Business Continuity Plans: Lessons Learned From Puerto Rico

The pandemic and subsequent supply chain disruptions have been harsh reminders of the need for manufacturers to create or update their business continuity plan (BCP). Disruptions of some sort are likely, and manufacturers must be prepared for all types of scenarios including natural disasters, technical failures and cyberattacks.

Having a BCP already in place is essential for the initial response to a disruptive event. A BCP also enables manufacturers to continue operations and can help during an extended period of time. We know this all too well here in Puerto Rico. In the past six years we have endured:

• Hurricanes: Irma and Maria came two weeks apart in September 2017, resulting in power outages for nearly a year in some mountainous regions of the island. Hurricane Fiona drenched Puerto Rico in September 2022 with 30 inches of rain in 48 hours.
• Earthquakes: A swarm of 11 earthquakes, including one with a magnitude of 6.4, hit the island in 2019-20.
• Pandemic: Of course, as it did globally, the COVID-19 pandemic impacted the island’s operations and amplified employee safety concerns.

Because of all these disruptions, we have quite a bit of experience with BCPs at the Puerto Rico Manufacturing Extension Inc. (PRiMEX). In fact, we have helped more than 320 companies complete a BCP.

Some of the common shortcomings that small and medium-sized manufacturers tend to have related to business continuity include:

• Lack of documentation for standard operating procedures or standard work.
• Need for cross-training to ensure adequate coverage for every task.
• Lack of preventive maintenance and inventory of key replacement parts.
• Not fully understanding employee concerns and family wellbeing during disasters.

Get started on your business continuity plan

Companies should take these steps to get started preparing a BCP:

Get a knowledgeable outsider’s input. It’s important to get an outside set of eyes to take a hard look at your processes. A person with no stake in your operations will ask legitimate questions and see things that you will not. However, this person should know your industry and ideally be familiar with the types of processes you use.

Set aside the time. It’s important to look at this input thoroughly and answer all questions. This will take longer than a few hours or even a day – plan for a series of sessions. This is an investment in your business and will pay dividends when there’s a disruption.

Documentation is essential. Many small companies operate with a handful of people, each doing multiple tasks. Each key player may do tasks a little differently. There may not be cross-training or documentation of standard work. This is not a concern until you are in a crisis situation.

5 risk mitigation strategies

We identified five important risk mitigation strategies that should be a focus of every BCP.

1. Organization, protocols and communication

What if there is a fire in your facility and your owner is traveling? Is there a clear plan for who is responsible for what? Be sure to include details in your BCP. And require everyone to have a hard copy of the BCP outside of the building – it does no good on a desk or laptop if it can’t be accessed in an emergency.

A checklist for your BCP might include:

• Define roles and responsibilities. Crisis management and escalation must be defined. Identify a primary and alternate contact for each key function. Who is authorized to make decisions and speak with authorities? Who is authorized to communicate with employees, customers and suppliers?
• Have a process for aligning your messages. How do you ensure everyone is relaying the same information? Be sure to consider that employees are under a lot of stress during disaster scenarios.
• Identify what channels to use. A chat tool works well, but that depends on network access. One manufacturer we worked with instructed employees to listen to a specific radio station that broadcast local company updates as a public service.
• Periodic testing. Do practice scenarios, including evacuations.

2. Materials, suppliers, warehousing and logistics

Our recent experience in Puerto Rico includes hyperlocal, regional and global disruptions. Plans for each are likely to be different, especially if your competitors are not impacted. For example, a hurricane may affect only a portion of the island.

From a supply chain perspective, consider:

• Supplier management. Have continuity plans for critical supplies and suppliers. This is especially important for sole source suppliers that impact your major product lines. Some smaller manufacturers in Puerto Rico had no sourcing outside the island. The MEP National Network’s supplier scouting service is a great resource for this.
• Warehousing. Here in Puerto Rico many manufacturers have implemented inventory and material requirement plans, considering safety stocks, lead time, and critical raw materials. They now boost inventory before hurricane season and consider alternative warehousing for key customers and suppliers.
• Routes and logistics. Have backup capability, whether it’s deliveries to customers or moving inventory from alternate warehouses.

3. Facilities and maintenance

A common problem for local manufacturers has been the inability to keep critical machines operational through various disruptions. Many have not performed preventive maintenance or don’t have critical parts in reserve, causing subsequent issues. Securing a key machine part from Asia has become a considerable challenge in recent years.

Preventive maintenance plays a key role in risk mitigation plans. Where can you be proactive to reduce unexpected and costly surprises? For example:

• Total Preventive Maintenance (TPM). TPM is essential for unique critical equipment with no manual back up. A veteran operator may know the machine so well they can tell by the sound that it is about to break down, but an inexperienced operator won’t realize this.
• Power. Ask yourself key questions: Have you done maintenance on your emergency generators? Do you regularly replace filters? In Puerto Rico, manufacturers need to have alternate energy sources (such as solar) to reduce dependence on the island’s energy grid.
• Fire prevention. In Puerto Rico, propane tanks need an earthquake valve for automatic shutdown in the event of a leak. Having a valve and other safety measures related to fire prevention and control in place protects many assets.

4. Employees and remote work

It is important that people have access to information about who does what work at your company, especially during an emergency response. Many small manufacturers rely on flexibility among their employees, but it may not be clear who is next in the line of responsibility during a crisis. You will want to identify backups and even a three-deep roster. You might want to have a succession plan for critical positions, which is especially important as longtime employees are aging out.

Many manufacturers here in Puerto Rico have had to develop remote procedures for office functions. This includes everything from documenting standard work instructions to equipment capabilities and access to networks and accounts. They also had to develop manual workarounds for critical office processes in case their main systems fail. You can’t account for all the “what ifs,” but be sure to account for key office functions.

5. Informatics and IT

The multiple natural disasters in Puerto Rico created ongoing issues ranging from lack of power for extended periods to internet outages. Many manufacturers have added satellite internet as a primary or alternate source, which also brings more cloud capability into consideration. Others have made plans for alternative offices and how to get employees connected to a network quickly.

Other considerations include:

• Back-ups. Data back-up services for safeguarding critical business information, including servers, computers and cloud-based applications.
• Remote connections. Improvements in remote connections for a work-from-home strategy, which might mean acquiring company laptops and implementing a VPN connection for more secure data management.
• Cybersecurity. Cybersecurity that accounts for remote work connectivity.
• Fire suppression. Installation of fire suppression systems in the server room.

It’s easy to get into the weeds when you are talking about IT backups and server recovery. The reality is you will need separate plans beyond your BCP for your communications network recovery and your cybersecurity.

Your local MEP Center can help you with a business continuity plan

Business continuity planning enables you to prepare for the impact of a broad range of threats including natural disasters, disease outbreaks, accidents and terrorism. Your local MEP Center can assist you in developing a plan unique to your needs.