Archive for September, 2008

Thinking of Texas at This Time

Thursday, September 11th, 2008
Annual Conference in Houston

Annual Conference in Houston

As the Gulf Coast of Texas mounts an evacuation in anticipation of Hurricane Ike, I am reminded of my last visit to that area. The occasion was a series of workshops I delivered on small business disaster preparedness for the Small Business Development Centers in San Angelo, El Paso, Laredo and San Antonio. It was a coming home of sorts for me because I was first introduced to the ASBDC network when I spoke at their annual conference in Houston in 2006. The local events in Texas were fantastic and attended by the mayors of the cities, the chiefs of police and fire services, presidents of the local Red Cross chapters, commissioner of public health and other officials. One of the points that was made very clearly was that over the course of a 30-year mortgage, you have a 26% chance of a flood versus a 9% chance of a fire. In addition, in any given year, 30% of the homes and businesses that flood are in areas that have never before experienced a flood. This is an alarming figure, because many homeowners and small business owners mistakenly believe that their insurance policies cover flood damage and they don’t (you have to purchase flood insurance separately).

This is a major source of concern for state insurance commissioners. I was recently interviewed on The Family Breakfast Show of WICC-AM to discuss flood risks for small businesses. The following day, the scheduled guest for the program was the insurance commissioner of Connecticut, as in the aftermath of Tropical Storm Fay, there is a need to educate the public about flood risks.

The other significant challenge that Texas faces is that for evacuees, all roads lead to San Antonio. At these workshops in 2007, emergency officials discussed the likelihood that as many as 1.5 million Texans may have to be evacuated from the Gulf Coast area in anticipation of a major hurricane. However, San Antonio has only 30,000 beds available in its entire hotel and hospitality industry. In Prepare for the Worst, Plan for the Best, I had discussed my work with Peg Callahan and Deidre Patillo of the San Antonio Small Business Development Centers. They are certainly in my prayers at this difficult time.

Baton Rouge Small Businesses Post-Gustav

Thursday, September 11th, 2008
This way to escape the hurricane

This way to escape the hurricane

On Monday, September 8, I was a guest on the Jim Engster program of WRKF, the National Public Radio Station in Baton Rouge. You can click this link if you would like to hear the podcast of the interview. The topic was what Baton Rouge small businesses need to do to accelerate their recovery from Hurricane Gustav. The following are the tips I discussed with Jim Engster:

1.    Rapid response is critical. Many small business owners will be in a state of shock and disbelief as a consequence of the disaster.  However difficult it may be, they must manage their emotions and work to restore operations as soon as possible. The choice is not whether to recover quickly or whether to recover at a more measured pace.  The choice is whether to recover quickly or not to recover at all.  A study of small businesses affected by the 1993 World Trade Center bombing found that of those businesses that could not restore operations within five business days, 90% of them were out of business within one year. Prioritize your business needs according to relative urgency and delegate where necessary.

2.    Mitigate your losses. To establish a valid property insurance claim, you must demonstrate to your insurer that you acted in good faith to mitigate your insured losses.  Consider a hypothetical example.  Let’s imagine that you have returned to your property and you see broken glass about the site. You must take reasonable steps to insure that people will not be injured by the broken glass.  Insurance companies are not very tolerant of passive policyholders who fail to act in their interests to limit losses. Limit subsequent losses to your business by taking prudent steps, such as restoring fire sprinklers or other equipment that may have been damaged by the storm.

3.    Identify your implicated policies. You should invest the time and effort required to examine all insurance policies implicated in the disaster, rather than foreclose options for coverage by limiting the scope of your review. Begin with insurance policies for first-party property losses that cover direct property damage, including collateral damage and indirect property damage, such as business interruption losses and loss-related expenses.  Next review all-risk policies, named peril policies, business owner’s policies, policies covering particular endorsements, valuable papers and records policies.

4.    Provide timely notice. Your business owner’s policy likely requires you to provide timely notice to your insurance company of covered losses.  Do not forfeit indemnification for a covered loss by failing to give timely notice. If you are in doubt as to whether an item is covered by your policy, err on the side of caution and include it in your claim.

