Protect Your Business

On Oct. 29, a rare autumn snowstorm left three million utility customers across the Northeast without power: approximately 875,000 of them in Connecticut. While the hardships for state residents were well documented, the storm also had a significant impact on many businesses.
Most of the business interruptions resulted from power outages or blocked access roads rather than from direct damage to facilities, says CBIA vice president and economist Pete Gioia, who explains that storm-related losses took many forms.
“Hourly workers lost wages, and employers who may have called staff in when their facilities weren’t operational incurred unnecessary costs,” he says. “There were lost sales in retail and other industries that won’t be recovered, and many businesses that were down for a prolonged period lost significant profits. Even those with power may have seen productivity decline if employees who had a power outage at home could not make it in.”
Gioia also notes that with power failures, food service companies and food processing manufacturers are vulnerable to losses of perishable inventory, a possibility that became reality for Guida’s Milk in New Britain.
“We lost power from Saturday to Wednesday night, which meant loss of business and product,” says Karen Lane, HR manager at Guida’s, who was on-site during the days following the storm. “Our milk is kept in silos. If power to the building goes down, that unit is no longer being refrigerated, which means we have to dump that product. We estimate the whole thing could cost us $200,000-plus in terms of product and sales that won’t be recovered.”
Lane explained that the generators Guida’s acquired after the storm proved insufficient to save all of their inventory but that they managed to fulfill some orders.
“We did try to operate some departments with generators, and we tried to load some of our trucks to the extent possible, but it was very minimal,” she says. “We pulled the milk cases by hand versus using the conveyers, which weren’t running, so it became very physical.”
Long-Term Impact
Natural or man-made disasters that cause business disruptions can be particularly devastating for companies that may have already been struggling financially or didn’t have a business continuity plan.
In addition, the negative consequences of disasters for individual businesses can ripple through the economy. Although many Connecticut businesses suffered serious short-term effects from the October snowstorm and Tropical Storm Irene, Gioia says the more immediate impacts of such events may not be as problematic as the potential long-term economic fallout.
“The real concern is when you have businesses in economic base industries that sell their products and services outside the area affected by a storm or other disaster,” he says. “Those customers may not be aware of the emergency or the severity of it and expect their products or services to be delivered on time. When that doesn’t happen, do they turn to other vendors? Do they decide that they need two vendors rather than one?
“There are potential long-term impacts on Connecticut businesses, and that’s the real economic risk for the state. We may not know the extent of the economic damage from the August and October storms for a while.”
Preserving Customer Relations
Guida’s did, in fact, encounter customers who were not affected by the storm and expected their orders on time.
“Some customers were upset,” says Lane. “If they had power, it was hard for them to understand that we couldn’t get the product to them. We got partial orders to them as much as we could and tried to explain what we were going through.”
Dick Hrinak, president of Crescent Manufacturing in Burlington, faced a similar situation with some of their 1,400 accounts. Crescent manufactures precision screws and fasteners and supplies their products through a global distribution network.
“We were out for five days,” Hrinak says. “We couldn’t do anything; we couldn’t ship anything. We have so much machinery: more than 100 pieces of production equipment: a generator is just not going to cut it. We just cannot operate.
“Some [customers] didn’t know and were calling and being very demanding. There were some who basically said, ‘We don’t care if you’re without power; you’re late.’ So I called our larger and midsize accounts around the country and talked to all of their reps, and they went out and spread the word so that everyone would know. We had only one account that was in trouble, but we got their orders out as fast as we got back to work.”
Getting Back to Normal: Safety First
Fortunately for Hrinak, his company didn’t sustain direct damage from the October snowstorm, and he and his employees were able to hit the ground running when power was restored. In cases where businesses do sustain physical damage to property, facilities, or equipment, there are several key steps employers should take as they seek to resume operations.
“One of the first things is to assess the amount of damage,” says Al Niederfringer, second vice president in the Risk Control Department at Travelers. “But even before that, I think everybody has to keep in mind personnel safety. In the last storm, we had power lines down. Depending on the type of event, you could have flammable liquids that float to the surface in a flood or equipment that doesn’t operate properly and poses a hazard from natural gas leakage or carbon monoxide. So there are a number of things that have to be taken into account before you flip the switch and try to get back in operation.”
Although Niederfringer advises employers to call their insurance company right away once damage has been assessed, he says that in many cases, it’s wise to react as if you have no insurance. That is, you should quickly do what’s necessary to secure your facility and prevent further harm to buildings and equipment, even if it means calling in a licensed contractor.
“You see people who put tarps over their roof where tree branches have caused damage,” he says. “Whether or not you have insurance should not be a consideration when it comes to taking such measures. A lot of people may think they have to leave things alone for insurance purposes, but it’s very important to do whatever you can to preserve your property, as long as you document and save receipts.”
When it comes to documentation, taking photos can be critical for recording the condition of your property before, during, and after any cleanup operations or repairs that could not be delayed. The Connecticut Insurance Department cautions, however, not to make permanent repairs until your insurer has inspected the property.
Compensation for Lost Business
John Byrnes, chairman of RC Knox & Company, a division of People’s United Insurance, urges business owners to submit any storm-related claims as soon as possible and emphasizes the importance of documentation of any losses that may be covered by business interruption insurance if a company has it.
“Most insurance is triggered by damage on your property,” says Byrnes. “If losses are from direct damage, it’s a little bit easier to adjust. However, the issue we’re running into with businesses as a result of [the October] snowstorm: especially if they were down for a few days or a week: is did they lose business, and can they document that?”
According to Byrnes, once a company produces adequate evidence of lost business and meets its deductible, the insurer will pay for lost profits as well as extra expenses resulting from the storm.
“The key is the documentation of all additional expenses: overtime pay, extra equipment (such as a generator): any extra expenses that were incurred to keep your business going.”
The financial hardship caused to businesses by the October blizzard resulted primarily from damage to off-site transmission lines, not to the lines on companies’ property or to their buildings and equipment. In such situations, compensation for lost business or emergency-related expenses may not be possible unless a company’s commercial property insurance policy includes an endorsement for off-premises power interruption, including transmission lines.
“I would say about 20% of people have that coverage,” says Byrnes. “If you have it, you would clearly have a legitimate claim to file for your lost profits or extra expenses in the event of a power outage. The coverage, however, is not automatic for most small businesses. It has to be endorsed on.”
Without a Plan, You’re Not Ready
For Pete Gioia, one of the lessons of the October blizzard is that many Connecticut companies were not adequately prepared in terms of having an emergency response plan.
“A storm of the century is a tough thing to plan for, and power is going to go out no matter what you do,” he says. “But businesses should make sure they have ways of communicating with employees without the on-site IT being up, so that they don’t have employees coming to work when their facility is not operational and they’re not potentially incurring the cost of those wages.”
According to a survey of 101 small business owners conducted by Travelers in 2010, nearly half (44%) reported not having a written business continuity plan or some other disaster recovery document. Yet, the same survey showed that 94% of respondents were confident that their companies were protected against insurable risks that can result in significant financial losses or business closure.
Similarly, a national survey of businesses with two to 999 employees conducted by the Ad Council in 2007 found that although 91% of respondents said it’s important for businesses to take steps to prepare for disasters and 59% assessed their own business as either very or somewhat prepared in the event of a disaster, only 38% reported having an emergency plan in place.
“I think part of this is that many organizations think, ‘It can’t happen to me,'” says Niederfringer. “And the other part is that they think they’re ready. It’s a false sense of security.”
One of the primary risks of not having a disaster recovery plan is that your business may be irreparably harmed or even be unable to resume operation. But according to Niederfringer, there’s another side to the risk equation: Without a plan, you may miss an opportunity to acquire new customers.
“Having a plan can give you a competitive advantage,” he says. “Many of the businesses in an affected area may be shut down, while another company that took steps beforehand to assess the risk to their facility and mitigate could remain operational and perhaps provide a necessary service to a population in dire need. That could develop into a great deal of customer loyalty.”
Planning Basics
Proper disaster response and recovery planning takes time and can be complex, depending on the size and type of company and the risks it faces. Fortunately, there are numerous resources available to guide you through the process (see below). Niederfringer says effective planning involves five basic steps.

