My NacuboWhy Join: Benefits of Membership

E-mail:   Password:   

 Remember Me? | Forgot password? | Need an online account?

Business Officer Magazine

Up and Running Again

Develop a plan for continuing the business of your institution no matter what unexpected scenario may arise.

By Barbara Johnson

Because many colleges and universities offer vital workforce and career training and provide critical medical services to urban and remote locations, they bolster the economic and social base of the communities in which they reside. Similarly, the strength of an institution is often inextricably linked to the community it serves—another of many lessons taught by Hurricane Katrina in particular. Widespread damage to Gulf Coast utilities and communication and transportation infrastructure has made recovery efforts for affected institutions much more complicated.

No matter the threat—whether an isolated, short-term interruption or a wide-scale catastrophe—institutions can’t afford to leave business continuity planning on the back burner. Yet, this realization alone does not make it easier to engage in the kind of comprehensive planning required. Following are key elements of a business continuity planning tool that is available at (see sidebar, “Online Planning Tool”).

Identify Risks

A well-developed business continuity plan guides an institution through the evaluation of activities and processes that constitute “normal operations.” Whereas in the past many business continuity plans were limited to systems operations, it is now advisable to focus on all institutional resources and critical areas of administration and instruction. Likewise, while campuses may already have in place an emergency response plan, a business continuity plan goes further. Done well, it provides for an in-depth, longer-term response to risk factors beyond emergency or disaster situations and considers all internal and external factors that may impact the institution’s overall goals.

A thorough risk assessment entails conducting an in-depth review of the resources and operations that are critical to meeting goals and objectives.

Strategic risks: Long-term risks that may affect whether the institution can meet its goals and objectives. Examples: changes in enrollment trends, unionized employee disagreements, and limited campus expansion opportunities.

Financial risks: Risks that can affect the institution’s financial stability. Examples: improper cash management controls, financial system failures, fraud, misappropriation of funds, mishandling of designated funds, poor endowment investment decisions, and issuing of payroll and service provider payments.

Legal risks: Risks associated with conforming to local, state, and federal rules and regulations. Examples: failure to comply with regulations regarding foreign students and faculty; non-compliance with EEOC, OSHA, and workers’ compensation regulations; and not training staff to comply with regulations.

Operational risks: Risks associated with the institution’s major functions. Examples: academic programs, auxiliary services, athletics, facilities, and sponsored research.

Technological risks: Risks associated with computer, telephone, cable, and satellite services. (Some business continuity plans group technological risks with facilities.)
An important component of assessing risk in a given area is to begin by asking key questions that identify weaknesses or gaps.

Answer the Tough Questions

Good business continuity planning includes taking stock of current operations. Here are some of the key questions associated with assessing operational and financial risks.

  • Does the institution have adequate means for safeguarding its financial assets, systems for safeguarding its financial records, and an inventory system to account for assets above a certain threshold?
  • How does the institution manage its payroll and disbursement function and its cash operations? Does the institution have a plan for issuing payroll and vendor payments during a disaster?
  • How does the institution record, track, invest, and manage its endowment? Does the institution have policies regarding fraud and misappropriation of financial assets?
  • How does the institution handle the accessibility, accuracy, integrity, security, and confidentiality of its data and information systems? Does the institution have backup and recovery plans, a data exchange partner, and plans to control all information on its Web site?
  • Does the institution have a parking and transportation plan, a campus plan that identifies maintenance needs for facilities and grounds, an adequate facility security plan, and a plan regarding emergency shelter?
  • Does the institution have a plan for safeguarding and disposing of hazardous waste?
  • Does the institution have a plan for medical services during a disaster?
  • Does the institution have business interruption insurance, and does this insurance cover all fixed and variable expenses when a disaster or a disruption of normal operations occurs?
  • Does the institution have space that could be used to temporarily house classrooms or offices, or is land available on which to place temporary modular or trailer housing?

While such questions provide critical assessment concerning short- and long-term response for continuing operations, at a minimum every college and university should have in place a well-conceived response to a disaster event. An emergency response plan—one central component of a business continuity plan—should be practiced and easy to follow and implement.

Write It Down

The extent and complexity of your emergency response plan will depend on your institution’s geographic location and the types of emergencies or disasters likely to affect your campus.

