The 40% That Never Reopen
Forty percent of businesses do not reopen after a disaster. Another 25% fail within one year. FEMA data reveals that business continuity isn’t about technology recovery. It’s about organizational survival.
Backups protect data. Continuity protects the business. The distinction matters because organizations that confuse the two rebuild servers while their customers leave, their employees scatter, and their operations collapse.
The Human Continuity Gap
Sixty-five percent of Business Continuity Plans focus exclusively on data restoration. They ignore human continuity: how people work when systems fail.
| Continuity Dimension | Typical Coverage | Actual Importance |
|---|---|---|
| Data backup and restoration | High | High |
| System recovery procedures | High | High |
| Alternative work locations | Medium | High |
| Employee communication chains | Low | Critical |
| Customer communication plans | Low | Critical |
| Vendor coordination | Low | High |
| Decision authority delegation | Very Low | Critical |
The server recovers in four hours. But employees don’t know where to report. Customers can’t reach anyone. Vendors don’t know whether to continue shipments. The technology works. The business doesn’t.
Process Dependency Mapping: The Missing Foundation
Half of continuity plans lack process dependency mapping. They document systems. They don’t document what happens if the system that runs payroll goes down the day before payday.
Process dependency mapping asks different questions:
What business processes depend on this system? Not technical dependencies. Business workflow dependencies.
What manual alternatives exist? If the ordering system fails, can orders be taken by phone? Who knows how?
What downstream processes fail? If this system stops, what else stops working within hours? Days?
What upstream processes must continue? If this system is down, what inputs queue up until recovery?
The mapping produces action items that backup strategies never reveal. Training on manual procedures. Stockpiling of paper forms. Communication templates for customers.
The Decision Authority Vacuum
Disasters create decisions that normal authority structures can’t handle. The CEO is unreachable. The office building is inaccessible. Normal approval workflows don’t function.
Continuity plans must address decision authority:
Succession of command. Who decides if the primary decision-maker is unavailable? How deep does the succession go?
Emergency spending authority. Who can approve emergency expenditures? What limits apply?
Customer commitment authority. Who can modify delivery timelines? Who can issue credits?
Employee authority. Who can authorize overtime? Who can hire temporary staff?
Vendor authority. Who can expedite orders? Who can switch suppliers?
Without predefined authority, decisions queue behind unavailable approvers while damage accumulates.
Testing Cadence: The Discipline That Separates Survivors
Continuity plans require testing. Not just reading the document. Exercising the procedures.
| Test Type | What It Validates | Recommended Frequency |
|---|---|---|
| Document review | Plan completeness and currency | Quarterly |
| Tabletop exercise | Decision-making and coordination | Semi-annual |
| Walkthrough test | Physical procedures and locations | Annual |
| Functional test | Actual system failover | Annual |
| Full-scale exercise | Complete organizational response | Bi-annual |
Each test tier catches different problems. Document reviews catch documentation gaps. Tabletop exercises catch coordination failures. Full-scale exercises catch reality.
Organizations that only perform annual tests discover problems during actual disasters rather than during tests.
The Communication Chain Problem
During disruption, communication becomes critical. Normal channels may be unavailable. Email servers are down. Office phones don’t work. The communication chain must function independently.
Effective communication chains include:
Multiple channels. Not just email. Personal cell phones. Text messaging. Emergency notification systems.
Out-of-band contact. Home addresses for employees who can’t be reached electronically.
Cascade protocol. Who contacts whom. Time limits before escalation.
Message templates. Pre-written messages for common scenarios. No wordsmithing under stress.
External stakeholder lists. Customer contacts. Vendor contacts. Regulatory contacts.
The chain requires testing. Annual call tree exercises verify that contact information remains current and that the cascade functions.
Remote Work Continuity: The Post-2020 Requirement
The pandemic demonstrated that most organizations can operate remotely. It also revealed capability gaps:
Home equipment. Do employees have adequate home equipment? Laptops? Monitors? Network connectivity?
Remote access capacity. VPN infrastructure sized for 20% remote work fails at 100% remote work.
Collaboration tools. Do employees know how to use remote collaboration tools effectively?
Security posture. Does remote work maintain security standards? Home networks are less controlled than offices.
Management capability. Can managers effectively lead distributed teams?
Continuity plans must incorporate remote work readiness. The assumption that employees can simply “work from home” requires infrastructure and training to support.
The Vendor Continuity Blind Spot
Your continuity depends on vendor continuity. If your critical supplier can’t deliver, your recovery stalls.
Vendor continuity assessment should address:
Critical vendor identification. Which vendors does your operation require? Not just IT vendors. All vendors.
Vendor BCP review. Do critical vendors have continuity plans? Have they been tested?
Alternative supplier identification. If primary vendor fails, who’s the backup? Is the backup relationship established?
Inventory buffers. For physical goods, what inventory exists to bridge vendor disruption?
Contract provisions. Do contracts address vendor continuity? Force majeure clauses? Termination rights?
The 2021 supply chain disruptions revealed that most organizations had never assessed vendor continuity. The lesson cost billions.
MSP Continuity Obligations
Your MSP is a critical vendor. Their continuity is your continuity.
| MSP Continuity Element | What to Verify | Why It Matters |
|---|---|---|
| MSP's own BCP | Does it exist? Tested? | MSP failure cascades to you |
| Staff redundancy | Key person coverage | Single points of failure affect you |
| Geographic distribution | Multiple locations | Regional disasters don't disable them |
| Data redundancy | Off-site backup of your data | MSP facility loss doesn't lose your data |
| Communication plan | How they reach you during their crisis | You need to know status |
| Client priority | Where do you rank? | During their crisis, who gets attention first |
Request your MSP’s BCP documentation. Review it. Ask about testing. The MSP that resists transparency about their own continuity may not survive to support yours.
The Insurance Gap
Business interruption insurance provides financial cushion. It doesn’t restore operations. Understanding coverage limits informs continuity planning.
Waiting periods. Coverage doesn’t begin immediately. 24-72 hour waiting periods are common.
Coverage caps. Daily and aggregate limits may fall short of actual losses.
Documentation requirements. Claims require detailed records. During crisis, documentation often suffers.
Exclusion scrutiny. Carriers look for reasons to deny. Did you follow your documented procedures?
Insurance supplements continuity planning. It doesn’t replace it.
The Continuity Investment Calculation
Continuity investment should correlate with disruption cost. A business losing $100,000 per day of downtime should invest more than one losing $10,000.
Disruption cost per day. Lost revenue, extra expenses, customer defection, regulatory penalties.
Probability of extended disruption. Historical incident rates, geographic risk factors.
Recovery capability gap. Difference between current recovery time and target recovery time.
Investment to close gap. Cost of additional redundancy, testing, training.
The calculation often reveals that continuity investment delivers strong return compared to disruption cost. The challenge is that the return only materializes when disaster strikes.
Building Continuity Culture
Continuity plans fail when they exist in documents but not in organizational culture.
Regular awareness. Employees should know the plan exists and understand their role.
Integrated exercises. Continuity testing shouldn’t feel like extra work. Integrate with normal operations.
Lessons learned integration. After any disruption, however minor, update the plan.
Leadership visibility. Executive participation in exercises signals importance.
The organization that treats continuity as an annual checkbox will perform like an organization that treats continuity as an annual checkbox.
Sources
- Business survival rates after disaster: FEMA
- BCP focus areas and gaps: Forrester continuity research
- Process dependency mapping rates: Business continuity industry surveys