Skip to main content
Certified Public Accountants
Back to News

11 Simple Steps for Creating a Disaster Recovery Plan for Your Small Business

By: Andy Prescott, CPA
Varney & Associates, CPAs, LLC

According to the Federal Emergency Management Agency, 40% of businesses that experience a disaster never reopen and another 25% fail within a year.  The extra trouble of going through a disaster along with the lost income from the time a business can’t operate make it hard for a small business to keep going.  To give yourself the best chance to keep going in the event of a disaster it is important to think through what you will do before the disaster hits so that you will have a clear plan on what to do.  Starting with these 11 steps will help you develop that plan.

Step 1- Know your risks

Think about what could possibly go wrong.  There are lots of things that could go wrong depending on where your business is such as tornados, floods, electrical outages, ice storms, hurricanes, earthquakes, nuclear disasters, terrorists attacks, or volcanoes. 

While (hopefully) not all of these are a concern for you it is important to consider exactly what could go wrong as you think through the rest of these steps and make sure you have a plan for addressing whatever disaster might happen to you.

Step 2- Backup your computer systems

If you were to lose all the computers in your office you wouldn’t want to lose all the data that was on them as well.  You should make sure your information is available to be recovered at all times.  There are a couple of different ways to do this.

The easiest way to backup your data is through cloud computing. Cloud computing means that your software and information is not actually kept on your local machines, but is kept and processed somewhere out on the internet.  If you use cloud computing programs then disaster recovery is a breeze.  Just get a new computer, get internet access, and you are ready to go.

Offsite backups are another easy way to backup information, but can be more expensive.  You can talk about to your computer/network vendor about how to have the information stored on your local machines automatically sent over the internet to another location.  In the event that local information is lost, it can simply be downloaded back to your local computers and restored.

Manual backups are the most basic way of backing up your data, but require you or your employees to be diligent about making sure this procedure is followed on a regular basis.  When you do a manual backup, you write all of the data on your computers or servers to another device such as a backup tape, external hard drive, DVD, or USB drive depending on exactly how much information you have to store.

Step 3- Keep your backed up information far away from your business

Going to all the trouble of backing up your information doesn’t do you any good if you lose both your local computers and the device their information is stored on.  To keep that from happening, you should keep your backups far away from the originals.  Just how far?  That depends on what kind of disaster you are worried about.

If you are worried about a flood, you should make sure your backups are not near the same river/ body of water as the original data.  If you are worried about a tornado, you should consider the tornado that hit Greensburg, Kansas some years ago was a mile wide, so the absolute bare minimum distance you should keep your data is a mile away.  For other types of disasters I will let you consider your specific information and decide where a safe place would be.

Step 4- Know what is important

If you lost everything, there would be way too much work for you to get it replaced and up and working all at once.  Replacing everything would be a major project that might take days or even weeks.  Before the disaster ever happens you should know what the most important systems are that you couldn’t possibly do without.  In the banking industry, we call this a business impact analysis.

Figure out what you absolutely, positively cannot operate without for even one day.  That is your high risk stuff.  Next think about what you may not need day one, but is so important you absolutely got to have it within a few days or a week at the most.  That is your medium risk stuff.    Everything else is your low risk stuff.  Those are the systems that are nice to have, but you could do without it for a while if you had to.

When you are going through this business impact analysis, don’t forget about software.  Too many companies have a great plan on how to replace hardware but forgot to make a list of what software they will need.

Step 5- Know how you are going to replace your stuff

Now that you know what is important, make sure you have a plan on how to get that stuff.  Begin with the high risk stuff, do you have a plan on how to get a new one within 24 hours?  Good, now rethink that plan.  Is your plan to just go down to the local electronics store and buy a new computer?  Depending on what type of disaster happens things may not be that easy.  Remember that following hurricane Katrina there were no computers available for sale in New Orleans.  If you absolutely need a certain piece of equipment it might be best to have a plan B and C ready to go.

Step 6- Know where you will go

If your building was suddenly unavailable where would you go?  The answer depends very much on what type of business you are in.  If you are in a retail type business that depends on customers being able to find you then you will have to find another retail location with easy access for customers.  If your business doesn’t require as much customer contact then you can be quite a bit more flexible, perhaps even working out of someone’s home on a temporary basis.

