“A high percentage of businesses that lose capabilities for a week or longer can never come back from it, ” says Mark Landers, managing director and senior vice president of J. Smith Lanier & Co. in Birmingham. “Disaster planning is your lifeline. It’s better to coalesce a plan in the calm of the day than to create the plan in the middle of disaster. It’s like changing a tire on the road going 70 miles an hour.”
That’s a compelling argument for buying business interruption insurance to compensate a company for the income lost after a disaster. Two in five businesses have suffered a business interruption loss in the last five years, according to the Risk Management Society (RIMS) Business Interruption Survey.
“Undertaking disaster planning is like doing homework, and nobody likes homework, ” says Landers. “But the time you spend can be some of the most valuable time your business will invest.”
Landers likens planning to the theory of a hierarchy of needs, proposed in 1943 by psychologist Abraham Maslow. At the base of the pyramid is the most basic need — survival — the objective of any enterprise in the face of adversity.
“You have to make sure the business survives, ” Landers says. “If you go to Florida after a hurricane, you’ll see that some businesses don’t make it through. The ones that have the strongest chance of making it are those that are able to continue operation at a pre-disaster level.”
When bottles of Tylenol were poisoned with cyanide in 1982, leading to the deaths of seven people, Johnson & Johnson quickly recalled 31 million bottles and implemented tamper-proof packaging, saving the medication’s place in the marketplace as a respected painkiller.
“Ultimately, the company saw an increase in sales, because it did such a great job of handling the situation, ” Landers says.
Managing business interruptions requires savvy leadership at the top, as well as a specialized team prepared and equipped for industry emergencies. An in-house team should be comprised of employees involved in executing a plan during a disaster, from the financial department to operations to the physical plant, with a big picture approach that includes safety, personnel, legal, risk management, education, training and resources.
Landers says the initial step in preparing for crisis is to quantify challenges, a multi-layered process that begins with assessment of any hazards the company may face. Cyber and ransomware attacks are on the rise in all industries, up 250 percent in 2017, and are estimated by a Kapersky Lab study to cost large businesses an average of $861, 000 and small companies an average of $86, 500. Kaspersky suggests the loss of business continuity costs a company an average of 23 hours of downtime, resulting in an average loss of $1.4 million.
The 2017 Hiscox Cyber Readiness Report, published earlier this year, indicates 53 percent of companies aren’t adequately prepared for an attack, though in 2016, cybercrime cost the global economy more than $450 billion.
Landers says the insurance industry is seeing a shift as small businesses recognize the need to arm themselves against IT breaches. Many insurers are beginning to build some cyber liability insurance into policies, though the amounts are still small.
“We used to think of cyber criminals as someone in a basement working in darkness, ” Landers says. “Now we know these criminals get up every morning and go to work. Their job is to hack other computer systems to make revenue. The data breach at Target was actually conducted through the HVAC contractor who had access to work on their systems. It was propagated with discount software.”
The cost of that breach included a tremendous dip in Target’s value.
“The good news is the cost of cyber insurance is still trending down, ” Landers says. “As more policies are written, more insurers will offer more competition.”
The growing potential for malicious disaster, combined with natural and accidental, is downright daunting. An essential part of business interruption preparedness is making a plan — however low tech.
“It doesn’t have to be expensive, and it doesn’t have to be time intensive, ” Landers says. “The simplest approach is to say, ‘Here is our evacuation map. Be sure to pick up the fire extinguisher and aim it at the base of the fire.’ It can be that simple, or it can be volumes.”
He suggests looking at your current capabilities and internal resources before coming up with a disaster mitigation strategy. The fundamental rule is to look at it from a 30, 000-foot perspective.
“You have to ensure you’re guarding your supply chain, ” Landers says. “A disaster halfway around the earth could affect your ability to get a specialized product. If you make a candy bar with pistachios, you will have a problem if those pistachios can’t be shipped to you because of a disaster in the Middle East.”
Having an alternate HQ designated for disasters can save time and resources.
“More companies are arranging alternate hot sites for IT capabilities if a computer system is destroyed, ” Landers says. “If you have something that is easily relocatable, you can temporarily rent offices across town. It’s essential to have a command center if something did occur, so that you can conduct operations.”
Disaster preparedness can be as simple as having contact lists for the company’s resources, or even names and cell phone numbers of key personnel.
“One client in health care was able to keep the business going because they had a huge generator on a trailer, ” Landers says. “They made the phone call earlier than anyone else and got the generator, while everyone else was essentially shut down. It cost them money, but the insurance paid for it, and they stayed in business without much of a dip in operations.”
That not only gave them an edge over the competition, but also reassured clients they were prepared in any eventuality. That same logic should have companies poised to outsource operations during emergencies.
In the case of hypothetical candy bars, creating a standby agreement with an alternative source of pistachios is a safety net to build into your insurance program.
Mutual aid agreements are another failsafe, often seen in the wake of storm damage, as power companies from other areas converge to correct massive outages. Power companies are in a high-hazard industry, pivoting to meet demands in the wake of storm outages, but other businesses aren’t accustomed to reacting to such challenges.
Any plan is only as strong as its weakest link, and the way to find that link is through testing.
“Don’t just let it sit on a shelf and gather dust, ” Landers cautions. “Keep it alive, and as people change, make those changes in the plan to keep it as dynamic as you can.”
That documentation of a well-laid plan is critical if a lawsuit results in defense of post-disaster claims. Having safety factors in place and documented can contribute to dollars saved on insurance. With scores of insurance claims at stake in product contamination or confidential information breaches, it takes more than an ounce of caution for a pound of cure.
“Buying insurance is the last thing you should do, ” Landers advises. “You should first do everything you can to have a plan to mitigate your losses. If the insurance company sees you’ve done all these things to get ready, they will give you a better price. It’s part of being prepared.”
If a major disaster befalls a business, lack of preparedness could be the actual catastrophe. Pilots prepare in simulators to create a reflexive response to a crisis. It’s that mindset businesses need to take into their business interruption and crisis planning.
“In the calm of the day, even as busy as days are, that’s the time to plan, ” Landers says. “When a car has just run through the front of your store and people are injured, you can’t make a good plan.”
Cara Clark and Cary Norton are freelance contributors to Business Alabama. Both are based in Birmingham.
