Before you start preparing your business for a crisis, you must first understand what risks you are actually exposed to, what the probability is and what an event might mean for you. A risk analysis is very individual, because in addition to the objective risks, which should be relatively similar for businesses in a certain industry or region, it also plays a role, how vulnerable or risk-taking you, and your stakeholders, are. If your business model depends on the internet, a power failure is more likely to be a problem for you than for a brick and mortar shop. So your risk analysis is YOUR analysis. Take a good look at the different risk categories. You’ll probably discover things you’ve never thought about before. But with other threats, you may realize that there is nothing to worry about.
The risk analysis for your business should include the following areas:
- Risks associated with your business operations, e.g.
- Financial risks
- Liability risks
- Reputational risks
- Compliance risks
- Security / IT security breaches
- Health & Safety
- Natural hazards
- Climate, climate change, and extreme weather events
- Infrastructure failure or loss
- Industrial accidents and emergencies
- War / Terrorist attacks
- Public health
- Risks related to your person, or private life
The order has no meaning. We’re starting with your business operations, then turn to the environment. Think about each point: Does this category apply to my business? Is this a potential threat? What can happen? How likely is it? Would it affect us directly (e.g. as an acute danger to the health and safety of your team) or rather indirectly (e.g. by loss of traffic connections)?
If you or have more than one facility or work in different locations, e.g. in the office or while travelling, it may be useful to perform the risk analysis for each location. However, start today, with your headquarters or plant.
Risks associated with your business operations
Obviously, those are the threats you should already know or at least have a basic understanding of. Chances are, there are health & safety or compliance regulations in place you have to apply, so you would normally be aware of the major risks associated with your operations or business model.
For a full risk assessment, we look along your whole value chain. The guiding question being: What could possibly go wrong? A multi stakeholder approach may broaden your horizon and raise awareness for your safety culture. E.g., if a faulty product hurts a customer, do you consider it to be mainly a financial and reputational risk, or is the customer’s safety your main concern? You can find both approaches in business, and both are valid, but they can lead to different approaches when planning for an emergency. The former may let you focus on response to an incident, while the latter has the potential to make you improve your product so that nothing happens in the first place. Which does not free you from planning your response, because accidents happen and people make mistakes.
When you conduct your risk assessment, think about all processes and resources such as facilities, IT and technology infrastructure, markets, money, staff, customers, managers, communications, mistakes, sabotage, and plain, bad luck. Include everything in the first assessment before evaluating the potential impact and probability of a threat happening to your business. Make sure you use good data in combination with instinct, and not just your guts.
Natural environment / geology
First, we’ll look at the grounds in your location. Is it flat or mountainous? Are the mountains stable or do they come to collapses, landslides etc.? Do you live on the coast or inland? Are there lakes and rivers? If there are floods: Are they fast and violent, like a storm surge on the coast, or do they build up slowly and then linger for days, like some rivers have done in recent years? Where are the planned flood plains? Is there seismic activity such as volcanoes and earthquakes, and near the coast, seaquakes / tsunamis? Seismic activity can also be the result of mining, strictly speaking not a natural phenomenon, but possibly worth considering. Have sinkholes ever occurred in your region?
Climate / Extreme weather events
How is the climate overall? Which seasonal fluctuations are normal and predictable? Do phenomena such as drought and wind reinforce each other? This can lead to sandstorms and fires. Do extreme weather events such as tornadoes, heavy rain, lightning ice or hurricanes occur? Precipitation in its various forms can cause very different problems. A lot of snow puts weight on roofs and slopes and can lead to collapses and avalanches. On the other hand, a lot of rain can render roads impassable in a very short time and cause waters to overflow their banks.
Is climate change affecting your business, now or in the future? This may be especially relevant if you source material and goods in vulnerable regions.
Everything that moves goods and people: railways, ports, airports, stations and routes. Accidents can happen here at any time. Even if you are not directly involved, an accident can paralyze the means of transport for a certain period of time. Hazardous goods are transported and the hazardous substances can be released in an accident. You can also take energy, water, and communication infrastructure into account here, e.g. the proximity of barrages or dams. Note that this category refers to hazards around your business. If you are an airline, loss of an airplane is a risk in your business operations.
