If you' re thinking about creating a contingency or disaster plan for your business, you' re not alone. A contingency plan has always been something that no business should be without, but the events of September 11, 2001 underscored the importance of such preparation.

Todd Gordon is the president and general manager of IBM' s Business Continuity and Recovery Services group that works with 12,000 customers in 76 countries. A 20-year IBM veteran, Gordon has seen many disasters that endangered the survival of important IBM business clients. Although Gordon mainly works with larger companies, he believes that small companies often have much more to lose than the big guys if they don' t have a continuity plan. " Small businesses typically don' t invest the time, effort, and resources to design redundancy into their systems," Gordon explains. " And it' s a real paradox, because small businesses that face a disruption tend to face tremendous financial hardships."

By creating a disaster plan, says Gordon, you perform an analysis that increases the chance your business will survive. You determine where your business comes from, what people you need for the business to function, and what resources you need for it to continue functioning.

The best way to start, Gordon suggests, is to develop a skeleton plan. Then, over the next 30 to 60 days, you create the next layer of the plan, and continue to fill in the blanks over the course of the next six months or so. It' s a huge project, and can seem overwhelming at the start. But think about it - consider all of the things that could go wrong: fire, flood, tornado, anthrax, workplace violence, hurricane, bomb threats, the death of key employees in a car accident or plane crash, burglary, and the list goes on. The key is to focus on the situations most relevant to your business, and to develop contingency plans for all of those situations.

The time-consuming process can have unexpected benefits. " Thinking about and creating a contingency plan forces you to think about what the most critical aspects of your business are, and this disciplined analysis can be an opportunity to become more efficient," says Gordon. " For example, as you review your key revenue generators and their vulnerabilities, you may find opportunities for automation."

Based on our conversations with Gordon and other disaster planning experts, we created an eight-point list to help you get started with your plan.

1.Put together a team.
The first step is to select the group of people who will form your contingency planning committee for the next six months - or for as long as it takes to put your plan together. Look for individuals who will bring a variety of perspectives on the company' s vulnerabilities to the table. For example, you might want to include a facilities manager or someone else who has detailed knowledge of the office building itself. Include high-level managers, consider representatives from all the departments within your business, and, if possible, include a human resources representative as well.

2.Maintain a complete company roster with multiple methods of contact.
Not only should you keep a list of the names of all employees, but that roster should include alternate ways that people can communicate with each other. Include home phone numbers, pager numbers, non-work e-mail addresses, and cell phone numbers. The more ways you have to keep in touch should disaster strike, the better. And keep it updated - disconnected phone numbers or outdated e-mail addresses won' t do you any good in an emergency. You might also want to set up a formal phone tree that can be activated should you need to get in touch with your employees quickly.

3.Determine a chain of command.
If something should happen to your CEO, what would happen to your company? What if several members of your management team were in an accident and couldn' t perform their regular responsibilities? What if key members of your company simply couldn' t be contacted for a period of time when you need to make some critical decisions? To prepare for this kind of circumstance, you need to consider a clear chain of command and authority. Think about the chain of command written into the laws of governmental succession in the United States; you need to think that way for your company, too. If key personnel are missing, who' s in charge? Who makes decisions?

4.Designate disaster authorities.
Gordon recommends having a single decision-maker. That person needs to know the steps to take in a crisis, and how to reach all employees and other essential contacts (clients, customers, etc). And employees need to know who to take direction from in the chaos that frequently follows a disaster.

5.Think about work space alternatives.
If something happened to you primary base of operations, what would you do? If there was an anthrax scare in your office, and you couldn' t re-enter for an extended period of time, where and how would you and your employees work? There' s no one-size-fits-all solution to this question. Can employees work out of their homes? Is there another company that would share their facilities with you temporarily until you can rent or buy space at a new location? Ask the questions now, so you' ll be prepared.

6.What are your main vulnerabilities?
Make a checklist. Do you live in tornado alley? Put tornado damage on that list. Do you work in an office with no alarm system? Put building security on the list. Might layoffs occur sometime in the future? Add workplace violence. What if the phones get disconnected? What if your key supplier can' t get shipments to you? Take everything into account - think about anything that could go wrong. Many scenarios will be specific to certain businesses and industries. You should consider how each one of those situations would affect your core business, your revenue streams, your customer service, and your employees.

7.Backup your data.
Most people have thought about backing up their computer data. Where are your important papers and files - both print and electronic? If your office computers or servers are destroyed, you' d better have your data recently backed up off site.

But what about intellectual data? That needs to be backed up, too. As Gordon explains, " At many smaller companies, assets are largely vested in a key individual or individuals. These companies need to take what' s in the head of those individuals and pass it on." How do you " back up" intellectual data? There are quite a few ways to do it. You can interview that person, and create educational materials from those sessions. You can start a mentoring program so more knowledge gets shared. In short, develop formal procedures through which you document that knowledge, and educate employees about that knowledge on a regular basis.

8.What equipment and supplies do you need to perform your business activities?
Based on your company needs, determine what' s needed to keep the business running if disaster strikes. If certain parts of your business shut down or were destroyed, how would you stay solvent? Where would revenue come from? What people, equipment, space, supplies, or services do you need to keep that revenue flowing if you experience a business disruption?

As you develop the plan, Gordon recommends getting someone who knows a little bit about your business - possibly a consultant or friend -- to look over your analysis. When you' re close to a project - especially, in this case, if you' re the founder of a business - it' s harder to see your vulnerabilities or where the holes in your plan are.

Once you have the plan in place, educate your employees about it. To test how well you' ve done in laying out the plan and communicating it to your company, Gordon recommends running " fire drills." Let employees know you' re going to test their familiarity with disaster procedures at random times, then simulate some of the scenarios set out in your plan. " The idea is to shut down certain systems, or simulate other disruptions, and see how the business reacts," Gordon says. For example, he suggests, if you have three office locations, call all the employees of one of those locations early one morning and tell them to stay home all day and not to answer the phone. The other two locations will then have to conduct business as usual - without one of the offices. Or try shutting down some of your main computer systems, or testing what people would do if there was an anthrax scare, or simulating the loss of five key employees. " Disaster preparedness and response is especially important in small businesses," says Gordon, " because there are fewer people, so each one matters more to the survival of the company." By testing your plan with drills on a regular basis, you make sure that everyone in the company knows how to react.

For more information on disaster planning and response, check out the following links:
Disaster Recovery Planning 101
Leading Your Company Through a Crisis
Flirting with Disaster
Business Insurance: A 12-Point Checklist
Helping Employees Cope

Copyright © 2001 Inc.com LLC