Disaster Risk Management and Business Education: the Case of Small and Medium Enterprises

It is safe to say that building disaster resilience by preparing for disasters with a business continuity plan is vital for small business to thrive in the long run. More often than not, small business owners invest large sums of money, time, and resources to make their ventures successful and yet, many of them fail to properly plan and prepare for disaster situations. With this problem in mind, Florida International University (FIU) became the house of the Small Business Development Center (SBDC) and the Extreme Events Institute (EEI). Together, both institutes have collaborated in their mission to spread disaster resilience and business continuity management knowledge and best practices in an accessible way to small businesses in South Florida and Latin America. By developing and disseminating knowledge, processes and best-practices through several activities and channels such as business consulting and business continuity plan elaboration, Pasantias (Practicums) , and the Disaster Resilience Toolkit for Small-and-Medium-Sized Enterprises, both institutes truly represent FIU’s experience with SMEs and its commitment with entrepreneurship and South Florida’s community.


RESUMEN
Es posible afirmar que la construcción de resiliencia de negocio a través de la preparación para los desastres utilizando un plan de continuidad de negocio es vital para el desarrollo de las pequeñas empresas en el largo plazo.No pocas veces, los dueños de las pequeñas empresas invierten grandes sumas de dinero, tiempo y recursos para hacer exitosos sus emprendimientos y, sin embargo, muchos de ellos fracasan en la apropiada planeación y preparación para las situaciones de desastre.Con este problema en mente, Florida International University (FIU) se convirtió en la casa del Centro de Desarrollo de Pequeñas Empresas (SBDC) y del Instituto de Eventos Extremo (EEI).En conjunto, ambos institutos han colaborado en su misión de difundir el conocimiento y las mejores prácticas en cuanto a resiliencia de desastres y gestión de la continuidad de negocio de una manera accesible a las pequeñas empresas del Sur de la Florida y de América Latina.Por medio del desarrollo y la difusión de conocimiento, procesos y mejores prácticas a través de diferentes actividades y canales, como la consultoría empresarial y la elaboración de planes de continuidad de negocio, Pasantías (Practicums) y del Kit de Herramientas de Resiliencia de Negocio para las Pequeñas y Medianas Empresas, ambos institutos representan verdaderamente la experiencia de FIU con PYME y su compromiso con el empresarismo y la comunidad del Sur de la Florida.

INTRODUCTION
Even as small business owners invest large sums of money, time and resources to succeed, lack of proper planning and preparation for disaster events often leads to significant losses and failed ventures.This is especially true for the community of small business owners in South Florida where disaster risk is a constant.Florida International University (FIU), cognizant of the needs of South Florida's small business community, made a commitment to promote and support entrepreneurship in South Florida at the time of its inception in 1965.The longstanding relationship continues to thrive until today.In the 1970s, FIU expanded its pledge by reaching out to the Latin American and the Caribbean region as it launched programs and began recruitment with an international focus (Florida International University, 2016b).FIU has since promoted several initiatives and institutes to help spur and develop the entrepreneurial spirit in South Florida, and eventually in the Latin American and Caribbean region.
Along with the need to develop the entrepreneurial spirit in the region, FIU's mission has been to spread the knowledge and best practices in disaster resilience and business continuity management to small businesses in an accessible way.Aligned with this mission, FIU became the house of the Small Business Development Center (SBDC) and the Extreme Events Institute (EEI).The Center collaborates with FIU's College of Business to provide South Florida's entrepreneurs with professional business consulting at no cost, management training, and vital information they need to grow and succeed in a complex and competitive global environment (Florida Small Business Development Center Network, 2016).The Extreme Events Institute, working under the Vice President's Office for Research & Economic Development, embodies FIU's research and applications leadership at the global level in extreme events, reflecting an institutional interest in development and multi-hazard disaster resilience, including disaster risk management, vulnerability reduction, preparedness, emergency response, resilience, and "smart" recovery (Florida International University, 2016a).The EEI brings the latest research on disaster risk for the benefit of the business community, with special emphasis on Small and Medium Enterprises.

