Hurricanes Irma, Harvey and disaster recovery planning

Millions of people were and still are impacted by Hurricane Irma and flooding caused by Hurricane Harvey. Many have lost their homes with more without power for days and weeks.

While our hearts, and in many cases wallets, go out to them, our thoughts turn to where these people work and how businesses are recovering from disaster. Do they have a disaster recovery plan, a business continuity plan, or even a crisis management plan?

According to EY, 40 percent of businesses that experience a disaster go out of business within five years. Think of all the businesses in Florida, Texas, and the Caribbean islands impacted by Irma and Harvey. Now imagine four out of ten of them closing their doors permanently.

It’s understandable when a business fails for business reasons. When the reason is a natural disaster outside of their control, it seems unfair.

Plan for business continuity
Business continuity and disaster recovery (BC/DR) planning encompasses all types of plans that relate to business interruption–natural disasters, power outages, cybercrimes, fire, civil unrest, terrorism, anything that interrupts business. The goal is to go from business interruption to business as usual as soon as possible.

Troy Harris, a noted expert on business continuity, refers to this as Recovery Time Objective (RTO). Getting critical operations back online would have a shorter RTO than a secondary service used by just a few employees or customers.

A good BC/DR plan doesn’t collect dust. It’s reviewed regularly and put to the test. Testing helps create a culture of preparedness within your organization. Exercises and scenarios help ingrain employees with what to do in the event of a disaster or when an interruption occurs.

What should you plan for?
One of the key aspects of developing a BC/DR plan is identifying what you should protect and details of contingency plans. A nuclear plant will have a far different BC/DR plan than a chain of convenience stores.

A good place to start is with commonly occurring business interruptions like computer network failure or a supplier impacted by a drought. The type of business you’re in and your industry can offer direction and guidance on BC/DR plan parameters.

Sometimes elements are missed that have consequences. For example, when Hurricane Irma veered West and headed for Tampa, a city that hadn’t experienced a hurricane since 1921, a healthcare facility in nearby Clearwater was ready. The facility boarded up windows, had backup generators, and made considerations for staff and patients. However, what the facility didn’t plan for was families of patients glued to the Weather Channel and starved for information.

After any crisis, a BC/DR plan should be revisited with an honest appraisal of what worked and what didn’t. By assessing and analyzing, along with regular reviews and testing, plans can continue to improve and evolve.  

Leverage technology
Given the breadth and depth of BC/DR plans, it can be excruciating using spreadsheets and email to build consensus. Fortunately, a GRC platform designed for managing risk and proving compliance provides an ideal build and test environment for BC/DR planning.

Within the GRC platform, you can plan for interruptions, manage plan details and ensure plan readiness. Gauge the financial implications from disruptions by conducting a business impact analysis. Use departmental testing to boost participation and preparedness. Because the plan exists in the cloud, you can access your BC/DR plan even during a disaster.

Nobody, not even Nostradamus, can predict when and where the next disaster will strike. You can, however, plan for unknown disasters and for anything that interrupts business operations. Let’s continue helping the millions impacted by Hurricanes Harvey and Irma. Let’s also help business prepare for the next disaster with better BC/DR plans.

Related Articles

Shutdown makes business riskier

Shutdown makes business riskier

Learn how the government shutdown affected business and the countermeasures needed to address the risk to remedy the situation.