Risk Check Survey

CIRCUMSPEX.COM | Toll Free 877.315.7526
3505 Lake Lynda Drive Suite 200 Orlando, FL 32817 USA

1CX | RISK CHECK SURVEY + RESOURCES Copyright © 2014
I. INTRODUCTION
THE EXPERT
David J. Mistick provides property managers, real estate groups and insurance
agents and brokers comprehensive strategies to build resilient organizations
fortified against disruptive business events.Through planning and exercises,
David affords increased protection for people, property and profits. Owners and
staff are better prepared to manage businesses through chaotic and catastroph-
ic times.The costs and durations of business interruptions are minimized while
the return to normal operations is accelerated.
David is a Certified Property Manger®
, Certified Business Resilience Manager®
and winner of the Phoenix Award for Innovation in Disaster Restoration. He also
co-authored, with Deborah S. Mistick, CPM®
, Before and After Disaster Strikes:
Developing the Emergency Procedures Manual published by the Institute of
Real Estate Management. David is contributing author to numerous trade
publications and is a continuing education instructor in more than 35 states.
David can be contacted via dave@circumspex.com or by calling 412-812-0211.
THE ISSUE
Today, businesses face a myriad of challenges in growing and sustaining them-
selves.These challenges include factors that are within the organization’s con-
trol and many that are not. In this document, we explore a business continuity
and crisis management planning process that harnesses the power of what you
can control and the collective knowledge of your organization.Through this
process, you will be empowered to minimize the risks of disastrous events and
crisis that are also beyond your control.
The need for business continuity and crisis management planning is to protect
people, equipment, systems, and facilities from the dire impacts of disasters.
In an age of information deluge there has never been a time when the need for
disaster planning has been so apparent.Yet, despite our awareness of the im-
pacts that tragedies like 9/11, the anthrax attacks, Hurricane Katrina, Superstorm
Sandy, the VirginiaTech massacre, petroleum processing plant explosions and
the Joplin tornado have had, disaster planning remains overlooked in most
businesses across the country.
Crisis planning, and its associated derivatives such as disaster planning, disas-
ter recovery planning, business continuity or emergency planning, represents
the formal process of hazard analysis, hazard mitigation, management and

procedural activities that provide for a pre-event strategy for handling the crisis.
Collectively, the crisis plan represents how the organization will deal with crisis
before (pre-event), during (business continuity) and after (business recovery)
a crisis. Such plans are designed to minimize the overall impact the crisis will
have on people, organization’s business process and property.The goals of
crisis planning and crisis plans are to safeguard human life, preserve business
operations and ensure an efficient and effective resumption of operations to
pre-event status as soon as possible.
Every organization, regardless of size and complexity, should have a crisis plan.
The plan represents a step-by-step guideline on how a defined crisis will be
managed. Even in a post 9/11/01 world, it is debatable whether businesses are
adequately positioned through planning and budgetary allocations, to effec-
tively manage a crisis.
The Association of Records Managers and Administrators reports that 60 per-
cent of businesses impacted by a major disaster close within two years of the
event. Similarly, the Strategic Research Institute states “companies that aren’t
able to resume operation within 10 days of a disaster are not likely to survive.”
Time magazine reported that the Hazards and Vulnerability Research Institute
at the University of South Carolina found that “91 percent of Americans live
in places with a moderate to high risk of earthquakes, volcanoes, tornadoes,
wildfires, hurricanes, flooding, high wind damage or terrorism.” So, with all the
media images, television reports, magazine articles, and research studies, why
aren’t we better prepared?
Consider the 6 myths of disaster planning:
Myth #1: Disaster — it won’t happen
Most Americans continue to be in denial of the risks. In the sameTime article,
Eric Holdeman, Director of Emergency Management for King County, Seattle,
summed it up best: “There are four stages of denial. One: It won’t happen.Two:
If it does happen, it won’t happen to me.Three: If it does happen to me, it won’t
be that bad. And four: If it happens to me and it’s that bad, there’s nothing I can
do to stop it anyway.”
Needless to say there is a certain warm comfort in this rationalization for do-
ing nothing.The fact is, disasters large and small impact businesses every day.
Not all make the evening news.Yet loss of power, Internet failure, or sprinkler
breaks, all result in some type of business disruption with an associated cost.