BACKGROUND
While knowledge of disaster resilience and business continuity is commonplace among large business managers, small business owners are often unaware of the costs of not preparing for unexpected events and disasters.In addition, some never get a chance to recover after being affected by such events.According to the Insti-tute for Business and Home Safety study, an estimated 25 percent of small to mid-size businesses do not reopen following a major disaster (U.S. Small Business Administration, 2016).Another study, conducted by the University of Texas, has shown that about 43% of all businesses that experience a catastrophic data loss never reopen, and 51% shut down within two years (Armstrong, 2007).
Furthermore, 80% of companies that do not recover from a disaster within one month are likely to go out of business; 75% of companies without business continuity plans fail within three years of a disaster; companies that aren't able to resume operations within ten days (of a disaster hit) are not likely to survive; and of those businesses that experience a disaster and have no emergency plan, 43% never reopen.Of those that do reopen, only 29% are still operating two years later (HP & Score, 2008).An infographic by the Eastern Kentucky University Department of Safety, Security, and Emergency Management (Eastern Kentucky University, 2016) further informs on the impacts of natural disasters on small businesses (Figure 1).

DISASTER RISK MANAGEMENT AND BUSINESS EDUCATION: THE CASE OF SMALL AND MEDIUM ENTERPRISES
A study on Private Sector and DRR was led by FIU and supported by USAID/OFDA (Office of U.S. Foreign Disaster Assistance) and the UNISDR (United Nations Office for Disaster Reduction), in collaboration with researchers of the INCAE Business School (Costa Rica), the University of Chile, Ohio University, and York University (Canada).The study was conducted in six cities of the Americas in 2012: Bogotá (Colombia), Miami, FL (United States), San José (Costa Rica), Santiago (Chile), Kingston (Jamaica), and Vancouver (Canada).
With close to 1300 survey responses, the key findings were: (1) 56% of respondents indicated that they do not have a Business Continuity Plan (BCP) in place; (2) 36.5% of businesses considered that BCP is desirable but other priorities take precedence; (3) the lack of protection in private sector is caused not only by financial constraints, but also by the still not well-understood issues of avoidance, competing priorities excuses, narrow decision-making, and concerns over accountability; (4) small businesses show the least progress in establishing business continuity plans (14%), compared to larger businesses (44.9%); (5) there are insufficient incentives for DRR strategies to have practical impacts on business vulnerabilities and lack of resilience; (6) implementing regulations and enforcement mechanisms are weak to non-existent; and (7) little progress has been made in social responsibility and commitment to reducing the vulnerabilities of at risk populations.
Private Sector and Disaster Risk Reduction: The Cases of Bogota, Miami, Kingston, San Jose, Santiago and Vancouver According to the study conducted by Sarmiento et. al (2013) with business owners from Bogota, Miami, Kingston, San Jose, Santiago, and Vancouver, the events that inspired major concern between managers are power outages (55.1%), followed by damage to facilities, equipment, and inventory (53.7%), and loss of telecommunications (38.2%).Other disruptive events feared by managers are water outages and supply chain disruptions, listed as disruptions of major concern by at least 32% of all sample respondents.
Additionally, the study indicates a correlation between company size and the presence of a business continuity plan.A far greater percentage of respondents from small businesses (those with fewer than 100 employees) indicated that their businesses had no BCM plans (65.8%).In comparison, about 28.7% of respondents from companies with 100 to 499 employees and 23.3% of respondents from companies with 500 or more employees indicated that no plan was currently in place.This highlights the fact small businesses are 59% more vulnerable to hazard and less prepared to build resilience in the aftermath.A robust body of research has demonstrated the importance of Disaster Resilience and Business Continuity for small businesses.Asgary et al. (2012) highlight the size of a business as the most significant factor on disaster impact on businesses.Some researchers suggest that a smaller business size is a major source of vulnerability to negative disaster outcomes (Alesch, Holly, Mittler & Nagy, 2001), while others argue that smaller businesses suffer disproportionally greater losses than larger businesses (Kroll, Landis, Shen & Stryker 1990).Further research suggests that smaller businesses have fewer resources to plan, respond, and recover from disaster impact (Runyan, 2006), which is in line with data that points that businesses with fledging financial conditions and smaller businesses have less chances of recovering from disaster related losses (Tierney & Dahlhammer, 1997).
Additional research also reflects on the ownership of the business premises as an important predictor that affects the preparedness and recovery.Researchers argue that owning a business facility provides more access to financial resources than renting (Dahlhammer & Tierney, 1996), and that one of the major impediments for small business in preparing for disaster was renting their business facilities (Dahlhammer & D'Souza, 1997).Further corroboration of these findings suggests that owners are more engaged in disaster preparedness than lessees (Asgary et al., 2012).
It is safe to say that building disaster resilience by preparing for disaster with a business continuity plan is vital for small business to thrive in the long run.More often than not, small business owners invest large sums of money, time, and resources to make their ventures successful and yet, many of them fail to properly plan and prepare for disaster situations (U.S. Small Business Administration, 2016).Possible explanations for this vary, ranging from small business owners' disbelief that a disaster would strike them, prohibitive costs, lack of resources, and general belief that a business continuity plan is not necessary (Hammock, 2015).Figure 3 describes business owners' reasons for not investing in a business continuity plan.