5.    Report the facts, don’t diagnose the cause. Think of the words of Sergeant Joe Friday, “Just the facts, ma’am”.  Here is an example of why you should not be a diagnostician.  A sole proprietor worked from her home near the World Trade Center on 9-11 and experienced a systems crash.  She concluded that the crash was most likely due to the loss of electrical power that was the result of the terrorist attack and so notified her insurer.  Because her policy did not include an endorsement for interruption of electrical supply, that portion of her claim was denied.  In fact, the damage to her computer was the result of soot and ash clogging the fan of her computer, a peril that was covered by her policy.  The denial of coverage and dispute that followed could have been avoided had she sent a description of the problem without the diagnosis.  Had the insurance adjuster inspected the damaged computer, he would have seen the soot and ash in the machine and likely authorized payment on the claim.  Her hasty diagnosis resulted in a denial and delay of her claims payment.

6.    Inspect your IT and other electronic assets at least twice to ensure that you have not overlooked anything. I began hearing unpleasant grinding noises emanating from my PC when I returned to my office following the 9-11 disaster.  I suspect I had not heard them earlier because of the background noise outside my office as work was being done to restore electricity and other essential services. Upon closer examination, I learned that the noise signaled an imminent hardware failure. By inspecting each IT asset twice, I avoided the error of submitting an incomplete claims report.

7.    Document your loss mitigation and other loss-related expenses; your business owner’s policy likely covers them.  Such expenses might include overtime wages paid to employees who work to restore the business, lease payments for alternate office facilities when your primary space has been rendered unusable by the hurricane, costs of purchasing assets for temporary business use and so forth.

8.    Get help if you need it. You are likely to experience a range of emotions following a disaster, from disorientation to shock and disbelief to grief and mourning. This is not uncommon and may continue for some time after the disaster.  You won’t be able to look after your employees and family if you are run down.  Get the support you need.

9.    Assess your performance. Unfortunately, Gustav may not the last hurricane of the 2008 season.  Review your business contingency plan and, in particular, your employee training to identify areas for improvement so you will be better prepared for the future.  You can and will learn from this difficult experience.

10.    Exercise care when negotiating continued insurance coverage. Premium increases following a major disaster are not uncommon, but there are steps you can take to protect yourself.  In particular, be aware of the “paying more/getting less” phenomenon in which increases in insurance premiums can be dampened by excluding risks that had previously been covered. Also, be prepared to demonstrate to your underwriter the features of your business protection plan that make your business a better risk.

Dodging a Bullet, But Still Suffering

Thursday, September 11th, 2008
Appreciation from the Red Cross

Appreciation from the Red Cross

Having feared the worst, residents of Louisiana got a reprieve, of sorts, when Hurricane Gustav did not leave a trail of devastation comparable to that of Hurricane Katrina. This has caused problems of another kind; Gustav is still a serious disaster and residents in the affected areas are in need of assistance. But charitable giving has not kept pace with the need, in part because of distorted perceptions from catastrophizing risk. The fact that Gustav was not as powerful as Katrina offers little comfort to Louisiana residents living in emergency shelters until their power and other services are restored and they can safely return home. To meet the needs of those who have been displaced by Gustav, the Red Cross has taken on debt, in the hope that donor contributions are on the way (that report from the Washington Post).

On the occasion of my most recent visit to New Orleans, I was surprised with a Certificate of Appreciation from the Gulf Coast Recovery Director of the American Red Cross. This was an acknowledgement of the contributions that my own small business has consistently made over the past few years. I am currently working out the details of a promotion in which profits on the sale of my book will assist disaster relief efforts. I urge other small businesses to join in; helping the relief efforts is not only a worthwhile thing to do, it can be effective team and skill building for your own organization. This has been a tough year in the United States for major natural disasters; in addition, to a severe hurricane season, we have had tornadoes in the southern states, floods in the midwestern states and wildfires in California. The need is certainly there.