Myth #2: Planning — Too much time and too much money
This myth reflects the notion that your plan should be the size of a PhD thesis
and require engineers, statisticians, biohazard experts, and planners with secret
training. It also reflects the sense that to be worthwhile, the plan must require
outside experts, nine months of project time, and a minimum of $75,000 invest-
ment. Many in the planning business have sustained this image to enhance the
value of the niche.There is a time and place for this process.
We must recognize the needs, yet limited resources, of many small and mid
market business owners and managers. By spreading information, providing
educational opportunities, and writing, we prove our case: that some planning
effort is better than none. Even the most basic plan – organizing communica-
tions, identifying hazards and documenting response procedures — will move
your business, staff and clients to a better place.
Myth #3: One size fits all
As in the prior segment, there is no single absolute model or format for ef-
fectiveness.There are certain core elements, which the business should strive
to address. But we must recognize that working in a disciplined and organized
way toward a comprehensive plan is an achievement in itself.
Often, we see an organization that has adopted a plan for a 25 story urban of-
fice tower, then attempt to transfer that plan to a flex building in a suburban
office park. While certain elements of a plan may overlap across multiple prop-
erties owned or managed by a single entity, simply changing the title on the
plan cover is not a reasonable solution.The most obvious example was British
Petroleum’s disaster plan for deep well development in the Gulf of Mexico. Cit-
ing otters and sea lions in its pages highlighted this useless approach.
Each situation, property, campus and shop on Main Street has unique charac-
teristics that require different salutation in plan development and execution.
These may be determined by location, property use, tenant or client profile,
building design, construction, etc.These elements and more require a consider-
ation of the unique and specific issues that surround a business.
Myth #4: One and done
For those who have written a plan, this may be the most egregious sin.This
sentiment reflects the belief that disaster planning is a project, with a comple-
tion and an end point. It also is reflected in the BP example – check the box,
submit the paperwork, and we’re done.
Writing a plan for a business, whether it is only six pages or six hundred, is
only the start. Exercising the plan, whether it involves bringing employees to a

full-blown virtual computer center or simply a tabletop discussion in the confer-
ence room is requisite. Placing the plan in a 3 ring binder in the trunk of your
car is not a solution.
Maintaining the plan is also a challenge for most organizations. Who is re-
sponsible for updating information regarding contacts, equipment, business
systems or insurance information?To maintain the value of any plan, change
management is essential.Today, this task has been made easier by computer
applications that make updating and distributing the plan much less time con-
suming.
Myth #5: If it can’t be perfect, why try?
We must disabuse the business owner’s perspective that perfection is the only
acceptable outcome. In a culture that strives for perfection, the intent is admi-
rable. However, it could be a roadblock to producing even the most basic plan.
A life preserver thrown to a drowning man is a good option when a life raft isn’t
available.
Making the investment of time and energy to prepare a business continuity and
crisis management plan is a visible commitment toward the health and safety
of your employees, as well as a statement to your clients about the viability of
your business. Providing essential information regarding evacuation, hazardous
materials, utility shutoffs seem so elementary, yet they can make a huge impact
on the severity and costs both in terms of personal injury/death as well as cash
to a business. A framework that limits these risks can speed recovery to normal
operations.
Myth #6: I’m insured, why worry?
The danger of being lulled into a state of false security is tremendous. Manag-
ers who have never taken the time to diligently consider the potential costs of
business interruption are inadvertently laying the groundwork for a disaster. Far
too often, business leaders only discover their true exposures after the fact –
when coverage and/or values are deemed inadequate. A close consideration of
insurance coverages relating to property values, business interruption, contin-
gent business interruption, code and ordinance coverage and environmental
issues are critical for any size business.This is an essential part of any business
plan or disaster plan.
In today’s economy, it is more important than ever. With credit lines limited for
small and mid market business, and average receivable times being extended,
any unforeseen strain on finances may portend doom. Realizing, post-disaster,
the inadequacy of your insurance coverage, is too late.

