When Small Businesses Face a Crisis, Failing to Plan is Planning to Fail

In a recent Associated Press article entitled “Small businesses can feel bigger effects from a PR disaster,” Joyce Rosenberg writes that small businesses are more likely to sustain a much deeper impact from an unforeseen crisis compared to their larger counterparts. In fact, they may even go out of business altogether.

Bob Harding, in a blog post for Pacific Continental Bank, explains in “If You Don’t Have a Crisis Communications Plan, You Have a Crisis”:

To me, being prepared for unexpected problems and having a crisis communication plan in place is fundamental to all businesses, regardless of the size of the operation. Yes, big corporations have legal teams and public relations people to navigate such challenges, but even tiny businesses should have a rudimentary plan for how they are going to speak about a crisis – and hopefully – save their reputation and brand.

Sadly, the majority of small businesses are not adequately prepared for adverse events. According to Refresh Leadership, “33% of respondents said they were as prepared as possible to respond to a crisis. Which means up to 67% of respondents could be putting themselves at risk.” Further, “out of that 67%,

• 32% said they have no crisis management plan at all
• 20% said they have general guidelines, but no real plan in place
• 11% said they aren’t sure whether or not they have a plan
• 3% said they have a plan, but it is outdated.”

Larger businesses, with bigger budgets for crisis planning, better overall preparedness, the ability to absorb the shock of a crisis, PR investment to fortify their reputation, access to more resources such as external communication consultants, larger internal communication departments, and more funding to purchase better insurance and retain lawyers or build their own legal team, have inherently stronger PR crisis resilience than their smaller counterparts.

So how can small businesses increase resilience and PR crisis readiness when they lack big-business resources? Eight key low- or no-cost strategies, if fully understood and implemented, can help small businesses weather a crisis and maintain business continuity:

Know your risks: To prepare for a critical event that would negatively impact your business, first determine what your risks are. Conduct a risk audit of your business and its brand. Risks typically stem from three core areas:

• Manmade: Active shooter, terror attack, rioting/public disturbance, employee strike, etc.
• Technical: Power outage, data breach, network failure, ransomware, etc.
• Natural: Weather-related events such as excessive heat and cold, snow, rain, and wind; hurricanes, tornadoes, blizzards, flooding, droughts, fire; and geological events such as earthquakes, etc.

Of course not every business or organization will be impacted by each risk type–at least not directly. And secondary, “hidden” risks abound. A seemingly unrelated event may have a disastrous impact on your business. For example, if you own a restaurant, purchase meat from a neighboring state, and truckers there go on strike, what would you do? Would you have a backup supply chain?

Once direct and indirect risks are identified, they need to be monitored and assessed, with a designated employee tasked with checking news and weather forecasts on a daily basis – sometimes hourly depending on issues or events being dealt with.

Note that the above risks are primarily operational. Each company is different, and other risks may be present. For example, a credit and market risk analysis may be in order depending on the type of company and services/solutions provided.

Understand the impacts: Identifying risks is the first step, but how can you actually plan to survive a critical event if you do not understand the full impact of that risk?

A critical event engenders both individual and knock-on effects. Some small business owners may not realize that many of their business functions may be dependent on one (possibly vulnerable) system/asset. This is why it is important to:

• Identify all products and services provided
• Identify all processes needed to ensure business continuity
• Identify assets and staff needed to keep products and services flowing
• Identify essential systems
• Identify which internal and external resources, products and services you are dependent on as well as their interdependencies
• Identify customers, stakeholders, and users who would be impacted

Once business owners understand how the components of their business are interconnected and what will happen to business functions if an adverse situation arises, they can better prepare for a crisis.

Develop a crisis communications plan: For many smaller businesses, this is easier said than done. Granted, having a crisis communications plan in place will not protect a company from falling victim to a critical event. But it will bolster the company’s ability to identify a risk, monitor it, and proactively respond when necessary to mitigate or even eliminate the threat. And when a crisis strikes without warning, the company can respond efficiently and effectively, reducing stress on employees and loss of valuable time.

According to Working Capital, “Companies with a plan in place to respond to disruptive incidents large or small can return to business as usual much quicker than those that do not, which can have a lasting impact on sales, perception, customer loyalty and more.”

