No organization today, nonprofit or otherwise, can afford to ignore the possibility of a natural or manmade threat that cripples operations. From hurricanes and wildfires, active shooters and cyberattacks, to things as seemingly minor as a burst pipe, your operations are vulnerable. While some disasters are unpreventable, you nonetheless can reduce the repercussions by preparing now.
Assessing the risks
The first step to effective disaster planning is to conduct a risk assessment. This can seem a daunting prospect, particularly for larger nonprofits, but breaking it down into discrete components can simplify the process.
Facilities. Evaluate your facilities’ structural integrity, including the elevators and fire suppression, water, gas, telephone and electrical systems. Consider, too, each facility’s location — for example, do the traffic, crime levels or neighbors pose any threats?
Operations. The main goal in disaster planning is to ensure that you can return to full operations as soon as possible. To that end, identify the equipment, information and people that are essential and at risk. For example, how would a lengthy power outage affect your operations? What are your staff’s critical functions? Is there sensitive information or inventory that would need to be recovered? Are certain supplies required?
Data. Digital data lies at the heart of many organizations, and you may house much of it on cloud storage. Ideally, you’ll still have access after a disaster. Nonetheless, think about backing up cloud data for an extra layer of protection. Also make sure that you have digital copies of your organization’s important documents — for example, your articles of incorporation and IRS determination letter — that might be on paper. You’ll also need access to contact lists, banking and financial information, insurance documents and similar records that might reside outside the cloud.
Communication. You may need to reach out to media, clients and vendors with urgent messages. What would a press release look like and where should it be released? Will clients need backup services while you’re unable to provide them? Prepare a crisis communications plan.
Reducing your exposure
Once you’ve identified risks, take a two-pronged approach to addressing them. Begin by doing what you can to reduce your exposure. Then plan your response to the risks that remain.
For example, purchasing a backup generator could support full operations or at least key functions if you experience a power failure. If you rely on specific suppliers, make plans with other vendors in case your usual sources aren’t available. You generally can maintain “active” status with a vendor merely by placing occasional orders. You also should dual-train staff for vital functions so that a single employee’s unavailability doesn’t undermine operations.
Insurance plays an important role in reducing exposure, too. Review coverages with your insurance broker and fill any gaps with, for example, cyber- or business-interruption policies.
Mapping out your response
You can’t eliminate every risk, of course. For those that remain, plan for how you’ll respond in the immediate aftermath.
Establish an emergency response team composed of several employees. Among other tasks, it should:
An often-overlooked resource in this stage is first responders. Don’t let your first contact with emergency help come in the frenzy of a crisis — reach out to them predisaster. The first responders’ suggestions can make for a smoother response in an actual emergency.
And finally, your emergency response team should re-evaluate their risk assessment and response plan frequently. Adjust your plan as needed.
Worth your time
It’s easy for disaster planning to fall by the wayside when you’re focused on pursuing your mission. But taking the time to prepare now can help you avert mission-threatening consequences later.