Louisiana Small Businesses Dare to Prepare

Thursday, September 11th, 2008
Louisiana SBDC Disaster Kit

Louisiana SBDC Disaster Kit

As residents of Louisiana anticipate the approach of Hurricane Gustav, I am reflecting on my most recent trip to the Louisiana Gulf Coast. The occasion was a series of “Dare to Prepare” workshops sponsored by the Louisiana Small Business Development Centers in mid-August. The workshops received very kind attention from the New Orleans Times-Picayune.  Participants in the workshops were given a number of takeaways, including a disaster kit. One of the participants in the second workshop in Slidell, Louisiana announced to the group that she had worked at 225 Broadway in Lower Manhattan on 9-11-01. Having lost her job, she moved to London and then re-joined her family in New Orleans to help with their business, just in advance of Hurricane Katrina. She and her sister were seated in the front row at the workshop, eager to share their experiences of disaster recovery and preparing for the next one. I cannot think of a better example of resilience and like all Americans, I am praying that Hurricane Gustav spares the Gulf Coast.

Greater New Orleans Small Business Sustainability Summit 2008

Thursday, September 11th, 2008

The third anniversary of Hurricane Katrina prompts me to reflect on the Greater New Orleans Small Business Sustainability Summit of 2008 in which I had participated earlier this year. New Orleans small businesses are dealing with issues that are all too familiar to us in Lower Manhattan: how do you reinvent your business to survive, and even thrive, in a completely new environment? How do you cope with the issues of disaster fatigue? How do you manage your frustration as you approach an anniversary date and reflect on how little progress has been made? The Summit provided a great forum for us to learn from one another.

Small businesses coming together at the Edgewater Baptist Church

Small businesses coming together at the Edgewater Baptist Church

On the one hand, it was remarkable to see how much we had in common. The recovery effort in New Orleans was impeded by the inability of the federal and state governments to agree to a common framework, and the constantly changing rules – a situation with which we in Lower Manhattan are all too familiar. Carmen Sunda, the Director of the New Orleans Small Business Development Center, took me on a tour of some of the affected areas. I have attached a few of my pictures. Even three years after Hurricane Katrina struck, the FEMA trailers and demolition signs are everywhere. And yet, I could see the resilience and commitment of those who participated in the small business neighborhood summit.

Notice the house markings

Notice the house markings

Demolition signs were everywhere

Demolition signs were everywhere

Back to Phoenix

Thursday, September 11th, 2008
Phoenix in June 2008 for the NAWBO annual conference

Phoenix in June 2008 for the NAWBO annual conference

Today, I participated in a radio interview with Ken Morgan and Julie Dougherty, the hosts of Business for Lunch, a program of Phoenix financial news radio station KFNN-AM. As we considered the needs of Phoenix small businesses, I shared with the hosts and their listeners that I had recently returned from Phoenix, the site of the 2008 annual conference of the National Association of Women Business Owners. Together with Erin Streeter of the Department of Homeland Security, I taught a workshop on helping NAWBO members prepare for the worst and plan for the best. Phoenix is blessed by geography, so it is easy to become complacent. But while in Phoenix, I learned of a business that learned the hard way to look beyond the obvious. This was a manufacturer of skin care products that relied on a sole supplier for a critical ingredient. That supplier was under eight feet of water in Iowa owing to the severe floods in the mid-western states. Although she was not directly affected by the disaster, she was indirectly affected – and may lose her business.

What could she have done differently? Her first step should have been to try to diversity her supplier base so she would not be critically dependent on a single supplier. I have, for example, all of my graphics files for letterhead, business cards and other marketing collateral with a printer in Sacramento. When my local printer could not deliver, I called Sacramento and implemented my backup plan. If this ingredient was so rare that she could not have found an alternate supplier, she should have sought contingent business interruption insurance to protect her business against this risk. I suspect that the cost of this additional coverage would have been relatively low.

Ken, Julie and I then talked about the issues around heat waves, a major risk in Phoenix. Did you know that heat waves cause more fatalities than any other natural disaster? If this is a risk for your business, be sensitive to the special medical needs of more vulnerable employees, customers or suppliers. Re-schedule your meetings with them when the temperatures will cool down or encourage telecommuting.

