A business owner who survived the World Trade Center attacks writes about preparing for disaster

September 10, 2001, was the first and last business day for a small pizza parlor in lower Manhattan; without business interruption insurance, the owners did not have enough funds to cover fixed expenses until they could repair and reopen the restaurant following the 9/11 attack on the World Trade Center. "Be Prepared," the Boy Scout motto, packs a lot of wisdom for small businesses, writes contingency planning expert Donna Childs. In her new book, "Prepare for the Worst, Plan for the Best: Disaster Preparedness and Recovery for Small Businesses," Childs explains what small businesses should do to survive a crises.

When the Klez e-mail worm struck FromGlobaltoYou.com's desktop computers, the online antique business was shut down for two days. As a result, the Utah-based company lost some 30 customers as well as significant revenue from eBay auctions it could not complete while its computers were inoperable. Such scenarios, unfortunately, play out in small businesses everyday, often with devastating consequences.

For this reason, it's imperative for small business owners to develop contingency plans that can help mitigate losses in the face of a variety of unexpected disasters, says Donna R. Childs in her new book, "Prepare for the Worst, Plan for the Best: Disaster Preparedness and Recovery for Small Businesses." Childs knows this first hand. A former senior executive at one of the world's largest reinsurance companies, Childs' own small business was located in the World Trade Center during the September 11 terrorist attacks.

While she certainly never expected such a disaster to occur, the contingency plans she had in place allowed her to ensure her employees' safety and resume business operations fairly quickly after the attacks. "My business had its data backed up online and off-site, which allowed me to work remotely following 9/11," she writes. "I soon realized that my level of preparedness was unusual."

Indeed, Childs cites a recent survey of 2,500 small business owners which found that 71 percent did not have disaster preparedness plans in place, while nearly 2/3 felt they did not need contingency plans, and 63 percent expressed confidence that they would resume business within 72 hours if they were affected by natural disaster, though evidence shows this not to be true.

Small businesses are especially vulnerable

Contingency planning is particularly crucial for small businesses because they lack the financial and personnel resources that large corporations can count on to work through crises, Childs points out. And it is not just small business owners who pay the price for poor contingency planning.

The well-being of American small businesses has a direct impact on the overall economy — the more than 25 million small businesses operating in the United States employ 52 percent of the private workforce and contribute more than half the nation's private GDP. Childs thoughtfully draws on the lessons she learned on September 11 and during the aftermath to guide small business owners on the path to disaster preparedness.

Written in a casual, first-person style and peppered throughout with real-world tales from small business owners, "Prepare for the Worst, Plan for the Best"serves as a handbook to help businesses prepare for and respond to events ranging from natural disasters like fires, hurricanes, and floods, to human errors, equipment failures, and major disasters such as a terrorist attack.

Acknowledging that disaster planning is sometimes a hard sell to busy entrepreneurs, Childs smartly shows that "putting in place a disaster preparedness plan to protect your business will yield a positive return on your investment even if disaster never strikes." For instance, by sharing her robust disaster preparedness plan with her insurance company, Childs proved her business was less of a risk than her peers, and negotiated a double-digit percentage decrease in her commercial insurance premiums.

In addition, because part of developing a preparedness plan means carefully evaluating business processes, company owners often find opportunities to increase operational efficiency, she notes. Unfortunately, explains Childs, in our post 9/11, post-Hurricane Katrina world, many business tend to think big, revolving their disaster preparedness efforts around sensational events while neglecting the high-frequency, low-severity events that are far more likely to disrupt their business.

A factory fire or a computer virus does not make headlines, but it will cause major headaches for a small business. By "sweating the small stuff," as she puts it, companies will naturally be more equipped to deal with the consequences of a major disaster. "If you develop a plan for how your business would function with a disruption in the electricity supply, you are automatically better prepared for coping with the more serious forms of disaster," she writes.

Prepare, respond, recover

The book outlines the three stages of disaster planning — prepare, respond, and recover — offering business owners a thorough, well-organized roadmap for creating a contingency plan that encompasses all three.