AD-MINISTER
Small business owners who claim that a business continuity plan is an unnecessary investment or that is not a high priority project for implementation in their enterprises might not realize the significant benefits reaped from such plans, especially in terms of return in investment (ROI).Many organizations utilize ROI procedures, a formula that measures and compares the tangible benefits of expenditures and discounts with those that are intangible, to quantify financial success of an investment and justify the necessary expenditures.Business continuity management benefits stem from understanding how "intangible" areas can also influence tangible business decisions, and this knowledge may reap relevant ROI results and tangible benefits (Cybulski, 2016).
Therefore, utilizing ROI calculations to make a case for investment in a business continuity management program may understate its real benefits.The complete range of benefits offered by a business continuity plan is only recognized after the planning and implementation processes have been completed (Cybulski, 2016).By understanding a business continuity plan, its objectives and planning components, small business owners can better understand the tangible and intangible benefits derived from it.

BUSINESS CONTINUITY PLAN
A business continuity plan can be described as "a set of technical, administrative, and management activities aimed at planning the steps to recover and restore critical business assets after an unforeseen event has impaired corporate functions."(Cremonini & Samarati, 2008, p. 671) The objective of a business continuity management plan is to define all the process, protocols, assets, and benchmarks for an organization to develop plans ensuring the safety of employees, its community and the continuity of time-sensitive operations (Cybulski, 2016).It is also important to highlight that, since unforeseen events can disrupt a business' operation and cause revenues loss, a business continuity plan to resume normal operations is essential not only for the survival of the company, but also for the recovery of the region where the business operates (Savage, 2002).
Scholars argue that business continuity planning originated during the 1970s, when mainframes and network technology gained prominence within business and methods of securing the data from unpredicted events that could undermine them (Cremonini & Samarati, 2008).Nowadays, BCP has evolved together with business models, expanding its focus from technology infrastructure to all the processes and management procedures involved in the continuation of the business in its entirety.The idea is that reducing down-time periods also accelerates recovery and business restoration (Cremonini & Samarati, 2008).
According to Aon Global Risk Consulting, three steps are essential when developing a business plan that is efficient and complies with standards, codes and best practices: 1) the Discovery Phase, which consists of business impact analysis and risk assessment; 2) the Planning Phase, composed of the emergency response and management and crisis management and communications steps; and 3) the Governance Phase, which follows the plan auditing, updating and exercising procedures (Figure 4).The Discovery Process phase of a business continuity plan seeks to identify potential risks that a company is exposed to, and measure the amount of disruption an organization can withstand or those that must be addressed.The first process of the Discovery Phase is the Business Impact Analysis (BIA), which seeks to identify and qualify the time-sensitive business functions and processes.By measuring these processes, organizations are enabled to understand the point in time when an impact starts to drive negative consequences.Once these impacts are understood, the organization can develop the framework to accept, remediate, or develop planning strategies to support organizational recovery (Cybulski, 2016).The next step in the Discovery Phase is the risk assessment and remediation (RA), which yields measurable results by quantifying and qualifying those risks and threats that can disrupt the organizations ability to continue time-sensitive business functions and processes (Cybulski, 2016).