CONCLUSION
There is an absolute need to plan for surviving and recovering from disasters.
The responsibility to employees, shareholders, customers, and other parties
with vested interests is clear.
To minimize potential harm to people and minimize downtime are paramount
objectives. A collaborative business environment employing processes and
procedures from business continuity and emergency response planning will
provide your organization with its best opportunity to meet these objectives.
John F. Kennedy once said that, “The best time to fix the roof is when the sun is
shining.”The best time to work on developing and testing a crisis management
plan are when things are quite “normal”. Developing a plan will improve your
organization’s ability to survive; to recover; to succeed!

II. BEST PRACTICES
In the following pages, you will learn the best practice components, goals, and
objectives for preparedness planning.These issues will heighten your aware-
ness and spur you to take positive actions.To many folks developing and ex-
ercising a business continuity plan seems like a daunting task.Yet it is really
completing that last piece of your organization’s business plan. Being a good
steward begs you to confront the issues of business resilience and prepared-
ness. When you think of all the blood sweat tears and dollars to start and man-
age your enterprise –how can you deny the exigency of preparedness?
BUSINESS CONTINUITY PLAN
The goal of a business continuity and crisis management plan is to organize the
tools and resources your business will need to minimize the impacts of disrup-
tive events by reducing business interruption losses, downtime and associated
financial impacts, while maintaining critical business processes and operations.
Business Continuity Management Process
–– Sets continuity planning as a critical project
–– Establishes business continuity planning policy
–– Identifies committee members
–– Sets requirements for awareness and training
–– Assures regulatory compliance
–– Establishes guidelines for the protection of people, equipment and property
–– Provides the framework for disaster response
–– Approves final plan documents
–– Maintains and implements the plan
The business continuity and crisis management plan focuses on people, criti-
cal business processes, services, suppliers and vendors.These critical factors
are considered across a spectrum of essential business processes including IT/
voice/data, records, manufacturing and production, physical spaces and sup-
port elements. Below are alternatives to normal operations, whether the dis-
ruption is loss of a facility or a critical component in a manufacturing process.
Viable, tested alternatives will ensure business survival.
Fundamental Goals & Objectives
–– Protection of people and assets
–– Prevention of potential disasters
–– Minimize downtime and speed return to normal operations

–– Development, testing, and maintenance of the plan
–– Elevation of disaster awareness
Six Stages
1. Risk Identification and Assessment
2. Business Impact Analysis
3. Strategy Development
4. Plan Creation
5. Testing
6. Plan Maintenance
STAGE 1: RISK IDENTIFICATION AND ASSESSMENT
This phase focuses on potential threats to your organization and extrapolates
the financial impacts of each. Considerations in the phase include:
Threat Sources
Natural, man-made or technical threats.
Events byType
Flood, hurricane, power loss, etc. A site survey conducted by a professional can
help expose risks that are not readily identifiable.
Outcomes
Consequences of an event for a critical business asset. Interruption in production,
or inability to fulfill customer orders, for example.
Single Loss Exposure
Also called Potential Single Loss Cost, it’s the value of an asset as exposed to a
particular risk (i.e. the cost of a disruption that happens only one time.)
Likelihood of Events
Annualized rate of threat occurrence.This is a mathematical formula that identifies
the number of times a specific threat might occur in one year. Unlikely and highly
unlikely probabilities can be rated with a fraction, or even zero.
Identify Risk Values
Multiply the Annualized Loss Exposure by the Annual Rate ofThreat Occurrence.
The result of this equation helps you rank threats in order of priority based on like-
lihood and cost to your business. Understanding the threats, their likelihood, and
their financial impact will help you determine how to best control the risk.

