In the unpredictable world of business, it’s not a question of if a crisis will occur, but when. According to FEMA, 40% of small businesses never reopen their doors after a disaster. However, businesses that prepare in advance with robust response plans and act decisively in the face of a crisis often bounce back stronger and more resilient. As the saying goes, “chance favors the prepared mind.”

Investors often look for evidence of such preparation when assessing the riskiness of an investment. Two key components of this preparation are the Emergency Response Plan (ERP) and the Business Continuity Plan (BCP). These plans help businesses prepare for disruptions to their operations and maintain critical business functions during a crisis.

Emergency Response Plan (ERP): The ERP is a disaster-specific plan that outlines the tactical response to each type of disaster your company might face. It focuses on protecting people, property, and assets. Once these are secure, the Business Continuity Plan (BCP) comes into play.

Business Continuity Plan (BCP): The BCP is an incident-agnostic plan that provides the overall strategy, governance, and recovery playbook to follow during a disaster. It identifies critical business processes and enables the company to maintain operational continuity after a disruption.

Here are the steps to develop these plans:

Step 1: Evaluating Potential Threats: Conducting risk assessments helps identify the threats your business is most vulnerable to. This allows you to develop response plans and mitigation strategies for the most common and/or severe risks. The risk assessment should explore specific types of threats to your organization and rank them based on their probability, severity, warning time, and duration.

Step 2: Analyzing Business Impact: A business impact analysis (BIA) studies your core operations to identify which of those is most critical to sustaining operations. The BIA should identify the impact to the organization when a business process is disrupted and should identify all the supporting resources needed for each business process.

Step 3: Crafting Recovery Strategies: Once the BIAs have been completed, each department should develop recovery strategies for their business processes. The recovery strategies should provide a step-by-step playbook on how to operate that business process without your typical resources.

Step 4: Plan Validation and Maintenance: After the development of the plans, plan reviews, tabletop exercises, or full-scale exercises can be used to simulate a real disaster and rehearse response and recovery from a disaster. Any lessons learned during an exercise (or during a real disaster) should be incorporated back into your plans to create a cycle of continuous improvement.

The current COVID-19 disaster shows that no organization is immune from experiencing crises. However, by creating a culture of preparedness within your organization, you can position the company to persevere and innovate through the crisis.  But as Seneca said “Luck is what happens when preparation meets opportunity.

This post was produced by Jeffrey Camp