ARTÍCULOS ORIGINALES

DOI: 10.17230/ad-minister.28.4

Disaster Risk Management and Business Education: the Case of Small and Medium Enterprises

La Gestión del Riesgo de Desastres y la Educación de Negocios: el caso de las pequeñas y medianas empresas

JUAN PABLO SARMIENTO¹, GABRIELA HOBERMAN², MEENAKSHI JERATH³, GUSTAVO FERREIRA JORDAO⁴

2 Florida International University, Miami, U.S.A. E-mail: ghoberma@fiu.edu

3 Florida International University, Miami, U.S.A. E-mail: mjerath@fiu.edu

4 Florida International University, Miami, U.S.A. E-mail: gjord005@fiu.edu

Received: 18/03/2016 Modified: 2/06/2016 Accepted: 10/06/2016

JEL: L26, M14, Q54

ABSTRACT

It is safe to say that building disaster resilience by preparing for disasters with a business continuity plan
is vital for small business to thrive in the long run. More often than not, small business owners invest
large sums of money, time, and resources to make their ventures successful and yet, many of them
fail to properly plan and prepare for disaster situations. With this problem in mind, Florida International
University (FIU) became the house of the Small Business Development Center (SBDC) and the Extreme
Events Institute (EEI). Together, both institutes have collaborated in their mission to spread disaster resilience
and business continuity management knowledge and best practices in an accessible way to small
businesses in South Florida and Latin America. By developing and disseminating knowledge, processes
and best-practices through several activities and channels such as business consulting and business
continuity plan elaboration, Pasantías (Practicums), and the Disaster Resilience Toolkit for Small-and-Medium
Sized Enterprises, both institutes truly represent FIU's experience with SMEs and its commitment
with entrepreneurship and South Florida's community.

KEYWORDS Business continuity; business education; disaster resilience; mainstreaming disaster risk reduction; SMEs.

RESUMEN

PALABRAS CLAVE Continuidad de negocio, educación de negocios, resiliencia de negocio, incorpración de la reducción del riesgo de desastres; PYME.

INTRODUCTION

Even as small business owners invest large sums of money, time and resources to succeed, lack of proper planning and preparation for disaster events often leads to significant losses and failed ventures. This is especially true for the community of small business owners in South Florida where disaster risk is a constant. Florida International University (FIU), cognizant of the needs of South Florida's small business community, made a commitment to promote and support entrepreneurship in South Florida at the time of its inception in 1965. The longstanding relationship continues to thrive until today. In the 1970s, FIU expanded its pledge by reaching out to the Latin American and the Caribbean region as it launched programs and began recruitment with an international focus (Florida International University, 2016b). FIU has since promoted several initiatives and institutes to help spur and develop the entrepreneurial spirit in South Florida, and eventually in the Latin American and Caribbean region.

Along with the need to develop the entrepreneurial spirit in the region, FIU's mission has been to spread the knowledge and best practices in disaster resilience and business continuity management to small businesses in an accessible way. Aligned with this mission, FIU became the house of the Small Business Development Center (SBDC) and the Extreme Events Institute (EEI). The Center collaborates with FIU's College of Business to provide South Florida's entrepreneurs with professional business consulting at no cost, management training, and vital information they need to grow and succeed in a complex and competitive global environment (Florida Small Business Development Center Network, 2016). The Extreme Events Institute, working under the Vice President's Oftce for Research & Economic Development, embodies FIU's research and applications leadership at the global level in extreme events, reflecting an institutional interest in development and multi-hazard disaster resilience, including disaster risk management, vulnerability reduction, preparedness, emergen cy response, resilience, and ''smart'' recovery (Florida International University, 2016a). The EEI brings the latest research on disaster risk for the benefit of the business community, with special emphasis on Small and Medium Enterprises.

BACKGROUND

While knowledge of disaster resilience and business continuity is commonplace among large business managers, small business owners are often unaware of the costs of not preparing for unexpected events and disasters. In addition, some never get a chance to recover after being affected by such events. According to the Institute for Business and Home Safety study, an estimated 25 percent of small to mid-size businesses do not reopen following a major disaster (U.S. Small Business Administration, 2016). Another study, conducted by the University of Texas, has shown that about 43% of all businesses that experience a catastrophic data loss never reopen, and 51% shut down within two years (Armstrong, 2007).