Discovery Process
The second phase, the Planning Process, is composed of three separate but integrated plans to coordinate activities, authorities, and responsibilities during disasters.These plans utilize the information captured and analyzed during the Discovery Process phase to ensure the organization not only survives catastrophic events, but can more effectively manage the situation, and drive operational resiliency (Cybulski, 2016).The Emergency Management & Response plan outlines the initial strategies for responding to, and stabilizing an unforeseen event.First responders are responsible for life safety, stabilizing the incident, qualifying and remediation of damage, and communicating to authorities and the Crisis Management Team (Cybulski, 2016).
The second plan to compose the Planning Process phase is the Crisis Management & Communications plan, which bridges the responsibility and coordination between the response team and business restoration and operational recovery; providing leadership, decision-making, and communications structure to support the restoring of critical functions.The last plan to compose the Planning Process is the development of business restoration and operational recovery plans, which includes the strategy development, documentation and deployment of activities required to restore and recover functional operations to meet or exceed the recovery time objective (Cybulski, 2016).
Lastly, the Governance phase provides the organization with the ability to keep the business continuity plans updated and accurate to their situation and risks.Three steps are devised in order to take on that task: plan auditing, updating, and exercising.Plan Auditing provides a formalized method for measuring the management of business continuity processes, and determining the effectiveness of the organization's objectives, and understanding of capabilities or maturity of the plans.Plan Updating ensures accurate and up to date strategies; resources and agreements have been documented in compliance with the business continuity policy.The Plan Exercising step is then conducted on a preset schedule in order to allow the participating teams to practice the plan implementation, strengthen responsibilities and capabilities while identifying improvements to strategies and resources (Cybulski, 2016).
It is important to highlight that these are general and broad steps that business continuity plans include in order to assess disaster risk and to provide guidelines for swift recovery of operations.Managers and small business owners that possess the full knowledge of their business will be able to fine tune the BCP to their company's needs.Additionally, disasters can take several forms.Some primarily affect individuals, while others have a larger, collective impact, such as natural and manmade disasters.Even though some of them may only cause short-term disruptions in normal business operation, the recovery of an impacted area from the many disasters can take much longer, especially if organizations have not made preparations in advance (Disaster Recovery, 2016).

