Business Continuity

A catastrophe is never in anyone’s plans. Have you taken the time to consider how your business would continue operating in the event of a disaster? If not, you could be risking all the work you’ve put into building a successful organization.

Most businesses will experience threats to their critical systems—threats like power outage, fire, flood, or a computer virus. Critical systems disruptions—no matter how long —are not only frustrating but can cause severe financial losses and threaten the survival of your organization.

Businesses depend heavily on computer technology, communications, and automated systems. Disruption for even a few days can cause irreparable financial damage. While all disasters can’t be predicted or prevented, their effects can be mitigated. That’s why a business continuity plan is so important. It not only provides your organization with a comprehensive statement of actions to be taken before, during, and after a disaster to minimize its impact, it also offers a certain level of comfort in knowing that if a catastrophe occurs, it will not result in complete financial disaster.

BUSINESS CHECKLIST
DISASTER PREPARATION AND RESPONSE

1. Identify the risk. Owner/occupiers should have their buildings inspected to ascertain vulnerability to high winds, water, or earthquake damage. This may help to avoid unnecessary loss of property and life during a disaster.
2. Necessary precautions. Take steps necessary to protect equipment, windows, and furniture where there is a warning (i.e., tornado, flood, etc). All too often equipment and furniture is damaged by flying debris or water when simple precautions could have been taken.
3. Back up data and files. Data and files should be backed up either electronically or by duplication–alternative storage sites or redundant locations should be considered. Redundancy is an imperative for sensitive financial and other data. It may also reduce overall insurance costs and will enable the business to initiate operations in an expedited manner post-disaster. This includes insurance, legal, personnel, and tax information plus a basic inventory of what you have on your premises for insurance purposes.
4. Make plans to work with limited funds, power, and lack of water. Emergency supplies on site should be maintained including portable generators, flashlights, batteries, water, and basic food stuff in the event you are stranded or it is difficult to move about. Potable water, foodstuffs, and power may be severally restricted or unavailable for a period of time. Planning in advance will enable the business to at least inventory and possibly operate post-disaster plus provide a sense of comfort to your employees.
5. Protect your employees. Safety comes first, Prepare, distribute, and discuss your disaster plan including recovery issues. Consider shelter issues and whether or not transportation should be provided. Identification of necessary employees with due consideration to safety and flexibility depending upon the severity of the disaster. Provide letters of authorization and identity cards for entry onto your premises for post disaster activity. The business cannot operate with the employees and frankly will need to entice them to return. Ensuring their safety is paramount, especially when basic services are disrupted. A major problem with recovery post-disaster has been the uncertainty of admittance to a disaster area—an “authorization” letter and identity card will at least provide information to any security force of the legitimacy of the employee.
6. Contact your customers & suppliers. Share your communications and recovery plans in advance. Include contact persons, private phone numbers, and any alternative site information. This could include any disaster recovery vendors in the area. This enables continuing communication with clients and will reduce downtime in the conduct of your business.
7. Review insurance coverage. Aside from standard liability insurance, business interruption policies are also available. A major cause of business failure is the inability to generate revenues during and after a disaster. A basic business interruption policy could be the difference between bankruptcy and success after a disaster.
8. Post-disaster inspection. Use caution—check power, water, and gas lines. Inspect the premises for damage and take photographs, as well as inventory everything. Aside from basic safety, a major claims issue will be an accurate inventory and proof of damages . The more information you are able to provide, the less objections a carrier may have with payment of a claim.

Industry Update:

All companies need a disaster recovery plan
By Kathie Sutin
SPECIAL TO THE POST-DISPATCH
Thursday, Jul. 05 2007

A prolonged power outage like St. Louis experienced multiple times last year is a major inconvenience for homeowners, but it can be lethal to businesses.

The National Archives and Records Administration says 93 percent of companies that lose access to their data for 10 days or more file for bankruptcy within one year.

But companies can develop an emergency preparedness plan that works for them.

An example is THF Realty Inc., a St. Louis-based real estate development and management firm with 85 employees. Risk manager Sabrina Radney explained at a recent Clayton Chamber of Commerce program how the company developed its plan and how it worked last summer.

Thanks to lessons it learned in an earlier outage, THF continued operations when two massive thunderstorms swept through the area last summer, leaving the company without power.

A key component in any business's emergency preparedness plan is protecting the information stored in its computers.

Information technology is at the core of critical business processes, making a contingency plan essential, said Elizabeth Niedringhaus, president of SSE Inc., a St. Louis company that develops courseware and data software, designs networks for companies and offers technology services to businesses.

"THF Realty's experience in last year's power outage is similar to what a business could experience with the failure of a critical piece of computer hardware," she said. "You know it will eventually be up and running again, it's just a matter of time."

Although vulnerabilities can be minimized through planning, "it is virtually impossible to eliminate all risks," Niedringhaus said.

"Therefore, effective contingency planning is essential."

Niedringhaus stressed the need to develop a contingency plan listing measures a business must take to recover information technology services after an emergency or system disruption.

"Think about what measures you can take to reduce the effects of disruptions," Niedringhaus said.

That includes backup methods and options, alternate sites, equipment replacement and places to keep copies of software, she said.

"This plan needs to be so specific that someone doesn't have to think in an emergency — they literally just have to follow the directions," she said.

THF weathered the storm by taking a variety of steps, starting with a disaster recovery plan that was developed after an outage in 2005.

"During those few hours in the dark, we realized our disaster recovery plan had not kept pace with our growth," Radney said.

On the technology side, the company moved its server off-site so files and e-mail could be accessed as soon as possible.

It also moved laptops into temporary meeting space where they were configured by the IT team to access the relocated server.

When the power was restored, THF held a celebration to recognize everyone and hand out some awards.

"Through it all, we were able to operate at approximately 70 percent efficiency," Radney said. "We even closed deals."

The disaster recovery team did a post-mortem and tweaked the plan. An Internet messaging system all employees can check periodically for information and updates was added, for example.

But in the end, Radney said, "We were tested and came out stronger and smarter as a team."

This webpage provides links to sites that may benefit a company and to help begin the process of planning for a disaster.

St. Louis Area Regional Response Web Site

SBA Business Preparedness Link

FEMA Business Preparedness
Standard Checklist for Business (PDF File - adopted from FEMA)

FEMA Emergency Management Guide for Business

Missouri Emergency Management Agency

American Red Cross