• Assess the threats. “In essence,” he says, “you’re looking at what could happen where your facility is located or somewhere along your supply chain.” In addition to natural disasters, such as blizzards, hurricanes, tornados, and floods, causes of business interruptions could be man-made: fires, terrorism, computer viruses, or even events like the “occupy” protests. Determine what threats are most likely to affect your business.

• Review business functions. Identify what business functions are most critical to your operation. “For example,” says Niederfringer, “if a large percentage of your business in conducted online, that’s a completely different business model than a 100% walk-in-the-door, brick-and-mortar retail type of operation.” In the first case, maintaining or quickly recovering IT functionality in a disaster situation may be the highest priority, while in the second, restoring customer access to your facility may take precedence.

• Conduct a business impact analysis to (a) determine the financial and operational impacts resulting from disruption of your critical business functions and (b) gather information needed to develop recovery strategies. “Consider your threat assessment issues along with your business functions,” says Niederfringer. “If you have determined that flooding is a threat, for example, and your business relies heavily on IT equipment, those two facts become part of your business impact analysis.”

• Develop prevention and mitigation strategies. In the above case, it could be that your business-critical computers are on a basement level, so a mitigation step might simply be to move them to an upper floor to protect them from flood damage. Another important element of this step is to review your insurance policy to make sure you have the coverage you need.

