Tips for Dealing With Business Disasters No business is ever safe from harm. This guide will show you how to plan for and bounce back from an unexpected crisis--and keep your customers in the meantime.

It's going to happen some day: A key employee is badly injured in an accident; a power outage knocks out your computers; a tornado takes out your warehouse. Unexpected emergencies can momentarily shut down operations, or even worse, put you out of business for weeks and force your customers to go elsewhere--and stay there. Are you prepared for this? It's not as difficult as you think. Here's how to plan for the inevitable:

Step 1: Determine what can go wrong. The first thing you should do is complete what's commonly referred to as a vulnerability or risk assessment. This assessment will identify what could go wrong, the effect on your business if something does go wrong, and what priority you should take in minimizing your risk exposure. During this assessment, you should:

• Learn the threats and risks your business faces. Threats are anything that could happen to your people, processes, infrastructure or reputation, including natural threats (hurricanes and tornados), technological threats (machinery malfunctions), or human threats (stealing).

• Once you've identified the possible threats, determine how vulnerable you are to them. How reliable is your data backup system in the event of a power outage? Are your employees properly trained for an earthquake? What about your security system--how capable are you of preventing customer or employee theft? Determine what your most vulnerable areas are and what mitigation measures are needed to protect them.

• With threats and vulnerabilities identified, start prioritizing. Rank your threats in order of frequency. Now rank your vulnerabilities to these threats by the impact they'll have on your business; for example, inventory results show employee theft is $5,000 per year, computer failure costs $100 per hour, and so on. Apply those numbers to the prioritized risks, and now you have a risk exposure for each threat. The higher the risk exposure, the more it's worth your while to protect yourself from that threat.

Step 2: Develop a plan. An emergency action plan is a written procedure manual for dealing with the threats you've identified in step one. Some of the components of your plan will be prescribed by law, regulations or good business sense. Among these are an OSHA-directed evacuation plan, adherence to the provisions of the 1996 Health Insurance Portability and Accountability Act, the Sarbanes-Oxley antifraud law, or the National Fire Protection Association's Life-Safety Code.

When there's a legal requirement to do something, you're usually--but not always--told how to comply. There are a number of different ways to create your emergency plan; however, all emergency plans tend to have the same basic elements. According to the National Safety Council, emergency actions plans should contain the following minimum elements:

• Clear, written policies that designate a chain of command, listing names and job titles of the people or departments who are responsible for making decisions, monitoring response actions, and recovering back-to-normal operations

• Names of the people responsible for assessing the degree of risk to life and property, and who exactly should be notified for various types of emergencies

• Specific instructions for shutting down equipment and production processes and stopping business activities

• Facility evacuation procedures, including a designated meeting site outside the facility and a process to account for all employees after an evacuation

• Procedures for employees who are responsible for shutting down critical operations before they evacuate the facility

• Specific training, practice schedules and equipment requirements for employees who are responsible for rescue operations, medical duties, hazardous responses, fire fighting and other responses specific to your work site

• The preferred means of reporting fires and other emergencies

All your procedures should be documented in writing.

Finally, ensure that you have a way of contacting your customers should you have the need. A press release, an e-mail or a sign that directs them to a new location or provides them with information on when you'll be back in business go far in reminding folks that your reputation is dependent on taking care of your customers.

Step 3: Be ready to respond. Once you get the basic emergency action plan written, tell your employees! Make sure they know what's expected of them in an emergency--any kind of emergency. If they haven't been involved before, give them an opportunity to "dry run" the plan and talk over how things might go in an emergency scenario (this is called a tabletop exercise). You might find that there are changes you need to make to some of the plan's details. That's good. No plan is perfect, and it's not even a plan until it's been tested.

Be sure to share your response protocols, especially your evacuation procedures, with the local fire department, emergency medical service and police department. These are likely the first type assistance to arrive on the scene, and they'll need to know what actions you've taken. When they've been apprised of your emergency action plan ahead of time, they're better prepared to help. As well, they're experienced with these kinds of plans and can provide valuable insight that you may want to incorporate into your written plan.

Some other areas of training for your employees that'll help mitigate the effects of an emergency and provide huge returns in employee satisfaction and business reputation include:

• Emergency equipment shutdown
• Emergency notification procedures
• Building evacuation procedures
• Fire extinguisher use
• Basic first aid
• Cardio-pulmonary respiration (CPR)

Training is an important and relatively inexpensive part of emergency preparation that may save a life. More important, proper training can prevent an emergency from becoming a disaster and make all the difference between closing down operations for a few hours and being out of business indefinitely.

Step 4: Get back to business. Once you've implemented the first three steps, take the time to think about the worst-case scenario and make some plans for how you'll recover. Some questions to think about--and answer--include these:

• Where will you find a new location to work?
• Where can you get replacement equipment and computers?
• Who will help clean up after the storm/fire/disaster?
• How will you recover your critical data--the computers or original documents damaged by water or fire?
• How will you reach your people?
• How will they reach your?
• How will they get to work?
• What if your suppliers aren't as prepared and something happens to them?
• What programs are available to help your business (Federal Emergency Management Agency, SBA) or help your people (Red Cross, Salvation Army)?

There are many more questions you could ask yourself, but I'm sure you get the idea. What will it take for you to get back into business quickly? You might be very proud of getting your operations back up in three weeks, but if your competitor does it in one, where will your customers go? How much will your reputation suffer?

Remember, there's no way to guarantee that once you're in business, you'll stay in business. It's up to you to plan ahead and be prepared by creating the most resilient business possible.

Charles S. Thomas is the managing director of CACH International Ltd. Co. , an internationally recognized firm that provides business continuity and crisis response consulting services.