It’s almost Halloween, I can tell by all the typical signs around my house: bags of candy I’m trying hard not to open, pieces of kids costumes still in production on various tables and counters, and replays of old monster movies that I’m missing on cable this week.  Haunted houses, trick-or-treating, and plenty of scares and frights.  Fun, right?

But for a moment let’s put the fun aside and address a different type of frights, particularly the things that scare you as a business leader, manager, or owner.  Market changes, IRS audits, lawsuits, and impacts of new regulations are some of the normal things we worry about.  But what do you fear?  What types of events or incidents go beyond a “worry” and should be classified as more of a “nightmare” situation for your business?  We all have a list of these – go ahead and think of 3 events that if happened, could put you out of business or worse.  I also know that list is realistically far longer than those 3 things you just thought of. 

From a business continuity perspective we use the term “threat” and normally we categorize them as natural, man-made, or technological with some threats broken down as accidental or intentional.  Natural threats include thunderstorms, blizzards, hurricanes, earthquakes, or even pandemics or diseases such as avian flu or Ebola.  Technological threats focus on impacts to networks, systems, or data from hardware failure, system outage, or cyber security breaches.  Man-made threats are highly unpredictable and can range from a minor incident like a medical emergency or increase in scale to bomb threats and workplace violence up to riots and terrorism.  The truly frightening fact regarding these possible incidents is this - you have no control over these threats.  Zip, nada, nothing.  Threats are uncontrollable.  They will happen and at some point they will happen to your business or organization.

To wrap up my awareness campaign for this years’ National Preparedness Month I want to address an area that is normally overlooked but is important – preparedness for churches, faith-based and non-profit organizations.  A few days ago I found a good discussion regarding the threat and general lack of planning for active shooter situations at churches.  The original post and link to the article by Melody Lauer (usually known as Lima) can be found here.  The focus of the discussion that I agree with 100% is that churches don’t spend much time preparing for threats, even though in the last few years there has been no shortage of examples of churches impacted by violence, protests, and natural disasters. 

Faith-based organizations have many challenges beyond what businesses must prepare for.  Churches are soft targets (meaning easy to attack) because of the general culture of being open to all.  I also consider churches as soft targets from natural threats since most churches are a combination of old, large, or mismatched buildings that may not be the most resilient to natural disasters.  The risk to churches increases dramatically based on additional services they provide such as daycare, schools, shelter services, etc.  Any services involving children or the elderly must be appropriately accounted for.  Churches may also have increased threats due to global, cultural, or political issues.  Lastly, churches and other faith-based organizations may have increased operational requirements during and after a disaster or incident; specifically if they are a designated shelter, food pantry, or emergency counseling center.

So why don’t churches take the time to prepare?  First, churches (like three quarters of American small and medium businesses) tend to believe these incidents won’t happen to them, which is especially amplified in smaller organizations.  Further, they usually have a small staff focused on administrative and ministerial positions and are not likely to have experience in safety, security, or preparedness.  Third, churches may not realize they have legal requirements they need to comply with.  Lastly, churches face the same budgetary and resource constraints that businesses face and mitigation and preparedness may not be considered a requirement.

Churches, faith-based organizations, and non-profits cannot claim in today’s environment “We didn’t know we were at risk!”  So what should they do, keeping in mind realistic constraints of resources and mission needs? 

Last week, my awareness article for National Preparedness Month focused on family evacuations, a few personal lessons, and a free evacuation checklist you can download for your family (catch up here).  For this week’s topic I want to shift gears and focus on business preparedness.  Specifically, I’d like to address a few fallacies, incorrect assumptions, and excuses that actually increase your business risk on top of the natural, man-made, and technological risks a business already faces. 

Incorrect assumption #1:  It won’t happen to me.

I am amazed at how often I hear this from business owners and managers.  One doesn’t need to be a preparedness expert to realize that no matter where you are in the country, you face not only natural hazards (floods, wildfires, hurricanes, blizzards, thunderstorms, tornadoes, earthquakes, etc.) but also man-made threats (power outages, water outages, protests and riots, crime and violence, etc.) and technological threats (cyber-attacks, hardware failure, sabotage, etc.).  The list is too long to name every threat here, just open your local paper or watch the local news – it’s a sure bet you will find at least one threat mentioned almost every day.  Fact is, bad things happen and it always happens to someone.  Someday that someone could be you.  Accept the threats and do something about it. 

This week for National Preparedness Month I would like to focus on one aspect of family preparedness that I’ve had to deal with personally – home evacuation.  In the previous two years my home area in Colorado had to deal with back-to-back record setting wildfires, the Waldo Canyon Fire and the Black Forest Fire.  Before you think “I don’t have to worry about evacuations because I don’t live in a forest,” let me say I don’t live in the forest either.  I’m basically in a developed area mixed with a good amount of trees.  The majority of the homes lost in these fires were in traditional subdivisions.  Even if your wildfire risk is low, floods, chemical spills, aircraft accidents, hurricanes, and many other hazardous situations may require you to evacuate your home.  From my personal & professional experience, I would like to share a few tips to help you better prepare your family.

