It’s easy for disaster planning to fall by the wayside when your nonprofit is focused on pursuing its mission. But taking the time to prepare now can help you avert mission-threatening consequences later. From hurricanes, wildfires, active shooters and cyberattacks — to events as seemingly minor as a burst pipe — your operations are vulnerable.

4 risks areas

The first step to effective disaster planning is to conduct a risk assessment. This can seem a daunting prospect, particularly for larger nonprofits, but breaking it down into discrete components can simplify the process.

1. Evaluate your facilities. Review structural integrity, including the elevators and fire suppression, water, gas, telephone and electrical systems. Consider, too, each facility’s location — for example, do the traffic, crime levels or neighbors pose any threats?
2. Review needed operations. The main goal in disaster planning is to ensure that you can return to full operations as soon as possible. To that end, identify the equipment, information and people that are essential and at risk. For example, how would a lengthy power outage affect your operations? What are your staff’s critical functions? Is there sensitive information or inventory that would need to be recovered? Are certain supplies required?
3. Ensure access to data. Digital data lies at the heart of many organizations, and you may house much of it on cloud storage. Ideally, you’ll still have access after a disaster. Nonetheless, think about backing up cloud data for an extra layer of protection. Also make sure that you have digital copies of your organization’s important documents — for example, your articles of incorporation and IRS determination letter — that might be on paper. You’ll also need access to contact lists, banking and financial information, insurance documents, and similar records that might reside outside the cloud.
4. Prepare a crisis communication plan. You may need to reach out to media, clients and vendors with urgent messages. What would a press release look like and where should it be released? Will clients need backup services while you’re unable to provide them?

Steps to mitigate risk

Once you’ve identified risks, take a two-pronged approach to addressing them:

1. Do what you can to reduce your exposure, and
2. Plan your response to the risks that remain.

For example, purchasing a backup generator could support full operations or at least key functions if you experience a power failure. If you rely on specific suppliers, make plans with other vendors in case your usual sources aren’t available. You generally can maintain “active” status with a vendor merely by placing occasional orders. You also should dual-train staff for vital functions so that a single employee’s unavailability doesn’t undermine operations.

Insurance plays an important role in reducing exposure, too. Review coverages with your insurance broker and fill any gaps with, for example, cyber or business interruption policies.

What to do after a disaster

You can’t eliminate every risk, of course. For those that remain, plan for how you’ll respond in the immediate aftermath. Establish an emergency response team composed of several employees. This team should:

• Develop an emergency response manual that describes roles and assigns responsibilities,
• Map evacuation routes,
• Prepare a crisis communications plan including a phone or email tree for contacting employees and clients, and
• Identify alternative worksites and partnerships for continuing operations in case your facilities are disabled.

An often-overlooked resource at this stage is first responders. Don’t let your first contact with emergency help come in the frenzy of a crisis — reach out to the police and fire department pre-disaster. The first responders’ suggestions can make for a smoother response in an actual emergency.

And finally, your emergency response team should reevaluate your organization’s risk assessment and response plan frequently. Adjust your plan as needed.

Time to prepare

No organization today, nonprofit or otherwise, can afford to ignore the possibility of a natural or manmade threat that undermines operations. While some disasters are unpreventable, you nonetheless can reduce the repercussions by preparing now.

© 2023