Furthermore, 80% of companies that do not recover from a disaster within one month are likely to go out of business; 75% of companies without business continuity plans fail within three years of a disaster; companies that aren't able to resume operations within ten days (of a disaster hit) are not likely to survive; and of those businesses that experience a disaster and have no emergency plan, 43% never reopen. Of those that do reopen, only 29% are still operating two years later (HP & Score, 2008). An infographic by the Eastern Kentucky University Department of Safety, Security, and Emergency Management (Eastern Kentucky University, 2016) further informs on the impacts of natural disasters on small businesses (Figure 1).

DISASTER RISK MANAGEMENT AND BUSINESS EDUCATION: THE CASE OF SMALL AND MEDIUM ENTERPRISES

A study on Private Sector and DRR was led by FIU and supported by USAID/OFDA (Oftce of U.S. Foreign Disaster Assistance) and the UNISDR (United Nations Oftce for Disaster Reduction), in collaboration with researchers of the INCAE Business School (Costa Rica), the University of Chile, Ohio University, and York University (Canada). The study was conducted in six cities of the Americas in 2012: Bogotá (Colombia), Miami, FL (United States), San José (Costa Rica), Santiago (Chile), Kingston (Jamaica), and Vancouver (Canada).

With close to 1300 survey responses, the key findings were: (1) 56% of respondents indicated that they do not have a Business Continuity Plan (BCP) in place; (2) 36.5% of businesses considered that BCP is desirable but other priorities take precedence; the lack of protection in private sector is caused not only by financial constraints, but also by the still not well-understood issues of avoidance, competing priorities excuses, narrow decision-making, and concerns over accountability; (4) small businesses show the least progress in establishing business continuity plans (14%), compared to larger businesses (44.9%); (5) there are insuftcient incentives for DRR strategies to have practical impacts on business vulnerabilities and lack of resilience; (6) implementing regulations and enforcement mechanisms are weak to non-existent; and (7) little progress has been made in social responsibility and commitment to reducing the vulnerabilities of at risk populations.

A robust body of research has demonstrated the importance of Disaster Resilience and Business Continuity for small businesses. Asgary et al. (2012) highlight the size of a business as the most significant factor on disaster impact on businesses. Some researchers suggest that a smaller business size is a major source of vulnerability to negative disaster outcomes (Alesch, Holly, Mittler & Nagy, 2001), while others argue that smaller businesses suffer disproportionally greater losses than larger businesses (Kroll, Landis, Shen & Stryker 1990). Further research suggests that smaller businesses have fewer resources to plan, respond, and recover from disaster impact (Runyan, 2006), which is in line with data that points that businesses with fledging financial conditions and smaller businesses have less chances of recovering from disaster related losses (Tierney & Dahlhammer, 1997).

Additional research also reflects on the ownership of the business premises as an important predictor that affects the preparedness and recovery. Researchers argue that owning a business facility provides more access to financial resources than renting (Dahlhammer & Tierney, 1996), and that one of the major impediments for small business in preparing for disaster was renting their business facilities (Dahlhammer & D'Souza, 1997). Further corroboration of these findings suggests that owners are more engaged in disaster preparedness than lessees (Asgary et al., 2012).

It is safe to say that building disaster resilience by preparing for disaster with a business continuity plan is vital for small business to thrive in the long run. More often than not, small business owners invest large sums of money, time, and resources to make their ventures successful and yet, many of them fail to properly plan and prepare for disaster situations (U.S. Small Business Administration, 2016). Possible explanations for this vary, ranging from small business owners' disbelief that a disaster would strike them, prohibitive costs, lack of resources, and general belief that a business continuity plan is not necessary (Hammock, 2015). Figure 3 describes business owners' reasons for not investing in a business continuity plan.

Small business owners who claim that a business continuity plan is an unnecessary investment or that is not a high priority project for implementation in their enterprises might not realize the significant benefits reaped from such plans, especially in terms of return in investment (ROI). Many organizations utilize ROI procedures, a formula that measures and compares the tangible benefits of expenditures and discounts with those that are intangible, to quantify financial success of an investment and justify the necessary expenditures. Business continuity management benefits stem from understanding how ''intangible'' areas can also influence tangible business decisions, and this knowledge may reap relevant ROI results and tangible benefits  (Cybulski, 2016).