In this age of social and digital media, a rapid, truthful and accurate response is crucial. The crisis communications plan needs to define and describe crisis teams and their functions and responsibilities, policies and protocols, strategies, the criteria for designating a crisis, crisis messaging templates for all stakeholders, contact lists for all parties, and detailed resources for managing the crisis. Do not forget to include a primary spokesperson and a backup spokesperson, just in case. Include a detailed section on social media crisis management as well.

The crisis communications plan cannot stand in isolation. It should be integrated into all other plans used to deal with emergencies, such as the business continuity plan and the emergency management plan.

And, as with all plans, it needs a trial run. All components should be tested and tweaked in readiness for a full crisis exercise. Depending on the company size and its budget, a simple tabletop exercise can be implemented, or a full-scale exercise with outside agencies can be scheduled. Following the exercise, a complete postmortem is essential to ensuring the plan is updated and readied for implementation.

Invest in your reputation: Because virtually every business trades on its reputation and values, good reputation management is a crucial investment that pays off in the long term. A solid reputation acts as a strong buffer for negative sentiment and experiences. It cannot make bad news go away–but it can soften the blow or the fallout of an event.

Social media is one of the logical places to build and manage your reputation. Many social media platforms are free. Twitter, Facebook, LinkedIn, YouTube, and Instagram are the most popular.

Some companies may be inclined to have as many active social media channels as possible. While it is wise to register your company on a wide array of channels to prevent social squatting, it is not advisable to execute a full-blown social media campaign on all channels, as that would be very time consuming and resource dependent. Instead, choose the platforms most suited to your business type and customer base, and concentrate on building a coordinated, focused, and consistent presence.

Content marketing, in which a company creates content of value, interest, and relevance for all current stakeholders, can also be a cost-effective method for building reputation. Content can be distributed via social media channels, newsletters, media releases, etc.

All efforts should be based on an integrated PR plan that is strategy-rich and coordinated with the company’s business plan. The plan can be implemented by an internal resource or a retained PR agency of record. The content generated from the PR should be disseminated to prospective clients, customers, the media, internal stakeholders, partners, suppliers, etc. Content should be adapted for relevant social media channels and then transmitted with uniform messaging across all channels.

Finally, good customer service is one of the most effective forms of PR and reputation enhancement a company can invest in. Ensure that your PR and customer service are synergized–e.g., that employees are up-to-date on the same marketing and PR material as stakeholders. Consistent messaging is essential because employees often have more face-to-face interactions than management. Staff needs to know what their company is communicating so they can answer any questions a current or potential customer may ask. Not being able to answer questions with accuracy may lead a client to conclude that employees do not know what is happening in their own company, and the client’s confidence will decline, making your business more vulnerable during a crisis.

Invest in enterprise risk management: Cybersecurity and business continuity are core mainstays in keeping your business protected and literally in business. Keep in mind that simply installing an anti-virus program on your network does not constitute cybersecurity. Antivirus technology does not protect your company against insider threats, data breaches, theft of intellectual capital via endpoints on your network, etc. Retain a cybersecurity company that can help devise an appropriate security strategy and deploy the necessary cybersecurity tools you will need to protect your business’s viability.

The statistics are alarming. According to Small Business Trends, out of all cyber attacks, 43% target small business. And a shocking 60% of small businesses go out of business within six months following a cyber attack. Similarly, according to the Federal Emergency Management Agency, 40 percent of businesses do not reopen after a disaster and 25 percent fail within one year.

In addition to protecting your business from attack, invest in business continuity and disaster recovery. The Journal of Accountancy states that “More than 60% of U.S. small businesses do not have a formal emergency-response plan and fail to back up their financial data offsite, leaving them vulnerable to catastrophic data loss in the event of a natural disaster.”

Ensure that data is backed up securely and offsite so that if systems are compromised or business processes and production are interrupted by any of the three risk types mentioned above, you can recover all data quickly, securely, and accurately, along with business processes (business dependent of course). Business continuity and disaster recovery professionals can advise you on the proper strategies and processes to minimize downtime and help you determine an acceptable recovery period and recovery point objectives.

Your overall objective is to be as resilient as possible under challenging circumstances. Depending on your business type, you may also want to consider investing in either a hot or cold site from which you can resume your business operations.

