Today's news broadcasts bring us daily reports of disaster—both natural and man-made. Earthquakes, floods, fires, ice storms, hurricanes, software viruses, riots and even planes crashing into buildings are just a few of the disasters we face today. When these disasters occur, our initial thoughts naturally turn toward the loss of life and injury to persons. It is only after these thoughts fades that we consider the loss of property. Most never consider the losses that can occur to a business.

"According to the U.S. Bureau of Labor, most businesses that experience a major disaster are no longer in business within five years. Why? Estimates are that only one-quarter of companies in the United States consciously prepare for disaster recovery. Most do nothing."¹ Doing nothing, in light of the world we live in today, could be the greatest disaster of all.

What can or should you do to prevent a disaster from ending your business? Experts agree that every company must create a "business continuity" or "disaster recovery" plan. In addition, that plan must be constantly updated as the company grows and changes. There are a few basic goals to keep in mind that will help you to formulate your plan. Kenneth L. Fulmer, a certified contingency planner with the Disaster Recovery Institute, states that "the goal is to ensure that you have the following basics if a disaster strikes:

• an alternate business location;
• access to vital records and resources during the recovery;
• key people assigned to the recovery effort; and
• a plan for speedy recovery."²

Having an alternate business location is vital to any continuity of business. A real estate agent and/or building manager can assist in locating space that would be available should the need arise. The space does not have to be as large as your current location, but it should be able to house your disaster recovery team. With today's technology, other employees would be able to work from home once a new network connection is established. Computer equipment is an important element when locating the appropriate temporary space. For a law firm, Edward Poll suggests creating a reciprocal arrangement with another firm that utilizes similar computer, accounting and litigation support equipment.

Access to vital records and resources is one of the most important features of a recovery plan. This requires a continuous back-up of everything that is saved on all firm computers as well as crucial paper records. A scanner would be a great investment as it would alleviate the costs of copying and storing large amounts of paper. Storage of the back-up tapes/disks and the paper records must be kept off-site.

The selection of key personnel for the creation of an emergency response team is vital to any recovery effort. It is important to remember that your current organizational chart may look quite different from the names that appear on the response team list. The purpose of this team is to coordinate all activities during the recovery period, so the team should be an assortment of personnel from all necessary departments. Depending on your business, the team may even include representatives from outside vendors and suppliers and even temporary staff.

The first step in creating a sufficient disaster recovery plan is to assess the risks involved should disaster strike. Prepare a comprehensive list of any potential incidents that could affect the business. The list of possible threats to your business is endless, and in addition to the common ones we immediately think of, such as earthquakes or fires, there are such things as hazardous material spills, terrorism, computer system failure, computer viruses and human error, including such things as misconduct or even substance abuse. Even if the likelihood of the event happening is remote, it is still better to include it on the list. Then analyze the possible consequences of each type of disaster. Determine the cost to replace and/or repair damaged physical property. More difficult, but most important, determine the potential business impact, such as potential violations of contractual agreements, loss of market share, interruption of your products or services and interruption of supplies. It is easier to create the plan once you've determined what possible effects a disaster could have on your business.

As part of this plan, it is important to thoroughly analyze your insurance coverage. Include your insurance agent in your review to assure that you fully understand the coverage, deductibles and exclusions from the policy. Have the list of potential disaster incidents with you as you review the policy to make sure certain disasters are covered. Often, additional riders are required to cover such events as floods and earthquakes. Mr. Poll suggests to make sure your policy covers "damage to or loss of real and personal property, loss of revenue [this is termed "business interruption" coverage and will continue to pay profits and ongoing firm expenses as if nothing had happened], general liability, reconstruction of destroyed documents and extra expenses related to a disaster or catastrophe." With respect to insurance, it is also helpful to maintain an updated inventory list as well as photographs of the contents of your offices. And of course, the inventory list and photographs should be stored off-site.

The next stage in your plan is to determine which critical business functions will need to be resumed, in what order they are to be resumed and the responsible party for each phase of the recovery. Most recovery specialists recommend creating scenarios based on the extent of the damage. For example, let's say that a computer virus attacks a company's computer system. The plan should have a scenario for both minor damage as well as one for severe damage. Minor damage can often be repaired quickly without much impact on the business as a whole, while severe damage could require the creation of an entire new system including new hardware. The recovery team, once it determines the extent of the damage, will be able to follow the steps outlined in the plan to allow for a speedy and efficient recovery.

The most important part of any recovery plan is communication—including internal staff as well as your clients and vendors. The plan should contain updated telephone contacts for all employees. Depending on the size of your business, you can easily set up a "phone-tree" to notify the staff of any emergency situation. The plan should also contain an updated telephone list of vendors and clients and the person assigned to contact those parties. It is imperative that these lists be updated continually and stored off-site. Mr. Poll notes that "it is typically easier to call out of—rather than into—a disaster area," and therefore "another good idea is to set up an out-of-area contact. This can be a business contact of another law firm outside your immediate area that could act as a clearinghouse for information." Most important, with respect to communication to your employees as well as vendors and clients, is to be prompt and provide honest information regarding the disaster and how it is being handled. Clients will feel more comfortable knowing that you are concerned about their needs even when you have a mess on your hands. Contacting them with the information before they make a frustrating effort to track you down will go a long way in your continued relationship with them.

Once you have your recovery plan in place, assign a responsible employee or employees to the maintenance and distribution of updates to the plan. Those employees should be continually working with human resources and your accounting department to update the employee, customer and vendor lists. In addition, they would be responsible for maintaining up-to-date lists of inventory and assets.

The best advice is to not assume it can't happen to you. It can, and it will; the best thing you can do is be prepared.

---

Footnotes

¹ Poll, Edward, "Planning for Disaster: Suggestions for Being Prepared for the Worst," American Bar Association, Law Practice Management Section, June 2002 (www.abanet.org/lpm/newsletters/articles/ newsarticle0202_p3_front.shtml). Return to article

² Fulmer, Kenneth L., "Business Continuity Planning, A Step-by-Step Guide," The Rothstein Catalog on Disaster Recovery, 2000 Edition. Return to article