Therefore, utilizing ROI calculations to make a case for investment in a business continuity management program may understate its real benefits. The complete range of benefits offered by a business continuity plan is only recognized after the planning and implementation processes have been completed (Cybulski, 2016). By understanding a business continuity plan, its objectives and planning components, small business owners can better understand the tangible and intangible benefits derived from it.

BUSINESS  CONTINUITY PLAN

Scholars argue that business continuity planning originated during the 1970s, when mainframes and network technology gained prominence within business and methods of securing the data from unpredicted events that could undermine them (Cremonini & Samarati, 2008). Nowadays, BCP has evolved together with business models, expanding its focus from technology infrastructure to all the processes and management procedures involved in the continuation of the business in its entirety. The idea is that reducing down-time periods also accelerates recovery and business restoration (Cremonini & Samarati, 2008).

According to Aon Global Risk Consulting, three steps are essential when developing a business plan that is eftcient and complies with standards, codes and best practices: 1) the Discovery Phase, which consists of business impact analysis and risk assessment; 2) the Planning Phase, composed of the emergency response and management and crisis management and communications steps; and 3) the Governance Phase, which follows the plan auditing, updating and exercising procedures (Figure 4).

The Discovery Process phase of a business continuity plan seeks to identify potential risks that a company is exposed to, and measure the amount of disruption an organization can withstand or those that must be addressed. The first process of the Discovery Phase is the Business Impact Analysis (BIA), which seeks to identify and qualify the time-sensitive business functions and processes. By measuring these processes, organizations are enabled to understand the point in time when an impact starts to drive negative consequences. Once these impacts are understood, the organization can develop the framework to accept, remediate, or develop planning strategies to support organizational recovery (Cybulski, 2016). The next step in the Discovery Phase is the risk assessment and remediation (RA), which yields measurable results by quantifying and qualifying those risks and threats that can disrupt the organizations ability to continue time-sensitive business functions and processes (Cybulski, 2016).

The second phase, the Planning Process, is composed of three separate but integrated plans to coordinate activities, authorities, and responsibilities during disasters. These plans utilize the information captured and analyzed during the Discovery Process phase to ensure the organization not only survives catastrophic events, but can more effectively manage the situation, and drive operational resiliency (Cybulski, 2016). The Emergency Management & Response plan outlines the initial strategies for responding to, and stabilizing an unforeseen event. First responders are responsible for life safety, stabilizing the incident, qualifying and remediation of damage, and communicating to authorities and the Crisis Management Team (Cybulski,  2016).

The second plan to compose the Planning Process phase is the Crisis Management & Communications plan, which bridges the responsibility and coordination between the response team and business restoration and operational recovery; providing leadership, decision-making, and communications structure to support the restoring of critical functions. The last plan to compose the Planning Process is the development of business restoration and operational recovery plans, which includes the strategy development, documentation and deployment of activities required to restore and recover functional operations to meet or exceed the recovery time objective (Cybulski, 2016).

Lastly, the Governance phase provides the organization with the ability to keep the business continuity plans updated and accurate to their situation and risks. Three steps are devised in order to take on that task: plan auditing, updating, and exercising. Plan Auditing provides a formalized method for measuring the management of business continuity processes, and determining the effectiveness of the organization's objectives, and understanding of capabilities or maturity of the plans. Plan Updating ensures accurate and up to date strategies; resources and agreements have been documented in compliance with the business continuity policy. The Plan Exercising step is then conducted on a preset schedule in order to allow the participating teams to practice the plan implementation, strengthen responsibilities and capabilities while identifying improvements to strategies and resources (Cybulski, 2016).

It is important to highlight that these are general and broad steps that business continuity plans include in order to assess disaster risk and to provide guidelines for swift recovery of operations. Managers and small business owners that possess the full knowledge of their business will be able to fine tune the BCP to their company's needs. Additionally, disasters can take several forms. Some primarily affect individuals, while others have a larger, collective impact, such as natural and manmade disasters. Even though some of them may only cause short-term disruptions in normal business operation, the recovery of an impacted area from the many disasters can take much longer, especially if organizations have not made preparations in advance (Disaster  Recovery, 2016).