She unearths some useful tips from the "I never would have thought of that" department: training all employees on how to use backup files and access system data in case IT personnel are not available during a disaster; taking steps to reduce the amount of junk mail your business receives to cut down the time it takes to screen mail for anthrax or other dangerous substances; and keeping petty cash in the office in case a disaster leaves your employees with no way to access an ATM machine, to name a few.

The importance of establishing redundancy is one thing Childs stresses, offering ideas such as backing up important files frequently and maintaining copies of the backup at a remote location; ensuring uninterrupted phone and e-mail service by contracting with multiple service providers, and even securing secondary office space so the business can continue functioning if damage to the premises is prohibitive. Financial redundancy is also key.

"Should a disaster strike your business, you may need additional funds to replace lost or damaged assets and to cover additional operating expenses during the recovery period following the disaster," Childs writes. The "prepare" phase of contingency planning also includes important steps such as determining which critical business assets to protect, establishing protection measures, and taking necessary precautions.

The importance of ample insurance coverage is not to be underestimated, says Childs. She recommends that business owners prepare an exhaustive list of business assets such as inventory, property and equipment that need to be insured under a property-casualty package. In addition, business interruption insurance, which helps to mitigate the impact of lost income while a business works to recover from a disaster, is a must.

Childs cites the example of a small pizza parlor which opened in lower Manhattan the day before the September 11 terrorist attacks; without business interruption insurance, the owners did not have enough funds to cover fixed expenses until they could repair and reopen the restaurant. "September 10, 2001, was the first and last day they served customers," she writes. Not surprisingly, the book also includes a lengthy section on IT strategy as part of disaster preparedness.

In today's high-tech, constantly connected business world, any loss of IT capacity can be crippling. Achieving a robust IT contingency solution involves "analyzing the current IT infrastructure, determining how the system is used, understanding current and future needs from a high-level perspective, and observing if those needs are being met and if they will be met in the future," she explains.

Businesses must be able to protect their IT capability from problems caused by simple human error and equipment failure as well as larger-scale threats like a natural disaster or a terror attack. Specifically, notes Childs, business owners should be sure they have system data, user data, and third-party vendor data backed up both online and off-site; maintain detailed records of physical goods such as hardware, software, printers and peripherals; and invest in system security measures and training for IT staff.

In the effort to be prepared, however, some business owners make the mistake of developing an IT plan that is too complex. "A good IT solution provides contingent capacity, and is simple and easy to operate," writes Childs. But even the best-laid plans do no good if they don't actually work the way the business owner intended. For that reason, Childs stresses that testing the contingency plan is a must. For example, she recommends doing monthly spot checks on backup data sets and running evacuation drills at the office.

When "Aid" does more harm than good

The first place that many small businesses turn to in the aftermath of a disaster is the federal government — be it to FEMA (Federal Emergency Management Agency) in the event of a major disaster or to the Small Business Association (SBA) for business loans to cover damages from smaller-scale events. However, Childs believes that these agencies and the programs they offer are not a reliable source of help.

"I participated in many disaster relief programs and I will tell you I would never do so again," she writes, explaining that the federal programs "have onerous documentation requirements and they generally yield a poor return on the time invested." Her criticism of these programs stems from their tendency to chew up valuable time, favor affluent populations, and cause conflict about how grant monies are divvied up.

Instead of counting on the government to help, Childs believes businesses should follow her roadmap to be prepared before disaster strikes so they can be self-reliant and remain in business after the event. The overall goal, she writes, is learning to "make your business disaster-resilient so that you realize your entrepreneurial dream and plan for the safety and security of your family and your employees."

Bottom Line According to Donna Childs:

• It is imperative for small business owners to develop contingency plans that can help mitigate losses in the face of a variety of unexpected disasters.
• Putting in place a disaster preparedness plan to protect your business can yield a positive return on your investment even if disaster never strikes — for instance by helping to lower commercial insurance premiums.
• Redundancy — in both technology and finance — is a key aspect of any contingency plan. Companies should maintain backup files of important data and keep additional funds to cover operating expenses during the recovery period following a disaster.
• Small businesses should not depend on government programs for aid after a disaster; they should instead be resilient and use their contingency plans to guide them through the disaster and help them resume operations as quickly as possible.