforts did before September 11. Even more broadly, an economically valuable tourist area may fail to realize the full extent of the area's natural hazards, a reality that led to over 300,000 deaths in the 2004 Indian Ocean tsunami across 13 nations.

Businesses overall also fail to plan for where they will go if they need to relocate temporarily or permanently, which may determine their success or failure. Few businesses train their employees how to remotely access computers should a building become unavailable or a quarantine be imposed. Even fewer seem to identify ways to adapt should an emergency occur including even short-term work stoppages during an infectious disease outbreak. Businesses also lack planning in who can step in if a critical employee becomes injured or unavailable such as having to drive from a distance where they evacuated.

Businesses do pursue risk reduction along more traditional rates, such as buying insurance. Yet, businesses need to regularly assess insurance coverage as it may not include all area hazards, such as floods or high winds. Businesses may need hazard-specific policies, which can be cost-prohibitive especially for smaller businesses. Business interruption insurance may be available but might not cover all the kinds of losses experienced in a pandemic or may be unaffordable for small businesses. Rainy-day funds for many businesses come from personal savings, when a more stable source that covers specific expenses is what businesses need. Without business continuity planning, the ability of the business to fulfill its mission is at stake not to mention paying mortgages or rents, business loans, and payroll.

Stop for a moment and imagine that you are currently working in a one-floor building – look around at your workspace. If your company has a 3-foot flood, what would be lost? How would you continue working if you lost everything below 3 ft, which would probably include electrical outlets, computer/Internet connections, copiers or the motorized bases for assembly lines and production? What about 6 ft of water? Patient beds, office pods, and other critical resources would be lost. Or, consider area hazards besides a hypothetical flood. What natural, technological, or hazardous materials might impact your actual workplace? If your work relies on navigation, what disruptions might be anticipated from a solar flare or geomagnetic storm? Then, stop and think about disasters that might indirectly impact you, like a power outage or loss of utilities because the city's water treatment system became compromised. How would you get back to normal? Where would you work from while your place of work is restored?

Readers may also worry that they lack expertise in disaster management, such as having professional staff including emergency planners, environmental health experts, or risk managers. Lack of expertise can become a reason to not do something – but with business continuity planning (BCP), that is not necessarily the case. Businesses, schools, agencies, and faith settings can use available software or open source templates to launch and complete a BCP by using this volume. Area experts, such as local city and county emergency managers, can be asked for their advice. Universities may be willing to extend their faculty experts to support businesses. Thus, while a lack of expertise may seem intimidating, it can be overcome by collaborating or partnering with those who do hold such knowledge and by working through a stepwise process to produce a viable business continuity plan.

Even with a partner or expert, an additional problem can rise up: that of the lone planner or over-reliance on a consultant or contractor to create the plan. The lone planner approach is a mistake, because best practices for planning must involve a wide set of eyes and ears on the issues that need to be covered (Der Heide, 1996; Quarantelli, 1985). Without involving a local team, plans created by individuals or even by specialized consultants are likely to be insufficient or to include strategies that will not work or that people will not use. Schools and universities make this mistake when a high-level planning team writes the plan without consulting the stakeholders. Dealing with a quarantine might mean converting classes to online platforms, which makes sense unless the faculty lack the knowledge or computer resources to deliver online classes, like what happened during the COVID-19 pandemic. Some classes may be more difficult to offer via an Internet-based solution, for those who had not been brought into the planning and made ready. While classes like anatomy or dance can be offered successfully (Attardi, Barbeau, & Rogers, 2018), doing so requires some understanding about distance education platforms and pedagogies. Students also need to be ready and willing to maximize online learning opportunities to succeed (Langfield, Colthorpe, & Ainscough, 2017) and must have access to the hardware and connectivity that online learning requires. In short, everyone must be part of the planning effort or at least consulted and then advised and trained on the plan. Only then will an enterprise be ready to respond and recover with resilience.

What does seem to inspire action in planning for disasters is going through one. Following a flood or tornado, businesses are more likely to prepare (Marshall, Niehm, Sydnor, & Schrank, 2015). Such events, whether local or at a distance, can serve as inspirational and motivational moments to promote business continuity planning. The COVID-19 pandemic of 2020 has served as such a call to action, but pandemics are not the only hazard that businesses will need to address.

Hazards that become (business) disasters

The next section of this chapter scans a wide array of hazards that a business might face. Each hazard presents some unique challenges and not every hazard will become a disaster – again, defined by disrupting the normal operations of the business and its surrounding community. Even though each hazard might not seem to be present in the jurisdiction where readers live and work, it is worthwhile to review each hazard for the examples contained within. Each example has been chosen to raise awareness and motivate planning, from natural hazards through those made or caused by human actions.

Natural hazards

Natural hazards, by themselves, would do little harm to businesses. Rather, hazards become disasters occur because businesses locate their sites and people into places of significant risk (Quarantelli, 1998). It may be that business owners cannot make a choice, such as when and where people find employment in seasonal work like farming, fishing, or tourism. But sometimes businesses knowingly make avoidable choices, including building in an area of known earthquake activity like San Francisco, Tokyo, or Quito. To understand the potential impacts of natural hazards, this section will reveal some of the consequences when natural hazards and businesses fail to co-exist. Conversely, readers will discern the benefits of making informed choices to mitigate risks, particularly the practice of business continuity planning.

Tsunamis and cascading events

Naggapattinam Hospital, located in southeastern India, lies a few kilometers inland from the Indian Ocean. On December 26, 2004, a massive 30–40-foot tsunami pushed across shoreline villages and rushed toward the hospital. From the back of the sixty-building compound, a woman yelled out a one-word warning of water, water. With 350 patients at risk, including those in neo-natal and intensive care units, medical staff and family members scrambled to carry patients to second floor levels. Water inundated the first levels of most buildings, leaving behind muddy debris and heavy damage. Survivors from the outlying area soon began to arrive, bringing the bodies of loved ones who could not be saved. At least 10,000 people died along a 5 km stretch of India's coastline that day – but not a single patient perished at the hospital (Phillips, Neal, Wikle, Subanthore, & Hyrapiet, 2008).

Why did patients, staff, and family members survive in a situation where they had only themselves to respond? Just 1 month prior to the tsunami, hospital staff had trained on their plan, which determined how staff would handle an emergency. Staff mobilized quickly to restore operations and, with the help of outside funding, returned to serving as the region's only major hospital location. They not only saved their patients but tended to the injured and deceased the same day. Within a few months, in an area quite isolated from large city resources, the hospital returned to normal operations. As an added precaution, staff members moved critical hospital operations further inland in case another tsunami occurred.

Hurricanes and cyclones

Hurricane Maria slammed into Puerto Rico in 2017, devastating utilities, roadways, and businesses of all sizes. The following year, the Federal Reserve Bank of New York conducted a survey, finding that 77% of businesses, the majority being small, suffered significant losses. Most of those businesses faced lost revenues coupled with increased expenses, damaged assets and property, and accumulating debt (Hamdani, Mills, Silva, & Battisto, 2018). Businesses also lacked sufficient insurance coverage to address losses and over one-third did not hold any insurance. Of those who did have insurance, only 6% indicated that their claims had been fully met (Hamdani et al.,