FIU, BUSINESS CONTINUITY AND SMES FROM SOUTH FLORIDA AND LAC Based on the 2012 public-private study conducted by FIU-EEI, particularly on the findings that business size matters and that there is an urgent need to overcome ''risk indifference'', FIU understood the challenge and initiated a comprehensive strategy to focus on small businesses to help them incorporate business continuity plans (BCP) and disaster risk reduction measures in their daily operations. In 2014, the EEI-DRR program began the project involving business school representatives from the USAID/OFDA priority countries to expose them to the BCP-DRR approach in order to mainstream disaster risk reduction into their academic programs and community services. The project emphasizes partnerships between universities, national emergency organizations, chambers of commerce, and small business associations (tourism, food and agriculture, services) at national, sub-national, and local levels.

In addition, FIU-EEI joined the UNISDR (United Nations Oftce for Disaster Reduction) Private Alliance for Disaster Resilient Societies (ARISE) in 2013, leading Activity Stream #4: State of the Art Disaster Risk Management, Education, Training, and Outreach. In 2015, UNISDR and ARISE, with support from the Federal Government of Germany's Ministry for Economic Cooperation and Development (BMZ) partnered with FIU-EEI and twelve leading business schools to improve or introduce disaster risk management in higher education curricula and training services, which supports Priorities for Action I, III, and IV of the Sendai Framework. The process began with a call for White Papers that proposed innovative approaches to mainstreaming cutting-edge disaster management content into MBA programs and other academic offerings, themes addressed at the Toronto's DRR and Business Education Workshop in March 2016. The project also sought to engage the support of larger experienced corporations, particularly those working in public-private partnerships. The Small Business Development Center (SBDC) and the Extreme Events Institute (EEI) head Florida International University's commitment to South Florida's community of Small and Medium Business Enterprises. . Both institutes have developed activities with cutting-edge knowledge of Business Continuity in order to provide support and increase the disaster resilience of the SMEs community. The SBDC activities with the Small Business community focus on South Florida's hurricane season, helping owners understand and assess the disaster impact on their business. Additionally, the SBDC presents Business Continuity as an achievable competitive advantage for small business owners, while helping to build disaster resilience by exposing stakeholders to essential concepts such as risk management, contingency planning, emergency preparedness, disaster recovery planning, succession planning, business continuity planning, cyber-security assessments, and  disaster recovery planning.

The following are a collection of materials that the SBDC utilizes in their training and consulting activities:

• SBDC Disaster Checklist: A general checklist of everything that is vital for the small business owner to run its company. The checklists contain advice on how to prepare the essential aspects of the business, such as employees, customers, suppliers, equipment, property, company records, and insurance related information.

• Disaster Tabletop Exercise: The SBDC provides small business owners with training by applying scenarios in order to assess a business's disaster resilience. The purpose of the exercise is to review and discuss the actions they would take in a particular emergency, testing their emergency plan in an informal, low-stress environment.
• SBDC Data and Cyber-Security Checklist: The institute also provides data and cyber-security advice for small business owners in order to increase their protection against cyber-attacks and critical data loss. The advice ranges from internal procedures to minimize risk to hardware and asset management.
• Disaster-related Apps: The SBDC also provides small business owners with additional sources of information and tools to help build disaster resilience for small business owners. The following are the most popular apps for disaster preparedness and recovery:

]]>

The Extreme Events Institute has also developed several activities and tools in order to provide small business owners and other stakeholders to improve their businesses' disaster resilience. One of the best examples of EEI's engagement with the small business community is the promotion of Pasantías, or practicums in English. The motivation behind the Pasantías is to bridge the gap between the conceptual, the operational and the practical by combining site visits, presentations, real world observations, and discussions, taking advantage of noteworthy experiences and capabilities in South Florida.