While in Phoenix, I also visited the team at the W.P. Carey School of Business of Arizona State University, who were kind enough to review the book. I look forward to returning to Phoenix. My radio interview with Ken and Julie was a nice break from what was otherwise a somber memorial date.

Illustrating a Lesson

Thursday, September 11th, 2008
Look carefully to see what is not obvious

Look carefully to see what is not obvious

I recently did a live radio interview with Tron Simpson of KCMN-AM in Colorado Springs, which took me back to my last visit to Colorado Springs a few months ago. The occasion was the annual small business awards luncheon hosted by the local Small Business Development Center. I was flattered to have been invited as the keynote speaker and after the luncheon, I led a three-hour workshop on small business disaster preparedness. I had been invited by Matt Barrett, the Director of the SBDC. Matt and Assistant Director Lisanne McNew were most gracious hosts. On my return home after the program, I had an experience that perfectly illustrates the concept of everyday disasters and the importance of having good processes in place.

My return flight departed Colorado Springs for Dallas-Fort Worth, where I had to make a connecting flight back to the New York City area. As we passed over Kansas, I heard a loud pop and the cabin rapidly lost pressure. Passengers became nauseated as we were jostled about in our seats like beans frying in a pan. Shortly thereafter, the pilot announced that we were returning to the airport in Denver where better aircraft maintenance facilities were available and, if necessary, alternate flight connections.  I had many hours in the airport terminal to make the acquaintance of my fellow passengers, as we had been instructed to remain in the gate area. Of course, everyone asked everyone else about the purpose of their travel and I mentioned my book and the event in Colorado Springs. Then one of the passengers who was seated next to the emergency exit door where the seal had broken (that was the “pop” we had heard) stated that he had suspected a problem as soon as he took his seat. He reported to the cabin crew that he could hear a hissing noise through the door. His concerns were dismissed. But as the aircraft pulled back from the jetway and towards the runway, the hissing sounds grew more ominous, particularly after takeoff as we gained altitude. In the context of the six disaster categories outlined in Prepare for the Worst, Plan for the Best, we all agreed that this was an example of equipment failure.

When I related the details to Stefan, he offered a different diagnosis. Stefan has a degree in Aerospace Engineering and he told me that aircraft always have multiple redundant systems to protect against the risk of a single failure. At least three things had to go wrong simultaneously with that flight in order to account for our experience. The risk of any single one occurring in isolation is small; the risk of all three striking simultaneously is negligible. Stefan diagnosed the problem as human error; the issue around the faulty seal should have set off an alarm in the cockpit. Perhaps the pilot was fatigued and did not notice. The pre-flight mechanical inspection should have surfaced the problem. It appeared that either the airline did not have proper procedures in place, which seems unlikely, or, more likely, the procedures were in place and they were not followed.

Garden of the Gods, Colorado Springs

Garden of the Gods, Colorado Springs

By the way, in case you are wondering about the photographs that accompany this blog post, I took them at a local site in Colorado Springs, the Garden of the Gods. Matt was kind enough to show me this beautiful natural setting when he drove me back to the airport. Matt spotted a deer, which sought to hide itself behind the trees, while I did my best to get a picture. If you look at the “V” shape between the main branches of the tree trunk, you can see the deer’s eyes, ears and nose. Sometimes you have to look very carefully to see beyond the obvious.

Two Thoughts From Pennsylvania

Thursday, September 11th, 2008

I learned a great deal from my participation in the “Building a Disaster-Resilient Small Business” workshop series of the Pennsylvania Small Business Development Center’s Environmental Management Assistance Program. The series consisted of three, three hour-workshops hosted by the Small Business Development Centers of Penn State University at State College, Bucknell University at Lewisburg and Duquesne University in Cranberry Township. T. David Filson and I facilitated each of the three workshops. Mr. Filson coordinates the emergency preparedness and response communications within the Penn State Cooperative Extension. Two issues, in particular, came up during the discussion that I want to share with you. The first concerns fire safety. Dave Filson spoke of how he had participated in group safety training with the local fire department in which each person had to demonstrate that he could put out a fire using the fire extinguisher. The fire fighter who taught the program would carefully start a fire in a controlled setting, giving the chance to learn in a safe environment.

