Today, we revisit...

Axiom Quarterly

1^st Quarter, 2007

A Case for Risk Management & Business Continuity through Disaster Planning

By Gary C. Harrell

Everything seemed to be going well for Timothy DuBois in the summer of 2005. The commercial photographer, known for his high-quality images, was set to move into a new studio, and he was feverishly working with lenders to secure funds for its renovation. His client roster was ballooning, and that meant more revenue coming into his new young business. Unfortunately, Mr. DuBois had no idea how quickly all of that was about to change.

As a powerful hurricane threatened the city of New Orleans, in late August, Mr. DuBois had to evacuate like thousands of other residents. He sought refuge with his family in Mississippi, where he stayed for four weeks, completely unaware of what awaited him in the devastated city. When he was finally able to return, Mr. Dubois was thunderstruck. He had lost the ability to even move into the new studio, and more strikingly, he had also lost 75% of his clients.

Reflecting on it now, Mr. DuBois likens his experience to “starting a business in one situation, and then having to start it again, all of the sudden, in another situation.”

Hurricane Katrina helped to open the eyes of the nation to the challenges posed by such powerful natural disasters. Mr. DuBois’s venture was among as many as 110,000 New Orleans metropolitan businesses shut down for weeks in the wake of the storm. In fact, before the 2005 hurricane season closed, Hurricane Rita also made landfall along the Louisiana-Texas coast, and Hurricane Wilma, which stunned forecasters with a one-day transformation from a tropical storm to a Category Five event, nailed southern Florida. All told, in Louisiana alone, according to figures released by the CPRA, upward of 200,000 homes sustained major or severe damage, and, for business, physical capital losses stood at nearly $130 Billion.¹

For business owners, the concept of business continuity, particularly in the face of overwhelming external events, has become as much a priority as reviewing financial statements or meeting project deadlines. The fact is, as they rightly understand, disasters can seriously impact any business, and a recuperation hinges largely on the business’s ability to restore normalcy to its operations.

Surprisingly, however, most business owners have either misinterpreted their level of preparedness or, quite wrongly, neglected to prepare themselves, at all. The truth is that no enterprise is ever fully prepared for the unexpected. What’s more, neglecting to plan for the possibilities of a disaster will not spare anyone of headaches. If anything, unless business owners proactively work to mitigate risks, the costs of not doing so may turn out to be far greater than they anticipate.

Of course, natural disasters are not the only types of risks that business owners face. Some, like the terror attacks of September 11, 2001, can be man-made and no less lethal. To date, Lower Manhattan is still reckoning with the rebuilding process at Ground Zero, and in the airline industry, three giants—UAL, Delta, and Northwestern—are struggling to emerge from bankruptcies following, among other things, the beginning of the war on terror and rising fuel costs.

Beyond that, risks arise from something even as small as an indiscriminate pathogen. For example, over two years now, researchers have been sounding a global alarm about the H5N1 virus—or bird flu, as so many call it. To date, roughly two hundred confirmed cases have been reported, mostly in Europe and Asia, but at no point has the virus transmuted to allow for its spread from human to human. If that were to occur, scientists warn, the consequences would be staggering. Thanks to global trade and modern transportation, the pandemic would spread to more corners of the globe, at a faster pace, than even the influenza epidemic of the early 1900’s. According to a study by research firm AMR, an avian flu pandemic would last from one to three years, and before it was over, economic losses would total over $100 Billion, domestically.² Compounding those losses, the study goes on to say that fifty percent of the U.S. workforce will be nixed. Does that mean “dead”? Well, given that the mortality rate for the infected is 61%--then death is highly probable.

Indeed, business owners do have their share of world-changing events for which to plan.

For their own part, insurance companies have been paying greater attention to the likelihood and impact of such disasters, and their responses have led to an unprecedented shift in the coverage of risks. Following the attacks of 9/11, insurers stopped writing policies that automatically offered coverage for incidents of terror. (Some $100 Billion in future damages shifted to the federal government, tantamount to the flood insurance program.) Insurers have also lost their appetite for commercial and residential properties in coastal regions. In Florida, following a hyperactive hurricane season in 2004, insurance rates jumped 40% as many large insurers elected to not write new policies or walk away, altogether. After 2005, the same type of rate increases has come true for Louisiana and Mississippi.