The Pasantías aim to bring together professionals, technicians and leaders working in public administration, project management, non-government and international organizations, private sector, and academic institutions who have disaster risk reduction and/ responsibilities, putting special attention on those who can guide or influence their institutions toward improved disaster risk reduction and resilience. The Pasantía also looks at Business Continuity and Disaster Resilience from a high-level research down to community preparedness and illustrates the private sector's corporate social responsibility of developing Emergency Plans and Business Continuity Plans. A noteworthy fact of the Pasantías is that it not only involves stakeholders from South Florida's multi-cultural environment but also from Latin America and the Caribbean, extending its reach and commitment to small business owners and informal sector operating in those countries. The Pasantías provides real examples of topics such as risk identification and vulnerability assessment, risk reduction and transfer, and disaster management, recovery and business continuity plans.

Another example of EEI's activities aimed towards disaster resilience and business continuity for small business is the new Disaster Resiliency Toolkit for Smalland Medium Sized Enterprises (SMEs). This initiative is embodied by a mobile app that allows its users to have an accessible and easy-to-understand way to build disaster resilience by self-designing and implementing business continuity plans for their organizations.

The app allows users to answer a predetermined questionnaire about their organization that can relate from its assets, business category, number of employees, annual sales and more. The questionnaire is the first step a user takes to assess the risks their businesses face and a fundamental step for the construction of a solid and reliable business continuity plan.

The Disaster Resiliency Toolkit for Small-and-Medium Sized Enterprises app offers a step-by-step approach to building a Business Continuity plan. The whole plan is composed of a business assessment, response and recovery steps. Inside each step, the app provides users with brief explanations of what constitutes the phase of the Business Continuity plan for a better understanding.

After the user completes filling all the categories to build its Business Continuity plan, the app provides useful advice for small and medium business owners and suggests other apps that will provide further information, allowing them to build disaster resilience into their organizations.

The Disaster Resilience Toolkit for Small-and-Medium Sized Enterprises is a very useful tool for small and medium business owners to prepare for unforeseen events, as well as an accessible and educational tool to spread knowledge on how to build business continuity plans. The Disaster Resilience Toolkit for Small-and-Medium Sized Enterprises will be available in English and Spanish for both mobile operational systems iOS and Android by June 2016.

CONCLUSIONS

The quest to involve business schools in disaster risk reduction topics represented an important challenge during the last decade for all actors involved. Looking for windows of opportunity, the FIU-EEI DRR program has developed a systematic strategy with two approaches: first, identifying business schools to mainstream the crosscutting topics of disaster risk reduction. During this process, several business schools with key themes related to crosscutting issues of business and disaster risk reduction in their curricula were selected. Second, fostering a better collaboration between business schools and small business enterprises and associations. With this strategy in mind, the FIU-EEI DRR program, with support from USAID, has organized a workshop in Medellín, Colombia, in June 2016. The workshop aims at exposing leading business schools from six Latin American and Caribbean countries to the BCP-DRR approach to mainstream DRR into their academic programs and community services. FIU expects that business schools along with their national emergency organizations will reach out to other stakeholders, such as chambers of commerce and small business associations, after this experience.

Both institutes, SBDC and EEI, embody FIU's passion for entrepreneurship and its commitment to the SMEs community. The Small Business Development Center, by providing South Florida's entrepreneurs with a range of professional activities, such as business consulting and management training, plays a key role in disseminating vital information for small business owners and aspirant entrepreneurs to face the challenges of the global business environment, and build increasingly resilient operations against unforeseen events. The Extreme Events Institute sets a true example of FIU's ''Worlds Ahead' spirit by leading research and applications in extreme events and developing cutting-edge knowledge in disaster resilience, including disaster risk management, vulnerability reduction, preparedness, business continuity, emergency response, and resilience. Together, these institutes make much more than a case for FIU's experience with Small-and-Medium Sized Enterprises.

REFERENCES

Alesch, D. J., Holly, J. N., Mittler, E., & Nagy, R. (2001). Organizations at Risk: What Happens When Small Businesses and Not-for-Profits Encounter Natural Disasters, Small Organizations Natural Hazards Project First Year Technical Report. Fairfax: Public Entity Risk Institute.         [ Links ]

Armstrong, L. (2007). Data Lost, Data Found. Bloomberg. Retrieved from http://www.bloomberg.com/news/articles/2007-09-02/data-lost-data-found.         [ Links ]

Asgary, A., Anjum, M. I., & Azimi, N. (2012). Disaster recovery and business continuity after the 2010 flood in Pakistan: Case of small businesses. International Journal of Disaster Risk Reduction, 2, 46-56. doi:10.1016/j. ijdrr.2012.08.001         [ Links ]