The second issue that arose concerned the unique needs of union workplaces and work rules as set out in collective bargaining contracts. For those small businesses that work with unionized employees, you need to have clarity about what their work responsibilities will be, within the framework of their contract, during a disaster recovery operation. This is particularly important as the union work rules may limit the flexibility of the response to disaster-related needs that you cannot always anticipate in advance.

I thought I would post these comments so that workshop participants in other parts of the country could have the benefit of our discussions. I very much look forward to returning to Pennsylvania. I had wanted to visit a bit, but driving the entire width of Pennsylvania on the turnpike left me little time!

Critical Computer Systems Held Hostage

Thursday, September 11th, 2008

A recent incident that crippled the City of San Francisco teaches a lesson for small businesses

Recently, a network administrator employed by the City of San Francisco locked down the City’s computer network. By keeping a single password secret, Terry Childs (no relation to me!) denied access to IT administrators, thereby crippling important municipal functions, such as the City’s payroll and law enforcement records. After spending several days in jail and meeting in secret with San Francisco Mayor Gavin Newsom, he gave up the password and power has been restored. Subsequent investigation revealed that Mr. Childs was a disgruntled employee with a criminal record; he had been arrested for aggravated robbery 25 years ago in Kansas.

As we had advised in the first edition of our book,  “A good network administrator builds his or her reputation on trust that has been earned throughout their careers. But even with the best service administrator in your service, you must still protect against the risk of internal sabotage. These measures are not difficult to implement and should be welcomed by your network administrator as being in the best interest of the organization.” How can your small business avoid San Francisco’s experience of being held hostage by a disgruntled network administrator?

1.    Apply basic auditing methods. There are simple auditing methods that you can apply and review periodically, such as identifying who accessed which files, who generated which external network traffic and who sent a large number of e-mails or attachments to which addressee. You should, of course, inform your staff that activities on the IT network are monitored and the results of these activities are not matched with personal information unless there is a compelling reason to do so. Ask staff to refrain from storing personal information on company computers. These guidelines should be formalized in company policy.

2.    Automate independent backups. It is critical to back up your business data and certainly your network administrator needs to have access to the backups in the event it becomes necessary to retrieve data in the course of ordinary business or emergency. But always have one backup mirrored on a site to which the administrator does not have access. There are tools that can do this automatically at designated times during the day. This mitigates your risk of sabotage. If the City of San Francisco had such a system in place, the Mayor would not have been compelled to visit a saboteur in his jail cell.

3.    Outsource your e-mail service to a third-party provider.
I always advise small businesses to outsource their e-mail service to a third-party provider, as it is generally not cost-effective for them to manage these services in-house. This approach offers an additional benefit: it makes the e-mail system independent of internal systems staff, both reducing their work burdens and the opportunities for internal sabotage.

4.    Do not use any built-in “Administrator” accounts, but instead give two users administrative rights on the system. This way, each week those two people can independently monitor and audit suspicious activities on your network and system administrator tasks can be traced to their user identifications.

One of the key messages of Prepare for the Worst, Plan for the Best: Disaster Preparedness and Recovery for Small Businesses (Wiley, second edition, 2008) is that by preparing for the everyday disaster, you automatically build resilience for the more serious threat. No one wants to think about internal sabotage; it is deeply upsetting to imagine that your trust could be betrayed in such a manner. Thankfully, few of us will have to deal with this possibility. But what if San Francisco’s IT administrator had suffered an accident or a medical emergency (a statistically more likely outcome than the perpetration of sabotage)? The City’s IT systems would still be brought to a stand-still, without the solution of a jailhouse visit by the Mayor to retrieve the password. Restricting access to a single individual, no matter how apparently trustworthy, is not a good policy. Let your small business learn from the experience of San Francisco.

Welcome To My Blog, Pertinent Perils!