Now faced with the prospects of having to shoulder greater risks, business owners need to plan more thoroughly and act more responsibly, lest even an indirect disaster can bring ruination.

It is important for business owners to understand what portion of their enterprise environment can be affected by a disaster. As demonstrated in a hurricane or a pandemic, even though a business may be able to physically withstand a disaster, its environment could be radically impacted. Therefore, where continuity is an issue, business owners will need to answer the following questions:

• Infrastructure – What are the conditions of vital roadways and bridges? Are basic utilities functional?
• Employees and Customers – Is everyone okay? Will the business be able to resume operations? If so, how soon?
• Supply Chain – Will vendors be able to deliver critical supplies in the wake of the disaster?
• Security – Disasters can reduce orderly communities to chaotic environments. How will you protect your assets?
• Information systems – Businesses are housing more critical data on their IT systems. When needed, will these systems continue to be accessible?
• Finance – No business can function without access to necessary operating capital. Even if the business has sustained minimal damages, relative to its environment, does the business have enough money to weather the aftermath of the disaster?

It is equally important for business owners to do their own part to mitigate risks to their enterprises. As a component of an effective risk management strategy, Axiom Strategy Advisors recommends the following steps:

• Develop a crisis management team from different areas of your enterprise. By utilizing a true cross-section of individuals, there is assurance that a broader spectrum of thought can be committed to the disaster planning.
• The crisis management team should assess the types of risks their enterprise might encounter and then determine their probability. After doing so, the team should perform a SWOT analysis of the entire enterprise to identify where weaknesses and threats might reside.
• From their analysis, the crisis management team should construct a disaster preparedness plan. Such a document should include the following:
• Identify precise triggering points and corresponding actions (Example: if a storm enters the Gulf of Mexico, move X assets to the designated safe location.)
• Identify and assemble a data sheet of contacts from suppliers to customers to government agencies. The data sheet should contain specific individual contact information. And it should be updated on a regular basis.
• Develop an emergency communications plan. In this plan, the team designates a central point where, or person to whom, other personnel will report their whereabouts and status. Likewise, in the event of a severe business interruption, the plan creates a means to get information to employees, suppliers, and customers.
• Create best practices and job description documentation regarding the mission critical operations of the business. In the event that critical employees are unable to return to work, such documentation could be deemed crucial in re-staffing these positions. (To that end, the upper management should devise an emergency hiring plan or an outsourcing strategy.)
• Designate an individual who will be tasked with public relations.
• Upper management should develop a contingency plan with key suppliers, in order to guarantee that mission critical resources will remain available.
• Communicate the disaster preparedness plan to everyone in the enterprise, and routinely test its effectiveness.

Having a comprehensive disaster plan as a component of any risk management strategy will serve any business well. Explains business owner Timothy DuBois, “It is the utmost concern for anyone living in this type of area.”

Mr. DuBois believes that he is much wiser now, since the disaster that crippled his business in 2005. In fact, though he resides in an enterprise environment where progress has been slow, the photographer has replenished his client base by half of the amount lost. He accredits that upswing to an expansion into new markets and cuts in his own service rates. Nevertheless, planning for unexpected risks is never far from his thoughts. “I don’t want to go through that again,” Mr. DuBois says, while also noting that a disaster plan is now an integral part of his business model.

Gary C. Harrell is the principal and managing director of Axiom Strategy Advisors, LLC. For more information, please contact gcharrell@axiomstrategyadvisors.com.

# # # #

1. Coastal Restoration Authority of Louisiana, Comprehensive Coastal Master Plan for Louisiana:

Preliminary Draft (2006), p. 9.

2. AMR Research, Is Your Supply Chain Prepared for a Pandemic (2005)