If your data is compromised or your ability to operate your business is impacted for longer than a day (the tolerable time for an outage varies from business to business), and you have not taken the necessary steps to mitigate your risks, what will your customers think and say? Ensuring customer service continuity and protecting customer assets held on your premises and in your systems is a key proactive step in mitigating a reputational crisis.

Be lean and mean: Small companies can use their size as an advantage when managing a crisis. Being small means they do not have to conduct endless meetings to hash out approaches and strategies. Small companies are less likely to have obstructive red tape and they have greater freedom to make timely, decisive decisions. These are critical advantages for the successful management of the crisis, as taking too much time to respond to an adverse event can destroy a reputation.

Crisis management teams should be small; there is no need for large teams with a multitude of role players, which can make decision making complex. There is, however, a place for specialized sub-teams that can act as consultants to the primary team to assist with decision making. Lean and mean teams with rapid and accurate decision-making capabilities win the day.

Invest in the right insurance and the right lawyer: Most businesses have insurance, but how many are correctly insured? Being correctly assessed by an insurance agent that specializes in your business niche is critical. Opt for experience and specialization rather than going for the lowest price or overly general one-size-fits-all policies.

The same strategy applies to hiring lawyers. Yes, most lawyers are competent in the broader areas of law, but if you are a startup in cybersecurity, you want to work with a law firm that either specializes in cybersecurity or has a cybersecurity department. Even if the family lawyer is trusted and competent, he or she is usually not a good fit when it comes to niche companies.

Specialized lawyers will understand your operating environment and can help protect your assets with the appropriately worded contracts, lease agreements, vendor and supplier contracts, etc. And, when a crisis happens, they will also have a better understanding of your business and will be in a much better position to advise you effectively.

Be customer-centric: For a great example of what not to do, look at the way many airlines deal with the flying public. Flying is no longer an experience and adventure. Many people find it strenuous and dread it simply because airlines see customers as commodities that they can use to fill seats. In other words, for airlines, it is all about the profit and not about the service.

The lesson here for small businesses is to focus on making customers happy. Consider the damage done by the power of word of mouth—“sharing” an unsatisfactory experience is now magnified when disgruntled customers rant on social media and videos go viral. To understand the importance of being customer-centric, small businesses should consider customer acquisition cost and determine how much is spent to secure a new customer as well as how much it costs to retain patronage.

According to HelpScout,

• Loyal customers are worth up to 10 times as much, on average, as their first purchase.
• You have a 5-20% chance of selling services/solutions/products to a new prospect and a 60-70% chance of selling them to an existing customer.
• It can take up to 12 positive experiences with a client to make up for one unresolved negative experience.
• The cost of acquiring a new customer is 6-7 times more expensive than keeping a current one.
• Bad service results in a customer complaining to more than twice as many people compared to good customer service.

Customer-centricity must be built around having the correct customer policies in place, including the ability to rapidly resolve issues, as speed and accuracy are important in a crisis. Having employees that are appropriately trained in both customer service and their own company, its products and services, is also crucial. Even more important is investing in training updates and refresher courses in these vital areas. Develop and maintain policies and procedures to immediately take employees involved in negative customer incidents offline for additional training and counseling.

Customer communication is also critical. Ensure you have some level of content marketing strategy and plan in place to communicate information of value at regular intervals. This helps customers feel connected and keeps your brand alive.

Remember, saying or thinking you have great customer service does not mean you do–only your customers will be the judge of that.

Having a crisis plan in place will not necessarily guarantee that your business will stay in business after a critical event. But it gives you a fighting chance and helps you respond quickly. At the end of the day it is cheaper to plan for something unpleasant than to hide your head in the sand and have to deal with heartbreak and expense of either losing customers and income, or in a worst-case scenario, losing your business and livelihood.

—ENDS—

About Fortress Strategic Communications:

Fortress Strategic Communications provides specialized strategic public relations and crisis communications consulting to companies that offer products, services, and solutions designed to manage and mitigate all types of risk. FSC also provides market specific solutions for data breach events and counsels startups looking to enter the risk management arena. The company draws on their executives’ combined 20 years of global experience in a broad array of vertical markets. For more information please visit www.fortresscomms.com or contact us via [email protected]