When Disaster Strikes - Strike Back

Today's news broadcasts bring us daily reports of disaster—both natural and man-made. Earthquakes, floods,
fires, ice storms, hurricanes, software viruses, riots and even planes crashing into buildings are just a few of
the disasters we face today. When these disasters occur, our initial thoughts naturally turn toward the loss of
life and injury to persons. It is only after these thoughts fades that we consider the loss of property. Most
never consider the losses that can occur to a business.

</p><p>"According to the U.S. Bureau of Labor, most businesses that experience a major disaster are no longer in
business within five years. Why? Estimates are that only one-quarter of companies in the United States
consciously prepare for disaster recovery. Most do nothing."<small>^{<a href="#1" name="1a">1</a>}</small> Doing nothing, in light of the world we live
in today, could be the greatest disaster of all.

</p><p>What can or should you do to prevent a disaster from ending your business? Experts agree that every
company must create a "business continuity" or "disaster recovery" plan. In addition, that plan must be
constantly updated as the company grows and changes. There are a few basic goals to keep in mind that will
help you to formulate your plan. Kenneth L. Fulmer, a certified contingency planner with the Disaster
Recovery Institute, states that "the goal is to ensure that you have the following basics if a disaster strikes:

</p><ul>
<li>an alternate business location;
</li><li>access to vital records and resources during the recovery;
</li><li>key people assigned to the recovery effort; and
</li><li>a plan for speedy recovery."<small>^{<a href="#2" name="2a">2</a>}</small>
</li></ul>

<p>Having an alternate business location is vital to any continuity of business. A real estate agent and/or
building manager can assist in locating space that would be available should the need arise. The space does
not have to be as large as your current location, but it should be able to house your disaster recovery team.
With today's technology, other employees would be able to work from home once a new network
connection is established. Computer equipment is an important element when locating the appropriate
temporary space. For a law firm, Edward Poll suggests creating a reciprocal arrangement with another firm
that utilizes similar computer, accounting and litigation support equipment.

</p><p>Access to vital records and resources is one of the most important features of a recovery plan. This
requires a continuous back-up of everything that is saved on all firm computers as well as crucial paper
records. A scanner would be a great investment as it would alleviate the costs of copying and storing large
amounts of paper. Storage of the back-up tapes/disks and the paper records must be kept off-site.

</p><p>The selection of key personnel for the creation of an emergency response team is vital to any recovery
effort. It is important to remember that your current organizational chart may look quite different from the
names that appear on the response team list. The purpose of this team is to coordinate all activities during
the recovery period, so the team should be an assortment of personnel from all necessary departments.
Depending on your business, the team may even include representatives from outside vendors and suppliers
and even temporary staff.

</p><p>The first step in creating a sufficient disaster recovery plan is to assess the risks involved should disaster
strike. Prepare a comprehensive list of any potential incidents that could affect the business. The list of
possible threats to your business is endless, and in addition to the common ones we immediately think of,
such as earthquakes or fires, there are such things as hazardous material spills, terrorism, computer system
failure, computer viruses and human error, including such things as misconduct or even substance abuse.
Even if the likelihood of the event happening is remote, it is still better to include it on the list. Then
analyze the possible consequences of each type of disaster. Determine the cost to replace and/or repair
damaged physical property. More difficult, but most important, determine the potential business impact,
such as potential violations of contractual agreements, loss of market share, interruption of your products or
services and interruption of supplies. It is easier to create the plan once you've determined what possible
effects a disaster could have on your business.

</p><p>As part of this plan, it is important to thoroughly analyze your insurance coverage. Include your
insurance agent in your review to assure that you fully understand the coverage, deductibles and exclusions
from the policy. Have the list of potential disaster incidents with you as you review the policy to make sure
certain disasters are covered. Often, additional riders are required to cover such events as floods and
earthquakes. Mr. Poll suggests to make sure your policy covers "damage to or loss of real and personal
property, loss of revenue [this is termed "business interruption" coverage and will continue to pay profits
and ongoing firm expenses as if nothing had happened], general liability, reconstruction of destroyed
documents and extra expenses related to a disaster or catastrophe." With respect to insurance, it is also
helpful to maintain an updated inventory list as well as photographs of the contents of your offices. And of
course, the inventory list and photographs should be stored off-site.

</p><p>The next stage in your plan is to determine which critical business functions will need to be resumed,
in what order they are to be resumed and the responsible party for each phase of the recovery. Most recovery
specialists recommend creating scenarios based on the extent of the damage. For example, let's say that a
computer virus attacks a company's computer system. The plan should have a scenario for both minor
damage as well as one for severe damage. Minor damage can often be repaired quickly without much impact
on the business as a whole, while severe damage could require the creation of an entire new system
including new hardware. The recovery team, once it determines the extent of the damage, will be able to
follow the steps outlined in the plan to allow for a speedy and efficient recovery.

</p><p>The most important part of any recovery plan is communication—including internal staff as well as
your clients and vendors. The plan should contain updated telephone contacts for all employees. Depending
on the size of your business, you can easily set up a "phone-tree" to notify the staff of any emergency
situation. The plan should also contain an updated telephone list of vendors and clients and the person
assigned to contact those parties. It is imperative that these lists be updated continually and stored off-site.
Mr. Poll notes that "it is typically easier to call out of—rather than into—a disaster area," and therefore
"another good idea is to set up an out-of-area contact. This can be a business contact of another law firm
outside your immediate area that could act as a clearinghouse for information." Most important, with
respect to communication to your employees as well as vendors and clients, is to be prompt and provide
honest information regarding the disaster and how it is being handled. Clients will feel more comfortable
knowing that you are concerned about their needs even when you have a mess on your hands. Contacting
them with the information before they make a frustrating effort to track you down will go a long way in
your continued relationship with them.

</p><p>Once you have your recovery plan in place, assign a responsible employee or employees to the
maintenance and distribution of updates to the plan. Those employees should be continually working with
human resources and your accounting department to update the employee, customer and vendor lists. In
addition, they would be responsible for maintaining up-to-date lists of inventory and assets.

</p><p>The best advice is to not assume it can't happen to you. It can, and it will; the best thing you can do is
be prepared.

</p><hr>
<h3>Footnotes</h3>

<p><small>^{<a name="1">1</a>}</small> Poll, Edward, "Planning for Disaster: Suggestions for Being Prepared for the Worst," American Bar Association, Law Practice Management Section, June 2002
(<a href="http://www.abanet.org/lpm/newsletters/articles/%20newsarticle0202_p3_fr…; target="window2">www.abanet.org/lpm/newsletters/articles/ newsarticle0202_p3_front.shtml</a>). <a href="#1a">Return to article</a>

</p><p><small>^{<a name="2" target="window2">2</a>}</small> Fulmer, Kenneth L., "Business Continuity Planning, A Step-by-Step Guide," <i>The Rothstein Catalog on Disaster Recovery,</i> 2000 Edition. <a href="#2a">Return to article</a>