Risk Control Options
Risk Acceptance Do nothing.
Risk Avoidance Avoid the risk completely.
Example: Remove hazardous materials from the site and thereby
eliminate the associated risk.
Risk Reduction Reduce the risk to acceptable level.
Example: Move valuables above the first floor in a flood zone.
RiskTransfer Transfer the risk to another entity (i.e. insurance company)
STAGE 2: BUSINESS IMPACT ANALYSIS
Analyzing risk and related exposures identifies the financial and operational
(non-financial) impacts of disasters or disruptive events.
Key components
–– Identification of business critical processes
–– Financial and operational costs
–– Requirements for resuming critical business processes after a disruption
The information for the business impact analysis is derived from interviews,
surveys and workshops involving the business staff.This process generates
several fundamental business continuity planning concepts including:
MaximumTolerable Downtime
How long can downtime be tolerated without dire impact?
RecoveryTime Objective
The length of time between a disruptive event and the recovery of systems
and resources, such as computer systems, voice and data, manufacturing
equipment, facility and associated building systems.
STAGE 3: STRATEGY DEVELOPMENT
This phase develops recovery options to be utilized when experiencing a disas-
ter or disruptive business event.The output of strategy development is a docu-
ment that specifies the cost benefit per option.
STAGE 4: PLAN CREATION
The plan is a document containing information required by your organization to
recover critical business processes and hasten return to normal operation.

As the plan takes shape, guidelines should be developed for:
–– Disaster declaration, including which individual(s) have authority
to make the declaration
–– Procedures for assessing the event
–– Initial response and notification of interested parties
–– Contact information for staff, vendors, clients and other resources
identified in the plan
–– Specific business functions to be handled outside of normal operations.
–– Recovery processes and procedures
–– Normalization of work processes
–– Routine updates, exercises and changes to the plan
STAGE 5:TESTING
Consistent testing and evaluation is essential to effective execution of your
business continuity and crisis management plan.Testing will help you confirm
the practicality and adequacy of your strategy. It will also highlight gaps, help
train staff and provide a benchmark for further improvements to the plan.
The preferred methodology for small to mid-sized business are generally:
ChecklistTest
The most frequently used and routine of all plan tests, the checklist test is per-
formed by a designated individual or team to ensure all plan documents are in
place and current.
TabletopTest
A review of the plan with other team members, often in the form of a presentation
describing specific scenarios to be discussed.The parties involved must under-
stand impacts and linkages seeing the results of
decisions made during the test.
STAGE 6: PLAN MAINTENANCE
Maintenance of the plan is a continual process that assures there is a constant
state of readiness. Routine maintenance of the plan should be scheduled to
minimize gap failure due to changes in personnel, equipment, IT systems or
regulatory requirements. Monthly or quarterly maintenance is appropriate de-
pending on the size of your organization.Triggers for updating the plan should
include major changes in personnel or equipment, and any actual event or test
that provides new information.

Maintenance of the plan should be assigned to a specific person or team. Be
sure to include instructions for distributing changes to the plan and for requir-
ing those involved to the keep their copy up to date.
EMERGENCY RESPONSE PLAN
An emergency response plan lays out procedures to deal with the immediate
physical effects of a disaster. It is developed as a methodology for initial re-
sponse, and is a complement to the business continuity plan.
Goals and Objectives
–– Provide a managed, coordinated and effective response to the immediate
physical effects of an emergency
–– Safeguard people
–– Provide shelter in place if required
–– Evacuate the premises
Secondary Objectives
–– Mitigate the threat of emergency situations
–– Prevent a minor incident from escalating to major disaster
–– Speed return to normal operations
–– Familiarize employees and staff members with procedures to follow in the
event of an emergency
–– Protect environment
–– Determine unsafe or hazardous conditions
–– Coordinate mitigation vendors and contractors
Scope
The emergency response plan policy should apply to all of your facilities and
locations.The individual plans are customized to the particular issues and con-
ditions at each location.Teams at each site should define, approve, and imple-
ment an emergency response plan, which includes essential activities, proce-
dures and tasks necessary to ensure an effective response.
Plan to survive and thrive. Give your group a roadmap through chaos. Ulti-
mately, a preparedness plan allows everyone to focus on doing instead of
deciding what to do.Your investment in preparedness will yield significant
benefits in saving lives and protecting your business. Disasters often present
unexpected opportunities to leverage planning into competitive advantages in
your market.