FIU, BUSINESS CONTINUITY AND SMES FROM SOUTH FLORIDA AND LAC
Based on the 2012 public-private study conducted by FIU-EEI, particularly on the findings that business size matters and that there is an urgent need to overcome "risk indifference", FIU understood the challenge and initiated a comprehensive strategy to focus on small businesses to help them incorporate business continuity plans (BCP) and disaster risk reduction measures in their daily operations.In 2014, the EEI-DRR program began the project involving business school representatives from the USAID/OFDA priority countries to expose them to the BCP-DRR approach in order to mainstream disaster risk reduction into their academic programs and community services.The project emphasizes partnerships between universities, national emergency organizations, chambers of commerce, and small business associations (tourism, food and agriculture, services) at national, sub-national, and local levels.
The initiative encompasses four interventions: (1) developing a Small-and-Medium Enterprise (SME) disaster resiliency and recovery toolkit (in collaboration with the FIU Small Business Development Center (SBDC) to merge BCP and DRR into one single, comprehensive, and practical guideline; (2) translating that guideline into Spanish and adapting it to the Latin American and Caribbean environment; (3) implementing a 'train the trainers' strategy on the toolkit's usage; and (4) developing an SME application (SME app) (in collaboration with the FIU-Digital Communications Unit), based on the information in the SME toolkit.The SME App, developed for both iOS and Android mobile devices and tablets, will be available in both English and Spanish.
In addition, FIU-EEI joined the UNISDR (United Nations Office for Disaster Reduction) Private Alliance for Disaster Resilient Societies (ARISE) in 2013, leading Activity Stream #4: State of the Art Disaster Risk Management, Education, Training, and Outreach.In 2015, UNISDR and ARISE, with support from the Federal Government of Germany's Ministry for Economic Cooperation and Development (BMZ) partnered with FIU-EEI and twelve leading business schools to improve or introduce disaster risk management in higher education curricula and training services, which supports Priorities for Action I, III, and IV of the Sendai Framework.The process began with a call for White Papers that proposed innovative approaches to mainstreaming cutting-edge disaster management content into MBA programs and other academic offerings, themes addressed at the Toronto's DRR and Business Education Workshop in March 2016.The project also sought to engage the support of larger experienced corporations, particularly those working in public-private partnerships.
The Small Business Development Center (SBDC) and the Extreme Events Institute (EEI) head Florida International University's commitment to South Florida's community of Small and Medium Business Enterprises. .Both institutes have developed activities with cutting-edge knowledge of Business Continuity in order to provide support and increase the disaster resilience of the SMEs community.The SBDC activities with the Small Business community focus on South Florida's hurricane season, helping owners understand and assess the disaster impact on their business.Additionally, the SBDC presents Business Continuity as an achievable competitive advantage for small business owners, while helping to build disaster resilience by exposing stakeholders to essential concepts such as risk management, contingency planning, emergency preparedness, disaster recovery planning, succession planning, business continuity planning, cyber-security assessments, and disaster recovery planning.
The following are a collection of materials that the SBDC utilizes in their training and consulting activities: • SBDC Disaster Checklist: A general checklist of everything that is vital for the small business owner to run its company.The checklists contain advice on how to prepare the essential aspects of the business, such as employees, customers, suppliers, equipment, property, company records, and insurance related information.
• Disaster Tabletop Exercise: The SBDC provides small business owners with training by applying scenarios in order to assess a business's disaster resilience.The purpose of the exercise is to review and discuss the actions they would take in a particular emergency, testing their emergency plan in an informal, low-stress environment.• SBDC Data and Cyber-Security Checklist: The institute also provides data and cyber-security advice for small business owners in order to increase their protection against cyber-attacks and critical data loss.The advice ranges from internal procedures to minimize risk to hardware and asset management.• Disaster-related Apps: The SBDC also provides small business owners with additional sources of information and tools to help build disaster resilience for small business owners.The following are the most popular apps for disaster preparedness and recovery: Box 2: Popular apps for disaster preparedness and recovery

Disaster-related Apps
Below are some of the most popular apps for disaster preparedness and disaster recovery: 1. Red Cross The Red Cross is the gold standard in terms of quantity and quality of disaster apps.Their apps include first aid apps, hurricane apps, shelter finder apps, and a very informative app for children teaching them disaster preparedness tips.http://www.redcross.org/prepare/mobile-apps.

ICE Standard
This app helps first respondents and emergency room personnel locate a person's updated medical information, emergency / medical contacts, medical insurance information, blood type, name, address and a photo verification of the individual.It backs up this information on your phone, so you can access it in your car with family/friends.http://emergencystandard.org/apps.

FEMA
If you download this app, you can receive alerts from National Weather Service for five different locations, access maps of disaster resources and shelters, and utilize other features.The app also has Spanish language capability and allows you to access Federal disaster assistance from your smartphone.http://www.fema.gov/mobile-app.
The Extreme Events Institute has also developed several activities and tools in order to provide small business owners and other stakeholders to improve their businesses' disaster resilience.One of the best examples of EEI's engagement with the small business community is the promotion of Pasantías, or practicums in English.The motivation behind the Pasantías is to bridge the gap between the conceptual, the operational and the practical by combining site visits, presentations, real world observations, and discussions, taking advantage of noteworthy experiences and capabilities in South Florida.
The Pasantías aim to bring together professionals, technicians and leaders working in public administration, project management, non-government and international organizations, private sector, and academic institutions who have disaster risk reduction and/ responsibilities, putting special attention on those who can guide or influence their institutions toward improved disaster risk reduction and resilience.The Pasantía also looks at Business Continuity and Disaster Resilience from a high-level research down to community preparedness and illustrates the private sector's corporate social responsibility of developing Emergency Plans and Business Continuity Plans.A noteworthy fact of the Pasantías is that it not only involves stakeholders from South Florida's multi-cultural environment but also from Latin America and the Caribbean, extending its reach and commitment to small business owners and informal sector operating in those countries.The Pasantías provides real examples of topics such as risk identification and vulnerability assessment, risk reduction and transfer, and disaster management, recovery and business continuity plans.
Another example of EEI's activities aimed towards disaster resilience and business continuity for small business is the new Disaster Resiliency Toolkit for Smalland Medium Sized Enterprises (SMEs).This initiative is embodied by a mobile app that allows its users to have an accessible and easy-to-understand way to build 4. Hurricane Tracker This is a very comprehensive app focused on hurricane-related information.You can see live hurricane briefings, access NOAA weather radio, see detailed satellite loops and maps, and receive updates on your phone.http://itunes.apple.com/us/app-hurricane-tracker/id327193945.