Don’t Assume Anything!  I have to admit that although I teach classes regarding preparedness for work and home and have completed quite a few actions to prepare my family, I hadn’t gotten around to some things I knew I should have before the first fire.  We had emergency supplies, a family checklist, and a plan of where to go all figured out.  I even had our (very tiny) camper all prepped and ready.  Collecting and scanning our critical paperwork - well, that’s my personal shortfall.  I assumed it was all in the fire-proof box and file cabinet.  Over time those documents are needed for other purposes and many don’t find their way back.  When we received the pre-evacuation warning during the Waldo Canyon fire, it became obvious that assuming those important documents were exactly where they should be was not correct.

A little over a year ago in my first blog post I discussed the business risks from protests and civil unrest from a continuity planning perspective, inspired by my cousin who owns a business very near to the events of that time.   (Post is here if you’d like to catch up:  http://accinctus.com/index.php/news/item/3-civil-unrest-is-a-business-threat)  A year later we see similar issues as the non-stop news stories so I’d like to revisit that idea as a reminder.

In that article, I recommended businesses take three steps:

1. Assess the threats and understand the risks to your business, employees, and customers and look for alternatives.
2. Have a solid communication process in place so you can easily communicate with your employees during an incident.
3. Document your response and recovery processes in your business continuity plan (BCP).

I still firmly believe that any business of any size (even micro-businesses with less than 10 employees) will benefit from applying these steps to their business scaled to their needs.  A risk assessment, communication plan, and business continuity plan will be very different in both size and level of detail comparing a small business and a global enterprise company, but the basic steps and the purpose are very similar. 

By now almost everyone has heard about the water crisis in Toledo the last few days, either as a legitimate news story or an internet joke.  I grew up on Rudy’s and Packo’s, the Mudhens, Max Klinger, the Jeep plant and “Glass City” so I know the “take the lake for granted” mentality of the area.  Even as the smallest Great Lake, Lake Erie is immense and you just can’t imagine more than 500,000 people told “don’t drink the water” over three days in the first days of August due to a little microscopic plant that just happens to have a nasty by product that is rather hazardous to people.  I’ll leave the science class aside, although I am definitely interested to see what happens from here.  Instead I would like to address the incident from my professional perspective.  

Today marks the one year anniversary of Accinctus.  A good friend of mine who is also a successful business owner told me when I started – the first year is a game of 52.  52 weeks in the year and 52 cards in a deck – week by week keep going to make it through the deck (looking forward to your book on the topic Bill).  Many days I feel it’s a game of 52 pickup with all the cards tossed in the air and I have to pluck just the right one out of the air at the right moment before they all fall. Might seem like magic but I’ve found there is no magic to any of this – just hard work with a good dose of stubbornness (which I have in spades).   

I’ve been thinking about what I’ve learned this year and would like to share my thoughts on what I think are the top 7 lessons.  Those who have far more experience running a business will perhaps enjoy a reminiscent chuckle and those like me trying to build a new business or thinking about starting a business will hopefully find some value in these to perhaps feel they’re not crazy.  

Lesson 1:  Starting a company is the hardest thing I’ve ever done. 
I am constantly challenged to learn about so many new things that a business owner needs to know.  Every time I think I’m starting to understand one thing, 50 more jump out at me and I do not know when that will slow down.  Some days it feels a lot like basic training with a string of rough minutes, hours, and days strung together.  Tenacity of purpose and thick skin are required to wear the title of “business owner!”

I was emailed Jeffrey Gitomer's Caffeine Jolt newsletter yesterday with an article titled Help! My Main Contact Left and I’m Panicked! Unlike the person who emailed the newsletter to me (thanks Mom), brushing my teeth with a brillo pad is more exciting than talking about sales and marketing to me.  I prefer dealing with disasters, disruptions, response plans and the related processes as a business continuity (BC) professional.  I bet a few marketing and sales professionals who read that think I’m certifiably nuts and would choose the brillo tooth brush instead of having to deal with workplace violence, mud slides, or power outages.  Each to our own passion.

However, there is an idea in the article I would like to address from my BC perspective rather than a sales perspective (sorry if that disappoints you sales and marketing gurus).  The specific question involved the loss of a key contact in customer organizations.  Loss of key personnel is certainly one threat I deal with but for this discussion it could also be a disruption that shuts down your production for a few days, an incident that harms your corporate reputation, or a disaster that damages your office or injures your employees.  The basic idea is that something bad unexpectedly happens which you are not prepared for resulting in a terrible impact to your business.  Putting that into a formula looks like this:

Threat + Lack of Awareness + Lack of Preparedness = Negative Business Impact