III. RISK CHECK SURVEY
The Risk Check Survey quantifies the degree to which an organization’s policies, programs,
and training focus on protecting the organization in a disaster or business interruption. Our
goal has been to provide tools to overcome inertia and provide practical and meaningful solu-
tions for crisis management and business continuity.
In an attempt o achieve this end we have prepared this risk check survey for our clients.This
survey brings a practical eye to our current risk exposures, presented in a manner that is easily
understood by managers and employees across all critical organizational processes.The sur-
vey results offer a brief but solid expression of your current state of preparedness.
Having completed your review of the pertinent issues and our description of best practices, we
invite you to complete this survey and consider your position in the planning continuum.
_________________________________________
ORGANIZATION NAME
_________________________________________
DATE
_________________________________________
PERSON COMPLETING SURVEY
_________________________________________
TITLE
EFFECTIVENESS RATING
The Effectiveness Rating describes the effectiveness or success of the organization’s actions.
1 ---------------------- 2 --------------------- 3 --------------------- 4 --------------------- 5
NOT
EFFECTIVE
MARGINALLY
EFFECTIVE
MODERATELY
EFFECTIVE
EFFECTIVE HIGHLY
EFFECTIVE
RATING
1. We annually review our changing risks with our insurance agent or broker.
COMMENTS:
2. We perform a critical process analysis to identify the internal and external resources required by our
department/business functions at least annually.
COMMENTS:
3. We constantly update our contact points and methods for staff, suppliers and clients/customers.These
updates are distributed throughout the organization and verified with various staff members.
COMMENTS:

4. Management and staff have defined roles and responsibilities during a disaster or business interruption.
COMMENTS:
5. We have identified a designated media spokesperson for the organization. All staff has been trained to
refer all media questions to that spokesperson.The spokesperson is equipped with a fact sheet about the
organization for quick distribution.
COMMENTS:
6. We have outlined and posted evacuation routes throughout our property(ies).
COMMENTS:
7. The location of all utility shutoffs are clearly marked and kept accessible; staff responsible for utility shut-
offs are aware of the locations and understand the mechanics involved.
COMMENTS:
8. We have identified all critical vendors, suppliers, contractors and created contingency plans in the event
those vendors or suppliers are unavailable.
COMMENTS:
9. We have identified critical equipment and supplies unique to our business, and have established mutual
aid agreements with neighboring businesses/organizations to secure those services, if necessary.
COMMENTS:
10. We regularly test and maintain our emergency generator, keeping an active log of those tests.
COMMENTS:
11. We have identified our critical energy needs should we require additional power beyond that provided
by our emergency generator. We have installed the required transfer switch to accommodate additional
power sources as required.
COMMENTS:
12. We have a well-documented physical asset list identifying equipment, make, model, serial #, installation
date, maintenance dates, original cost, replacement cost and photos.
COMMENTS:
13. All electronic data is backed up to an off-site server daily. Staff is trained on how to restore that data. Soft-
ware programs are secured and available to be re-installed as necessary.
COMMENTS:
14. Critical paper documents are stored in fireproof cabinets and in areas safe from flooding or other damage.
There are electronic backups of all paper documents.
COMMENTS:
15. We understand our computer figurations and requirements so that we can transfer our data operations to
a temporary configuration, if necessary.
COMMENTS:

16. We regularly exercise basic evacuation procedures keeping a log of those tests/exercises and review “les-
sons learned” from each.The “lessons learned” are incorporated into our disaster plans.
COMMENTS:
17.
We utilize an emergency notification system to contact staff, clients and vendors/suppliers or contractors
as well as identified communication methods in the event cell towers or telephone landlines are down.
COMMENTS:
18.
We routinely review our property risk and procedures with local public safety personnel.
COMMENTS:
19.
We utilize a Knox-Box or an electronic methodology to provide critical data and access for first responders.
COMMENTS:
20.
We maintain a record of all hazardous materials on-site, by type, quantity and location.This list and all
Material Safety Data Sheets are shared with emergency responders.
COMMENTS:
TOTAL
SURVEY RESULT: RISK CHECK INDICATOR
The combined total rating from the Risk Check Survey is your organization’s Risk Check
Indicator (RCI).
My RCI is TOTAL .
The Risk Check Indicator represents the following:
95 + OUTSTANDING Your organization is an industry leader in how this category of risk is
managed.
90 – 94 VERY GOOD Your organization is performing at a superior level yet seeks further
opportunities to achieve best practices.
86 – 89 GOOD Your organization needs to elevate the management of risk with the
goal of achieving best practices.
83 – 85 ACCEPTABLE Your organization needs to enhance the management of this risk.
80 – 69 AVERAGE Your organization needs to address this risk with a sense of urgency.
Key priorities must be identified. Emphasis should be placed on the
Risk Check Survey results.
> 60 POOR Serious compliance and potential legal liability exposures exist.
Immediate actions should be taken.

