Owners say their business is prepared the way drivers say they’re above-average; the self-assessment is generous and rarely tested. FEMA’s long-running estimate is that roughly forty percent of small businesses never reopen after a major disaster, and another quarter close within a year. The numbers don’t reflect bad luck. They reflect a planning gap that only becomes visible during a crisis.
The uncomfortable part is that the gap usually isn’t about earthquakes or hurricanes. It’s about losing power for three days, a key employee for three weeks, or a vendor for three months.
Continuity plans are mostly theater
Most “business continuity plans” are PDFs written for compliance, stored on the same network they’re meant to protect. They list contact numbers no one verifies, vendors no one tests, and recovery time objectives no one has measured. The plan exists because the auditor asks. It does not exist because anyone has rehearsed it.
A useful plan is short, lives outside the primary system, and gets walked through once a year by the people who would actually execute it. It identifies the two or three processes that generate cash, the minimum staffing to run them, and the manual workarounds when software fails. Everything else is optional. Owners who have lived through an outage learn this the hard way; everyone else assumes their cloud provider will handle it.
The single points of failure no one names
Every small business has one or two single points of failure that the owner could name in thirty seconds and chooses not to. The bookkeeper who knows the whole accounting system. The one supplier who actually ships on time. The website that runs on a developer’s personal account. The owner’s email, which is the recovery address for every other login.
These aren’t edge cases; they’re the modal failure mode. A real preparedness audit asks what happens if each of those vanishes for a week and writes the answer down. If the answer is “we’d be in serious trouble,” that’s the work. Cross-training, documented credentials, and a second vendor for any critical input cost almost nothing and prevent the failures that actually close businesses.
Insurance is a backstop, not a plan
Business interruption insurance pays out, eventually, after a covered event, with a long list of exclusions. Owners often assume coverage will bridge a closure that the policy was never designed to bridge. Pandemic-era litigation made this painfully clear. Insurance is a financial backstop for a narrow set of scenarios, not a substitute for operational redundancy.
The cheaper preparedness move is cash. A business that can survive sixty days of zero revenue can ride out almost any disruption short of a structural one. Most small businesses operate with under thirty days of cash on hand, which is the real exposure no policy fixes.
The takeaway
Preparedness isn’t a binary. It’s a small set of boring habits: a short written plan, mapped single points of failure, cross-trained staff, and a real cash buffer. None of it feels urgent until the morning it does, and by then the work has to already be done.
Leave a Reply