Emergency Radio
The Emergency Radio app gives you live access to EMS, police, fire, NOAA weather and other frequencies.You can add favorites to quickly access those frequencies in an emergency.http://www.edgerift.com/emergencyradio/.disaster resilience by self-designing and implementing business continuity plans for their organizations.The app allows users to answer a predetermined questionnaire about their organization that can relate from its assets, business category, number of employees, annual sales and more.The questionnaire is the first step a user takes to assess the risks their businesses face and a fundamental step for the construction of a solid and reliable business continuity plan.The Disaster Resiliency Toolkit for Small-and-Medium Sized Enterprises app offers a step-by-step approach to building a Business Continuity plan.The whole plan is composed of a business assessment, response and recovery steps.Inside each step, the app provides users with brief explanations of what constitutes the phase of the Business Continuity plan for a better understanding.After the user completes filling all the categories to build its Business Continuity plan, the app provides useful advice for small and medium business owners and suggests other apps that will provide further information, allowing them to build disaster resilience into their organizations.The Disaster Resilience Toolkit for Small-and-Medium Sized Enterprises is a very useful tool for small and medium business owners to prepare for unforeseen events, as well as an accessible and educational tool to spread knowledge on how to build business continuity plans.The Disaster Resilience Toolkit for Small-and-Medium Sized Enterprises will be available in English and Spanish for both mobile operational systems iOS and Android by June 2016.

CONCLUSIONS
The quest to involve business schools in disaster risk reduction topics represented an important challenge during the last decade for all actors involved.Looking for windows of opportunity, the FIU-EEI DRR program has developed a systematic strategy with two approaches: first, identifying business schools to mainstream the crosscutting topics of disaster risk reduction.During this process, several business schools with key themes related to crosscutting issues of business and disaster risk reduction in their curricula were selected.Second, fostering a better collaboration between business schools and small business enterprises and associations.With this strategy in mind, the FIU-EEI DRR program, with support from USAID, has organized a workshop in Medellín, Colombia, in June 2016.The workshop aims at exposing leading business schools from six Latin American and Caribbean countries to the BCP-DRR approach to mainstream DRR into their academic programs and community services.FIU expects that business schools along with their national emergency organizations will reach out to other stakeholders, such as chambers of commerce and small business associations, after this experience.
Both institutes, SBDC and EEI, embody FIU's passion for entrepreneurship and its commitment to the SMEs community.The Small Business Development Center, by providing South Florida's entrepreneurs with a range of professional activities, such as business consulting and management training, plays a key role in disseminating vital information for small business owners and aspirant entrepreneurs to face the challenges of the global business environment, and build increasingly resilient operations against unforeseen events.The Extreme Events Institute sets a true example of FIU's "Worlds Ahead' spirit by leading research and applications in extreme events and developing cutting-edge knowledge in disaster resilience, including disaster risk management, vulnerability reduction, preparedness, business continuity, emergency response, and resilience.Together, these institutes make much more than a case for FIU's experience with Small-and-Medium Sized Enterprises.

Figure 3 :
Figure3: Adapted from The Three Steps of a Business Continuity Plan(Cybulski, 2016)