IV. BASIS FOR QUESTIONS
Below you will find thumbnail summaries of the salient issues addressed by the questions in
this risk check survey. Hopefully these comments will encourage you to make a more critical
review of your current state of preparedness.
QUESTION 1
“We annually review our changing risks with our insurance agent or broker.”
Your insurance agent or broker should be an integral part of your business continuity planning
process, reviewing specific details at least annually. Encourage your agent or broker to partici-
pate in exercises related to the system and involve them in meetings with the disaster restora-
tion contractor and other key service providers that you choose.
QUESTION 2
“We perform a critical process analysis to identify the internal and external resources
required by our department/business functions at least annually.”
Use a well-developed process questionnaire to help identify all of the critical components of
your business and how they function together.This process will help identify priorities for how
and when functions need to be restored, along with the resources needed for each function.
QUESTION 3
“We constantly update our contact points and methods for staff, suppliers and clients/
customers.These updates are distributed throughout the organization and verified with
various staff members.”
Staff changes are some of the most common, but often overlooked, updates needed for any
type of disaster plan. Changes need to be made in everyone’s phone book, plan and emergen-
cy response list. It’s often not enough to send an e-mail with an update.To ensure the proper
information has been updated, it will be need to reviewed routinely. Consider using a checklist
test to make sure key information is updated and accurate for everyone involved in your plan.
QUESTIONS 4–5
“Management and staff have defined roles and responsibilities during a disaster or busi-
ness interruption.“

“We have identified a designated media spokesperson for the organization. All staff has
been trained to refer all media questions to that spokesperson.The spokesperson is
equipped with a fact sheet about the organization for quick distribution.”
It is important that everyone can jump immediately into action for the roles they have been
assigned (i.e. coordinating evacuation, investigating the source of the problem, speaking with
media and making sure utilities are shut off) in an emergency situation.The roles need to be
well defined and practiced in advance. Don’t wait for an emergency to establish role definition.
QUESTION 6
“We have outlined and posted evacuation routes throughout our property(ies).”
Evacuation maps need to be posted and prominently displayed throughout the property. Mark
the locations of fire extinguishers and other life safety equipment as well as evacuation routes.
Create a monthly routine of confirming that the maps are current and prominently displayed.
QUESTION 7
“The location of all utility shutoffs are clearly marked and kept accessible; staff respon-
sible for utility shutoffs are aware of the locations and understand the mechanics in-
volved.”
Utility shutoff locations and instructions are a critical part of any continuity plan. Instructions
need to be specific and staff needs to be trained on how to operate the controls. Identify areas
of the facility serviced by different utility meters, if applicable. Include in your plan any equip-
ment needed to shut off utilities, such as a ladder or specific tools.
QUESTIONS 8–9
“We have identified all critical vendors, suppliers, contractors and created contingency
plans in the event those vendors or suppliers are unavailable.”
“We have identified critical equipment and supplies that are unique to our business, and
have established mutual aid agreements with neighboring businesses/organizations to
secure those services, if necessary.”
Key vendors and service suppliers are often spread very thin during a disaster. It’s important
to have alternates already identified before the need arises. Vet vendors and subcontractors
based on experience, insurance coverage, references, pricing and contracts.
Specialized equipment necessary for your business may not be readily available to replace if