Cremonini, M. A. & Samarati, P. (2008). Business Continuity Planning. In H. Bidgoli (Ed.), Handbook of Computer Networks: Distributed Networks, Network Planning, Control, Management, and New Trends and Applications, (pp. 671-688). New Jersey: NJ, 2008.         [ Links ]

Cybulski, G. T.. (2016). Business Continuity Management: Return on Investment. Aon Global Risk Consulting Dahlhamer,         [ Links ] J. M., & D'Souza, M. J. (1997). Determinants of Business-Disaster Preparedness in Two U.S.         [ Links ]

Metropolitan Areas. International Journal of Mass Emergencies and Disasters, 15(2), 265-281.         [ Links ]

Dahlhamer, J. M., & Tierney, K. J. (1996). Winners and losers: Predicting business disaster recovery outcomes following the Northridge earthquake. Newark: Disaster Research Center, University of Delaware.         [ Links ]

Disaster Recovery. (2016). Business Continuity & Disaster Recovery Planning. Retrieved from http://www.disasterrecovery.org/disaster_recovery.html.         [ Links ]

Eastern Kentucky University (2016). Top Natural Disasters that Threaten Businesses. Department of Safety, Security, and Emergency Management, Retrieved April 12, 2016, from http://safetymanagement.eku.edu/resources/infographics/top-natural-disasters-that-threaten-businesses/.         [ Links ]

Florida International University. (2016a). Disaster Risk Reduction Program. Retrieved April 11, 2016, from http://drr.fiu.edu/disaster-risk-reduction-program/.         [ Links ]

Florida International University. (2016b). History. Retrieved from http://www.fiu.edu/about-us/history/index. html.         [ Links ]

Florida Small Business Development Center Network. (2016). Miami. Retrieved April 11, 2016, from http:// floridasbdc.org/locations/florida-international-university-miami/.         [ Links ]

Global assessment report on disaster risk reduction 2013: From shared risk to shared value: The business case for disaster risk reduction. (2013). Geneva, Switzerland: United Nations International Strategy for Disaster Reduction.         [ Links ]

Hammock, R. (2015). Only 37% of Small Businesses Have a Formal Disaster Preparation Plan. Retrieved April 12, 2016, from http://smallbusiness.com/operating/despite-a-decade-of-historic-disasters-only-37-of-small-businesses-have-a-formal-plan-for-disaster-preparation-recovery/.         [ Links ]

HP & SCORE. (2008). Impact on U.S. Small Business of Natural & Man-Made Disasters. Compilation of public and private sector.         [ Links ]

Kroll, C., Landis, J., Shen, Q., & Stryker, S. (1990). The Economic impact of the Loma Prieta Earthquake: A focus on small business. Berkeley Planning Journal, 5, 40-58.         [ Links ]

Runyan, R. C. (2006). Small Business in the Face of Crisis: Identifying Barriers to Recovery from a Natural Disaster1. Journal of Contingencies and Crisis Management, 14(1), 12-26. doi :10.1111/j.1468-5973.2006.00477.x.         [ Links ]

Sarmiento, J.P., Hoberman, G., Ilcheva, M., Asgary, A., Majano, A. M., Poggione, S. & Duran, L.R. (2012). Private Sector and Disaster Risk Reduction: The Cases of Bogota, Miami, Kingston, San Jose, Santiago and Vancouver. Background paper prepared for the 2013 Global Assessment Report on Disaster Risk Reduction.  Geneva,  Switzerland:  UNISDR,  2012. http://www.preventionweb.net/gar.         [ Links ]

Savage, M. (2002). Business continuity planning. Work Study, 51(5), 254-261. doi:10.1108/00438020210437277 The U.         [ Links ]S. Small Business Administration. (2016). Disaster Planning. Retrieved April 11, 2016, from https://www.sba.gov/managing-business/running-business/emergency-preparedness/disaster-planning.         [ Links ]

Tierney, K. J., & Dahlhamer, J. M. (1997). Business disruption, preparedness, and recovery: Lessons from the Northridge earthquake. Newark, DE: University of Delaware, Disaster Research Center.         [ Links ]