Once you figure out what type of space you will need then you can figure out what options you have. If you are having trouble thinking of suitable options then I have a few options to think about.  Is there another company some distance away that might be interested in a reciprocal agreement where you will share space in the even either of your buildings are not available during a disaster? None of your options will be ideal I am sure, but you just have to find something that is good enough to get you by and keep you operating.

 If you have no other options, then there are companies that specialize in disaster recovery solutions that might be able to help you out. These companies would provide a trailer complete with offices and computers all ready to go within 24 hours notice.  If your plan is to work with one of these companies then you must sign a contract with them ahead of time as they normally aren’t interested in working with somebody who already is in the middle of a disaster.

Step 7- Have a plan for missing employees

What if the disaster is not a physical disaster that destroys roads and buildings but something like a flu pandemic that leaves you short staffed?  According to the CDC at the height of a flu pandemic you should plan on as much as 50% of your staff being out sick.

Could you get by for a few days with 50% of your employees?  If not, maybe it’s time to think about ways that you could move in that direction.  Is it possible you could cross train your employees a little more?

Another step to think about in the event of a flu pandemic is how to minimize contact between our employees and customers so that as few people get the flu as possible.  Maybe it is possible in your business for everyone to work from home for a short period of time?  If not, maybe it is possible to lock your doors to customers and ask your customers to contact you through phone and email only.  For some businesses closing the door to customers means doing no business at all, so this just isn’t practical.  If you can do nothing else, then you should at least consider having a supply of hand sanitizer available that you can distribute to employees and instruct them to use it as much as possible to kill germs.

Step 8- Take care of your people so they can take care of your customers

Earlier this year I lead a panel discussion on disaster recovery with several panelists that had gone through a variety of disasters and their businesses survived to tell about it.  The panelists were asked what the number #1 lesson they learned was and they all gave the exact same answer. All of the panelists explained that the most important step was to make sure their employees had everything they needed at home.

That answer shocked me because I never would have guessed that answer, but after hearing their explanations it made perfect sense.  Recovering from a disaster is going to be a tremendous amount of work and dedication from your employees.  Now I am sure that you have very hardworking loyal employees who are up to the challenge, but the fact is that if their home has been destroyed or if their family needs help then they are going to choose helping their family over your business.

 One of the businesses on the panel paid most of its employees on commission, and employees knew there was a lot of work to do before the business was up and running to the point where they could earn commissions again.  The first thing the owner of that business did was let all the employees know that they would be paid a salary until they could start earning commissions again.  The effort that businesses employees put in to get things going again was remarkable and the business was eventually built up again bigger and better than ever.

So if your business is destroyed make sure your employees and their families are OK.  Once they are OK, they can focus on making sure you’re OK.

Step 9- Take a copy of your plan offsite

OK, so you have written up a great plan with all the steps you need to take to get your small business up and running again.  It is likely that a disaster won’t hit soon though.  Maybe it will never hit or maybe it will be several years from now.  How good is your memory? Will you be able to remember all the details of your disaster recovery plan years from now?  Yeah, I wouldn’t be able to either.

So you’re going to want to make sure you have a copy of your plan available to you.  Your building might not be available to you, so you will want to make sure you have a copy somewhere else. Keeping a copy in your house is a good idea.  If you use a cloud computing solution such as Google Drive then keeping your plan on the internet is another good plan.

Step 10- Talk to your insurance agent

If it has been a while since your policy has been updated it might be a good idea to talk to your insurance agent and make sure your coverage levels match the amount you would have to spend to recover.

Would you be able to survive for a period of time without the revenue your business is generating?  If not, you might want to talk to your agent about lost revenue coverage.

Step 11- Train and test

After you have a great disaster recovery plan in place the next step is to train your employees on it so they will know what to do as well as you do.  At the very least, all of your employees should know where to go and what they will be in charge of doing.

Finally, be aware that there are a million things that can go wrong when you are recovering from a disaster, and most of them you never would have thought of.  Maybe your backup tapes haven’t been writing correctly the last six months.  Maybe you can’t find the right kind of drive to read your backup tapes.  Make sure you run through your disaster recovery plan and test as many steps as possible at least once per year so that you can be reasonably certain your plan will actually work.


The Varney & Associates IT team is available for help!

If you need help with your disaster recovery planning, or would like testing done on your IT systems the V&A IT team would love to help you out.  You can reach Richard Boggs at, Val Kershner at, or Scott Woborny at As always, please don't hesitate to call us at 785-537-2202.