• Test and update your plan. “Make sure that it actually works and that your employees understand what needs to be done,” advises Niederfringer. “Businesses are rarely static, so anytime there is a change in your operations, workforce, or suppliers, you need to go back and make sure your plan is up to date.”

Guarding Against Cyber Threats
Advances in information technology have steadily improved business productivity and efficiency: so much so that most businesses could scarcely get along without PCs, computer networks, mobile devices, and Internet-based tools: including social networking. That reliance, however, has made companies small and large vulnerable to a much wider range of threats and the risk of significant losses. According to the Federal Emergency Management Agency (FEMA), current estimates put business losses to various forms of cyber attacks at several billion dollars each week.
“Network security threats are becoming more frequent and advanced,” says Brian Vines, business continuity manager at The Hartford. “In many cases, small and midsize companies don’t make network security issues a priority due to more immediate matters or because they don’t believe they would be a target for a cyber attack.”
FEMA points out, however, that many attacks on Internet and network systems do not target a particular company. Rather, the attacker sends a large broadcast that uses any unprotected system as a launch point.
“It makes good business sense to be prepared for scenarios that can disable a network or leave a network exposed,” says Vines. “At a minimum, it’s important to back up critical information regularly and keep it in a safe place. The more important the information, the more frequently it should be backed up. In addition, password protection, antivirus software, firewalls, and data encryption can all be used to secure and protect information stored on computers and prevent business disruptions.”
The Special Case of Power Outages
A 2010 study by Forrester Research and the Disaster Recovery Journal surveyed 200 businesses (43% of which had fewer than 1,000 employees) about their level of disaster preparedness. Forty-four percent of respondents indicated their most significant disaster declaration or major business interruption was the result of power failure, making it the most common cause of declared business disasters. (Hardware failure at 24% and network failure: 15%: were the second- and third-most common. See chart for more results.)
For Connecticut companies affected by Irene and the October snowstorm, that fact comes as no surprise. Although it would be a stretch to say that prolonged power outages are a common occurrence here, they happen frequently enough to warrant special consideration.2
New Jersey-based consultant Dr. Jim Kennedy, an expert in disaster recovery and information security planning, has seen a lot of mistakes when it comes to preparing for the possibility of a power failure.
“I’ve actually been in companies that thought that because their building had a generator, it would be available for all the tenants,” he recalls. “When a power failure occurred, they found out that the generators only powered the elevators, emergency lighting, and some IT operations, but not everywhere in the building.”
Kennedy recommends that businesses in multiple occupancy buildings make sure they have access to power from the building’s generator(s).
For companies that occupy their own buildings, a common oversight is failing to regularly maintain and test their generators. Kennedy advises running generators at least once a month to make sure they’re operationally sound and have full fuel tanks and proper oil levels. He cautions, however, that reliance on gas- or diesel-powered generators may prove risky if a prolonged power failure has knocked out fueling stations in a wide area.
He also urges business owners to have plenty of emergency lighting, at least one corded phone that does not plug into an electrical outlet, and ensure that their equipment is adequately protected from the surge that occurs when the power goes out.
“If you have IT systems,” he says, “you need to make sure that you have a universal power source that allows you to bring your computers down softly and save all the open files so there’s no data loss.
“The essential thing is that all small and medium-size businesses have some kind of business continuity or contingency plan for what they specifically need to do to keep their business operational, keep their customers, and make sure they meet their contractual and regulatory obligations. Second, they need to plan for the possibility that their location may not be available to them and be able to move to an alternate location.”
That’s exactly what one trucking company owner in Louisiana did in advance of Hurricane Katrina, recalls Kennedy.
“Knowing that he had only a few days’ notice about where the hurricane was going to strike, he moved all his trucks to higher ground outside the area. His was the only trucking company still in business after the hurricane and was still operating three or four months later, whereas some of his competitors were not. So his ability to plan ahead really helped him maintain his operation and actually do things that his competitors couldn’t.”
Online Disaster Planning Resources
Numerous state and federal government agencies and other organizations provide a wealth of online tools and information to help businesses plan for disasters and survive them once they hit. Here are a few good sources:

• CBIA’s Small Business Disaster Checklist contains links to key state websites and other important disaster response information.

• The Federal Emergency Management Agency’s Emergency Management Guide for Business & Industry is an essential resource. In addition, FEMA’s ready.gov site contains extensive information on emergency preparedness for businesses.

• The IRS provides a Disaster Losses Kit for Businesses to help companies claim casualty losses on property that has been destroyed by a natural disaster and contains tax forms needed to claim a casualty loss.

• For more information about planning for power outages, see “Preparing a Power Failure Response Strategy,” by Dr. Jim Kennedy.

• Other organizations with valuable online disaster planning tools for businesses: the U.S. Small Business Administration, the American Red Cross, The Insurance Institute for Business & Home Safety, and the Insurance Information Institute.