severe damage has occurred.Talk with your vendor or service contractors to determined if oth-
er businesses may be using the same equipment, and establish agreements for use in advance
of an emergency. Identify the cost of use and time restraints around your use as appropriate.
QUESTIONS 10–11
“We regularly test and maintain our emergency generator, keeping an active log of
those tests.”
“We have identified our critical energy needs should we require additional power be-
yond that provided by our emergency generator. We have installed the required transfer
switch to accommodate additional power sources as required.”
The most frequent business disruption is power outages, averaging 17% of total disruptions.
Power is at the heart of it all. Most buildings, if they have emergency generators, eventually
realize that they typically only support minimal emergency lighting and very few other pieces
of equipment. Do a brief analysis of your most critical pieces, be it IT, phone, elevators, refrig-
erators, flood pumps, HVAC, etc.Then ask your electrician to calculate your total power needs
so you can make necessary arrangements for an on site generator or an accommodation for
utilizing mobile generators. Knowing what you need and having the switching equipment to
accommodate auxiliary mobile generators is essential to a smooth continuity of operations.
QUESTION 12
“We have a well-documented physical asset list identifying equipment, make, model,
serial #, installation date, maintenance dates, original cost, replacement cost, photos.”
A well-documented asset list is important for a number of reasons: if damaged, the proper
information can help speed procurement of the parts or replacement as necessary. It is also
a benefit in settling the insurance claim. When you can easily generate a list of assets and an
adjuster can more quickly review specifics about the assets lost, it can significantly impact
the timeline of the claims settlement.This list is not the same as the list kept for accounting
and tax purposes.The greater the level of detail accumulated, the more helpful it will be when
needed.
QUESTIONS 13–15
“All electronic data is backed up to an off-site server daily. Staff is trained on how to
restore that data. Software programs are secured and available to be re-installed as
necessary.”

“Critical paper documents are stored in fireproof cabinets and in areas safe from flood-
ing or other damage.There are electronic backups of all paper documents.”
“We understand our computer figurations and requirements so that we can transfer our
data operations to a temporary configuration, if necessary.”
Data is at the heart of every organization, and protecting it is the goal of business continuity
management. In today’s world, there are numerous ways of backing up and protecting elec-
tronic data.The methods need to be routine and tested.
Should your organization lose an operations center, be sure you have what you need not only
to restore your data, but to make that data operable on new equipment. Keep track of the in-
formation needed to reinstall programs as well as data, and don’t forget about the basic e-mail
and word processing programs in addition to any specialized programs.
Typically, there are original paper documents that need to be protected. Keep them safe and
identify their location. Create electronic backups in the event the originals are damaged.
QUESTION 16
“We regularly exercise basic evacuation procedures keeping a log of those tests/exer-
cises and review lessons learned from each.The lessons learned are incorporated into
our disaster plans.”
Business continuity planning is an on-going process. Keep in mind that the simplest incidents
(i.e. loss of power or a burst sprinkler line) can cause extensive disruption to your operations.
When reviewing, exercising and testing your plan, consider those smaller incidents. Lessons
learned from smaller disruptions will improve your response to more broad scale emergencies.
QUESTION 17
“We utilize an emergency notification system to contact staff, clients and vendors/
suppliers or contractors, and have identified alternate communication methods in the
event cell towers or telephone landlines are down.”
Consider staff, vendors, tenants and others who will need to be advised of the situation, even
if they’re not immediately involved in handling the disruption. Emergency notification systems
are an effective tool for disseminating information quickly to a number of people.There are a
number of systems in the market today for very reasonable fees that can disperse prerecorded,
customized messages via multiple avenues of reach and maintain a perpetual log of to whom,
how and when the message was received.These records help limit liability and improve ac-
countability throughout the organization.

