Most US small businesses lack disaster-recovery plans

More than 60% of US small businesses do not have a formal emergency-response plan and fail to back up their financial data off-site, leaving them vulnerable to catastrophic data loss in the event of a natural disaster.

The Small Business Disaster Preparedness Study, conducted by software maker Sage North America, found that while 94% of small US businesses back up the financial information stored on their computer systems, most of them store their backups on-site. For these companies, a flood, fire or earthquake that destroys their office and primary computer system could destroy their back-up data as well. That would cost the business access to crucial information and could imperil its ability to survive.   
 
“Backing up on-site may not be sufficient to protect small businesses from natural disasters—particularly if the business is located in an area prone to earthquakes, hurricanes, fires or flooding—or more common crises, such as theft or hardware malfunction,” Connie Certusi, executive vice president and general manager of Sage Small Business Accounting Solutions, said in a news release.

“Data loss could have a serious impact on operations and crisis recovery,” she added. “The development of a preparedness plan that includes solutions for protecting critical information, such us backing up off-site, could be the difference between getting a business on its way to recovery and worrying about its survival.”

Sage—which surveyed chief executives, presidents and owners at 504 US small businesses, all of which are Sage customers—found that 62% of small US businesses have not established a formal plan for responding to a natural disaster or another emergency. Asked why they don’t have a formal disaster or emergency preparedness plan in place, one-third of the respondents chose this answer: “I’ve never had an issue before/disasters are rare in my area.”

Another 30% chose this response: “I haven’t really thought about it,” while 27% indicated that they don’t believe it’s important to their business and 20% said that they haven’t had time to develop and institute a plan.

Among the 38% of companies that do have a formal emergency- or disaster-preparedness plan, nearly nine in 10 said that data backup is covered in their plans. Asked why they have an emergency plan, a majority of respondents said that the plan is a precautionary measure—that is “the smart thing to do.”

The poll also found that:

• 48% of small businesses that back up their data do so daily and another 17% do so “a few times a week.” All told, 98% of the small businesses that back up their data do so at least once a month.
• 83% of businesses that back up their data can do so in less than an hour, with another 8% needing between one and two hours.
• Nearly 30% of executives whose businesses back up their data do so because of a prior experience losing data.
• 16% of those businesses backing up their data do so on-site and off-site.

Resources for disaster recovery planning are available on AICPA.org. 

Related CGMA resources:

• Smart risk management: A guide to identifying and calibrating everyday business risks: Effective risk management does not always translate to risk reduction. While not enough effort in controlling risks is dangerous, too much drains resources and impedes innovation. Find your balance.

• Case studies on enterprise risk management implementation: Walk through the process of implementing an ERM programme with a real-life organisation, as the board and management identify and rate significant risk categories.

• How to evaluate enterprise risk management maturity: This Enterprise Risk Management assessment tool can be used by senior executives and their boards of directors to evaluate the strength and relevance of their organisation’s existing risk oversight processes.
   

—Jeff Drew (jdrew@aicpa.org) is a CGMA Magazine senior editor.