Friday, September 5th, 2008
Blogging on the run

Blogging on the run

Welcome to my new blog! This blog is the product of entrepreneurial inspiration! I am an entrepreneur and, on 9-11-01, my small business office was located in “Zone 1” of the World Trade Center. On that fateful morning, I was in the WTC when the planes struck the first tower. I safely exited the building and placed a cell phone call to my office and then to a friend who was on his way in from Brooklyn to meet me. I tried to reach him to advise him to turn around and go home, and, as it was not safe to be about, I did the same.

My home was located in the residential community in the shadow of the World Trade Center. I was in my apartment when the towers fell, in part, on my building. Then, together with my neighbor and his dog, I was evacuated by police boat across the Hudson River to New Jersey where I remained, homeless, for several months. I was allowed to return home once during this time to retrieve some clothing and other personal belongings. Mine was the only residential neighborhood evacuated, closed and placed under the control of the National Guard. Civil authorities allowed my office building to re-open on September 18, 2001, one week to the day later. This was largely because of the symbolic importance attached to re-opening Wall Street and the New York Stock Exchange. Had we been located a block in either direction, our re-opening would have been further delayed. Even so, we were without essential services for some time, such as electricity, land line telephone, gas, water, mail delivery and pedestrian access. I had to file insurance claims, deal with disaster relief agencies and programs and put into effect an environmental remediation of my office to remove the soot and ash.

I soon realized my experience was very unusual. Few small businesses in Lower Manhattan were prepared to work through such a major disruption. Ours was a statistical outlier in terms of preparedness. This is an accident of two unusual professional backgrounds. Prior to starting the business, I lived in Zurich, Switzerland where I was a senior executive of the world’s largest reinsurance company. Reinsurance companies are the ultimate providers of risk capital and so invest considerable effort in advising their corporate clients in respect of disaster preparedness, business continuity and risk management strategies. This background was of enormous help to me in responding to the consequences of what happened on 9-11.

I was doubly fortunate to have Stefan Dietrich as my business IT guru. Stefan has a doctorate in engineering and computer science and completed his post-doctoral training in computer science at Cornell University. He had contributed to the disaster recovery operations (and future business continuity planning) of Deutsche Bank in London following the bomb attack on Bishopsgate. He had me all set up with appropriate data backup, application access, an appropriate communications plan – you name it!

Few small businesses had the experience that would lead to our insight and so, after providing pro bono help to my fellow Lower Manhattan small business owners to aid their recovery efforts, we decided to write a book to share our expertise more widely and on a proactive basis. Not long after 9-11, I wrote a proposal for a book on the topic of small business disaster preparedness and recovery and one week later, that proposal was accepted. In 2002, John Wiley & Sons Inc. published Contingency Planning and Disaster Recovery: a Small Business Guide.

With weather-related and other disasters in the news, our topic continues to be timely and this summer Wiley published the second edition of our book, with 40% new material, under the title Prepare for the Worst, Plan for the Best: Disaster Preparedness and Recovery for Small Businesses. There has been particularly strong interest in the small business community for information about insurance for disaster exposures; hence, the title of my blog is “Pertinent Perils” which is reinsurance-speak for “relevant risks”.

I hope that with this blog and website we can build a community among small business owners to share best practices for disaster preparedness and recovery. With the events of 9-11, Hurricane Katrina and other major disasters, it seemed that no national learning was taking place. I am reminded of the Drew Barrymore movie 50 First Dates in which the leading lady suffers acute deficits in short-term memory such that every date she has with Adam Sandler requires that they start their relationship all over again. It is an amusing plot for an in-flight movie, but not very funny in real life. Learning the same lessons over and over again is unnecessarily costly, both in human and financial terms.

One of the challenges of entrepreneurship, which is also the one that I find the most rewarding, is that we have to become a Jill-of-all-trades. In the large corporate environment, roles and responsibilities are better defined in functional departments. When I worked in the reinsurance industry, for example, I never had to think about building a website or doing a p.r. campaign with the news media. Now I do and I see it as an opportunity to connect with others and to learn from them.

And I hope we will learn about the best as well as the worst of disaster practices. The new title of the second edition was intended to capture the lesson that disaster planning not only protects your small business against the downside, but it offers immediate, tangible benefits to your business even if disaster never strikes. I invite you to contribute to this blog and share what you can with the small business community.