When the hurricane season ends in November, several housing authorities will breathe a sigh of relief.

Although there were only a few hurricanes this season, housing authorities should ask themselves if they were prepared for a disaster and could they continue their operation if one occurred.

Forty percent of businesses do not reopen their doors after a crisis. Millions of people depend on housing authorities every day and can not afford to have their housing authority close its doors. A Business Continuity Plan must be established to help avoid such closings.

A Business Continuity Plan (BCP) is an ongoing process supported by senior management. It must be funded to ensure that necessary steps are taken to identify the impact of potential losses, maintain variable recovery strategies and plans, and ensure the continuity of operations through personnel training, plan testing, and maintenance.

The following points are the keys to developing a plan:

• Assign Accountability: Senior management of the Authority must take responsibility for creating, testing, and implementing the Business Continuity Plan. It is essential that senior leadership engages in a “top-down” management approach to the BCP so that all levels of staff understand that the BCP is a management priority.
  
• Perform a Risk Management Assessment: A group of individuals representing various departments should identify the types of risk that may impact the authority. Once the risks have been identified, the impact of a crisis should be examined in a Business Impact Analysis.
  
• Conduct a Business Impact Analysis (BIA): A management-level analysis that identifies the impact of losing the entity’s resources is necessary. The analysis measures the effect of resource loss and escalating losses over time in order to provide reliable data upon which to base decisions on mitigation, business continuity strategies, and recovery.
  
• Agree on Strategic Plans: Multiple strategies must be agreed upon to address a variety of probable situations. These situations may include the extent of the interruption (partial versus complete), the duration of business interruption (short- versus long-term), and the period in which it occurs (peak versus low). The strategies must be attainable, cost effective, appropriate for the size and scope of the authority, and practiced through tests and exercises.
  
• Crisis Management and Response Team Development: A Crisis Management Team should be established to lead the crisis response. The team should be comprised of members from the human resources, information technology, facilities, security, legal, communications/media relations and other critical support departments. The Crisis Management Team needs to be supported by as many Response Teams as deemed appropriate. Consider the authority’s size, number of employees, and location when determining the appropriate number of Response Teams. These teams should develop plans to address aspects of potential crises, such as administrative support, damage assessment, site restoration, displaced residents, and payroll. The members of the Response Teams should be chosen for membership based on their skills, vested interest, and commitment.

Once the authority’s Business Continuity Plan is established, it should be tested and exercised for effectiveness. The plan should be practiced around a “worst case scenario,” so that the response may be scaled down to match the actual crisis. The plan should also be modified so that it grows as the authority grows. Maintenance should be done on the BCP when lessons are learned from testing, personnel changes, changes to external environment (new roads or acquired properties) or issues discovered during the actual implementation of the plan in a crisis. Hopefully the Business Continuity Plan will not have to be implemented, but at least your authority will be prepared in the event of a crisis.

Please consult your Risk Control Representative or NFPA 1600 if you have any questions concerning Business Continuity Plans.