QUESTIONS 18–20
“We routinely review our property risk and procedures with local public safety personnel.”
“We utilize a Knox-Box or an electronic methodology to provide critical data and access
for first responders.”
“We maintain a record of all hazardous materials on-site, by type, quantity and location.
This list and all Material Safety Data Sheets are shared with emergency responders.”
Do not hesitate to invite public safety officials to your site to have them familiar with your
facility(ies) and systems.The more complex your facility(ies), the more often they should be
invited.You want to give the officials the best possible chance for success when the need for
their services is required. Familiarizing them with access issues, alarm systems, life safety sys-
tems and building contents will help them do their job most effectively when needed.
Prepare in advance for the information first responders need when responding to an emergen-
cy. A Knox-Box is an efficient way to store that information. Make sure the floor plans, evacua-
tion routes, list of those who may need help evacuating and locations of hazardous materials
are routinely updated.

V. RESOURCES
“Basic Disaster Planning Concepts For Small Business” Ezine Articles
http://ezinearticles.com/?Basic-Disaster-Planning-Concepts-For-Small-Business&id=3627314
“Disaster Recovery: Confidence in Crisis (1 of 7),” Buildings Magazine, April 3, 2006
http://www.buildings.com/article-details/articleid/3049/title/disaster-recovery-confidence-in-crisis-1-of-7.aspx
“Emergency Preparedness and Response,” U.S. Department of Labor Occupational Safety and
Health Administration (OSHA)
www.osha.gov/SLTC/emergencypreparedness/index.html
“Emergency Preparedness Checklist for Small Businesses,” Buildings Magazine, November 1,
2007
http://www.buildings.com/article-details/article-details1/articleid/5395/title/emergency-preparedness-checklist-for-small-businesses.
aspx
“Evacuation Planning,” Buildings Magazine
http://www.buildings.com/article-details/articleid/3562/title/evacuation-planning.aspx
“Using Social Media in Crisis Communication,” Ezine Articles
http://ezinearticles.com/?Using-Social-Media-in-Crisis-Communication&id=7329375
American Red Cross
www.redcross.org
American Society for Industrial Security (ASIS)
www.asisonline.org
American Society of Safety Engineers (ASSE)
www.asse.org
ASIS International
www.asisonline.org
Association of Contingency Planners
www.acp-international.com
Before and After Disaster Strikes: Developing an Emergency Procedures Manual,
Fourth Edition,The Institute of Real Estate Management, 2012
Business Continuity Guidelines: A Practical Approach for Emergency Preparedness,
Crisis Management, and Disaster Recovery
Business Continuity Institute
www.thebci.org

Business Continuity Planners Association (BCPA)
www.bcpa.org
Centers for Disease Control and Prevention
“Emergency Preparedness & Response”
www.bt.cdc.gov
http://www.cdc.gov/niosh/topics/emres/business.html
Department of Homeland Security/Emergency Response Directorate
www.dhs.gov
Department of Justices/Office for Domestic Preparedness
www.ojp.usdoj.gov/odp/
Disaster Preparedness (Small Business Administration)
www.sba.gov/services/disasterassistance/disasterpreparedness/index.html
Emergency Evacuation Planning Guide for People with Disabilities
Emergency Management Accreditation Program (EMAP)
www.emaponline.org
Emergency Management Guide for Business & Industry: A Step by Step Approach to Emergen-
cy Planning Response and Recovery for Companies of All Sizes, FEMA 141, October 1993
http://www.fema.gov/pdf/business/guide/bizindst.pdf
Federal Emergency Management Agency
www.fema.gov
Federal Emergency Management Agency (FEMA)
www.fema.gov
Insurance Information Institute
www.iii.org
Insurance Services Office
www.iso.com
National Fire Protection Association (NFPA)
www.nfpa.org
National Fire Protection Association (NFPA)
www.nfpa.org
National Safety Council
www.nsc.org/preparedness

NFPA 1600 Standard or Disaster/Emergency Management and Business Continuity Programs
2004 Edition
Occupational Safety and Health Administration (OSHA)
www.osha.gov
Society for Human Resource Management (SHRM)
www.shrm.org
U.S. Small Business Administration (SBA)
www.sba.gov

Risk Check Survey

Recommended

Recommended

More Related Content

What's hot

What's hot (14)

Similar to Risk Check Survey

Similar to Risk Check Survey (20)

More from David Mistick

More from David Mistick (7)

Recently uploaded

Recently uploaded (20)

Risk Check Survey