Evaluate business risk

What are the common risks?

The components to be considered are people, processes, premises, providers, profiles and performance.

What changes of roles and responsibilities might be required should some staff no longer be able to work?
What levels of awareness and education about the plan/contingencies do particular staff require?
What is the likely availability of people (existing and/or replacement staff) to keep the business going during/after a disaster?
What might be the emotional impact of the disaster on your staff members and what support processes might you have to access in the recovery phase?
What might your people need in order for their own home situations to recover from a disaster?

What organisational processes (manufacturing, sales, delivery, financial, IT) do you run and what changes might you have to make to them in a post-disaster situation?
How would your communications (both internal and external) be affected and what non-traditional communication methods might you require to stay connected?
What formalised planning have you done, where is it stored and who knows about it should it be required?

What might the impact be on buildings and facilities for staff, customers and suppliers?
What alternative buildings and/or facilities could you use as a backup or in an emergency?
How can you minimise the impact of potential disaster with security, sprinkler and other risk minimisation actions?

How could you protect an ongoing supply chain (purchased goods and/or raw materials) if either their or your business were affected by a disaster?
Who are your contractors or the people you outsource work to?
Do you have a complete list of their contact details?
Who provides your communication, sanitation and other essential services?
Do you have a list of their contact details?
Are all your lists backed up with copies held somewhere off site?
In the event of a disaster, what alternative sources do you have to supply the services your business requires?

How might your brand, image and reputation in the marketplace be affected after a disaster? What elements do you need to protect and how would you do that?
How would you prepare for a heightened awareness of your brand/market profile in a post-disaster situation?

How long would it take you to re-establish accepted benchmarking standards post-disaster?
How would you evaluate and audit your post-disaster recovery processes to check on their relevance and/or effectiveness?