Among the key elements to include:

  • A definition of what constitutes an emergency or disaster based on the event’s nature and extent.
  • A clear indication regarding at what point the plan would be activated.
  • An organizational plan identifying all involved parties and the chain of command.
  • The names and telephone numbers of critical staff and agencies, including backup personnel.
  • The name of the chief spokesperson responsible for notifying external audiences and the campus of the emergency or disaster.
  • A list of supplies and equipment needed during an emergency.
  • Actions to take in the aftermath of an emergency or disaster, such as quickly evacuating the campus, securing the affected areas, and relocating affected campus members.

Mobilize Your Response

To develop a plan that enables your institution to effectively manage any type of disaster, consider implementing the following recommendations:

  • Obtain the support and cooperation of key administrators—not only during the development stage but whenever the plan is tested and updated.
  • Assess the vulnerability of the campus, and design alternate plans for relocating and evacuating the campus.
  • Determine responsibilities and the level of response appropriate to each type of disaster. For example, what activities would be necessary in the event of a campus evacuation, exposure to hazardous chemicals, or exposure to a communicable disease? For some types of emergencies, various rules and regulations would apply at the local, state, and federal levels.
  • Organize a planning committee that consists of campus personnel as well as key players in the surrounding community. Include state-level representatives, if appropriate.
  • Organize emergency response teams throughout the campus. Ensure that the personnel on each team are equipped to handle the types of disasters addressed in the emergency response plan. Consider appointing a coordinator for each building to ensure compliance to the plan.
  • Coordinate with emergency agencies in the surrounding community and with other external agencies that would assist in recovery.
  • Evaluate external resources, such as the proximity and capabilities of fire departments, emergency medical services, hospitals, and police.
  • Develop a multilayered communication plan for internal and external purposes. Determine what type of system is necessary when normal lines of communication are not available. For example: satellite telephones; standard, non-electric telephones; HAM radios; text messaging; telephone lines hosted at another institution; and any disaster-related services provided by your local telephone company.
  • Benchmark your plan against those prepared by similar institutions.
Online Planning Tool

On the heels of the major storms in 2005, NACUBO and the American Council on Education swiftly joined forces to develop, a clearinghouse of resources for institutions, students, faculty, and staff to aid in disaster recovery. While this site emerged in immediate response to the 2005 hurricanes in particular, the resources available from this site are applicable to the range of operational interruptions and disaster recovery efforts institutions may face.

One recently added resource is a business continuity planning model to assist with campus plans. The online tool includes best practices, checklists, key components of an emergency preparedness plan, a sample institutional plan, and links to government and organizational resources and literature.

This model is an outgrowth of the many conversations NACUBO staff conducted with hurricane-affected institutions during the first several months following the storms—in part to determine what had worked well with recovery plans and where institutions were underprepared. One revelation was that while the events that occurred in connection with Hurricane Katrina were of a catastrophic nature, many institutions had not done the type of planning to allow business to continue even on a limited basis. A good business continuity plan can help ensure at a minimum that critical systems remain up, that key processes such as payroll and vendor payment stay on track, and that communication channels are in place to track the whereabouts of students, faculty, and staff.

To access the full model, go to In addition to serving as a valuable guide for administrators, the model can be incorporated into an institution’s curriculum. The tool readily provides study and research opportunities by raising issues about financial, sociological, organizational, governmental, and environmental impacts of disasters.

Prepare for Everything

Because no one can predict when or to what extent damages may occur from either natural or human-caused disasters, institutions must be prepared for the multitude of scenarios that may arise. Despite heavy debris cleanup, relocation of offices and classrooms, and compression of course schedules, the majority of institutions directly impacted by Hurricane Katrina did resume operations within the first two months. For other institutions, leaders first scrambled to help students maintain studies at colleges and universities across the nation or online for the fall 2005 semester and then spent intervening months developing plans and figuring out logistics to reopen for the spring. Some, though not all, did so on their own turf. Nearly a year later, those institutions hardest hit are in the final stages of preparing their campuses to welcome “home” a new class of freshmen. (To read more about these efforts, read “Grit and Soul” in the May 2006 issue of Business Officer.)

A business continuity plan offers no guarantee of when or whether operations will resume as normal. However, having a well-conceived plan in place will help mitigate any damages incurred by ensuring that a campus is better prepared to handle a disaster—whatever form it may take and whenever it may strike.

BARBARA JOHNSON is a higher education consultant based in Northfield, Minnesota. From September 2005 until March 2006, she served as consultant to NACUBO and was instrumental in developing the business continuity model now available at