You should also consider the other companies at your location. Accidents can happen in production or in the service sector, in which local residents can be injured. A high density of industrial companies usually goes hand in hand with an equally high density of transport routes (see above). As cities and/or companies grow, residential areas, factory premises and stables may move closer together, increasing the risk of being directly affected in the event of an accident. How far away from your office is the nearest nuclear power plant?
War / Terrorist attacks
Objectively speaking, this is certainly one of the most unlikely events for us. Nevertheless, many are afraid and even unlikely events can happen. Furthermore, you may be travelling in parts of the world where the risk is much higher. The most probable scenario in this category in my homeland, Germany, however, is that during construction work or a water depression in a river, an unexploded bomb from World War II is found and you are evacuated from your home because of the defusing.
In your area, the risk may be different. Pay attention to information provided by your government.
Other public health hazards
Apart from all the damage it can cause to you or your staff in one of the emergency situation above, epidemics and pandemics are the most common threats. These are limited or not so limited outbreaks of infectious diseases. Right now, we are in the middle of a global pandemic. While some politicians seem utterly surprised, Bill Gates is sometimes referred to as having predicted the Corona outbreak. Both is false.
No politician can be surprised, and literally everybody within the field of emergency planning and preparedness was aware of the threat of a pandemic. Governments who were unprepared simply focused on other threats. It’s always easy to consider a decision poor judgment in hindsight. But we can never prepare for every single threat. That would be a waste of resources, if it wouldn’t exceed the available resources anyway. We cannot predict the future. Sometimes, making an informed guess where to put the money and where not (yet) is the best we can do.
Back to our assessment of your organisation’s environment: Pathogens can be released intentionally or unintentionally, but usually an endemic (naturally occurring) disease suddenly spreads. In our networked world, diseases can travel from one end of the world to the other in a matter of days via the various transport routes. And there you have a pandemic.
All other possible hazardous substances, biological, chemical and physical, could occur naturally as well as being released in an accident or intentionally. You may have considered this option for war and terror. Think also about food poisoning or animals that can be dangerous to you or your staff.
Threats in your personal life
Your personal situation is not the first thing that comes to mind when conducting a risk assessment for your business. But whatever affects you as the business owner – or maybe even the only person in your business – has the potential to affect your business, too.
Most people are first and foremost afraid that something will happen to those they love and that they will not be able to cope with it. But you, too, can get sick or have an accident. What happens if you can no longer work and run your business? What is your job and who else can do it? Do you have a hobby where something can happen to you? How do you estimate your risk of becoming a victim of a crime? Men probably think of other crimes than women. What about care responsibilities, family planning, or ‘corpses in the basement’ that can be used against you?
And now: Relax!
No one can make the decision for you for which risks you really want to prepare yourself and your business, above what the law requires. That decision depends, among other things, on the overall situation, the presence or absence of public support structures, your willingness to take risks or whether you bear responsibility for other people. Start with what you yourself consider the highest risk or what you are most afraid of. A realistic assessment and good preparation have a calming effect and help to overcome the crisis in an emergency.
Should you have become panicky after your risk analysis and are now imagining catastrophic scenarios: this will pass. It is similar to the proverbial medical student who, in the first semester, has all the diseases herself. Realize how fascinating the interaction in nature and between nature and technology usually is. How fantastic everything works! Take a walk. Take a deep breath in and out. Notice how the soles of your feet make contact with the ground as you roll from heel to toe. Look up into the blue sky. Enjoy the colours. Listen. Everything is perfect right now.
If you want to get deeper into planning for emergencies in your business, check out our Disaster Preparation Intro course. This 4-week online course will introduce you to the full emergency management cycle and help you start your planning process.
Of course we are also available for individual consulting projects or coaching calls to discuss your risk assessment. We are here to help you kick drama out of your life and business!