DR Planning

The eagle has landed and has chosen to do so in the form of a jumbo jet, and it has landed right in the middle of your office block obliterating everything - not a single brick remains standing.

If you ask 'is this unlikely?' the answer may well be 'perhaps'. But if you ask is it possible, the answer has to be yes. This, or something like it, could actually happen to you. After all, Lockerbie could just as easily have happened over a more densely populated commercial area.

Should such an incident occur, you might well argue that you are insured, and that your policy will cover the damage. This may be so, but how long will it take you to get things back to normal? And where would you start? This then highlights the very real need to have a disaster recovery plan (DRP) in place ready for use at any time, as disaster will usually strike when it is least expected.

Even if this is an unlikely scenario, can any prudent company director afford to ignore it completely?

WHAT IS A DISASTER?

The word disaster comes from the Latin literally meaning 'evil star', and can in today's terminology be defined as:

- any unplanned occurrence which seriously affects an organizational ability to trade; or

- an event or development which immediately puts at risk all, or the major parts of a business.

This could arise from a variety of incidents, including fire bombing and flooding, as well as potentially major natural disasters such as an earthquake. Of course, disaster need not necessarily involve actual physical damage, and may not always be a total loss. They could be caused by pollution or section, as in the case of Farley's Baby Foods, where salmonella closed the factory or where Perrier had problems with benzene ingress into its bottled water.

THE IMPORTANCE OF DISASTER RECOVERY PLANNING

The only certainty with disasters is that they will continue to occur and we must always be prepared, as one never knows when a disaster may strike or what form it will take.

It is a sad fact that some 80 per cent of firms without a DRP go into liquidation within 18 months of a major disaster and a further 10 per cent within five years. Many of these could have been saved if they had had a proper DRP ready to be put into effect.

In the scenario outlined earlier, all too many will have to hold their hands up in horror, saying that they always intended to find time to prepare a plan, but never did. Unfortunately, however, when the disaster has happened it is far too late for such recriminations and regrets.

So, if you were a company director, what would you do in the event of a disaster? Without a DRP, one possibility would be to panic. Alternatively, you could think quickly on your feet, but many decisions made this way would be disorganized, discordant and probably duplicated - the right hand/left hand syndrome. Such action would of course have the adverse effect of delaying recovery, not least by the wasted arguments which would probably arise. It has to be remembered that it is not only the consequences of terrorist bombs which need to be considered, although major bombing incidents such as the Commercial Union building in London in 1992, have received the most publicity in the press. Incidentally, CU was very lucky (if that is the right word), in that the bombing occurred late on a Friday night, so there were few people in the building. It also meant that they had the weekend to put its DRP into effect giving it two non-normal working days free before it was business as usual - had the bomb been set to explode on a busy Monday morning, the outcome would certainly have been very different, with serious loss of life, on the scale of the Oklahoma City bomb. With the Commercial Union being in the public eye, it gained a lot of sympathy which would have helped its recovery, although it has to be said that much of the sympathy was engendered by the fact that it was organised and ready and able to cope with the disaster when it happened.

It is therefore essential that all businesses are fully prepared for every eventuality as far as is practicable.

INITIAL PLANNING CONSIDERATIONS

When preparing a disaster recovery plan, there are many aspects which need to be taken into consideration, including the following:

Staff

Safety of staff is of paramount importance, especially in the early stages of evacuation and where a building may be in a dangerous condition. Remember that property can be replaced more easily than staff. In order to get back to normal working as quickly as possible, it is important to retain staff and their goodwill, and also to keep their morale high. There is nothing more demotivating than not having any trust in your directors' ability to rebuild the company -a very bleak outlook indeed. These objectives, however, can be achieved easily if they are given proper consideration and involvement in the early planning stages.

Objectives

The overall objective, of course, is to provide for an orderly and timely recovery from the disaster. This will be achieved by:

- reducing confusion during the chaotic period by having a clearly defined course of action;

- selecting appropriate personnel responsible for different aspects of recover;

- identifying outside support that could be used,

- specifying the steps necessary to return to normal In as short a time as possible.

Cash flow

No company can operate for any length of time without a cash flow, and it is therefore important to maintain a state of liquidity at all times, and especially following a major incident.

In the event of an insured loss, insurers will usually agree payments on account, which helps with the cash flow, but even with such insurance protection many businesses will, unfortunately, still fail if they do not have a DRP

PREPARING A DISASTER RECOVERY PLAN

In preparing a DRP for any company, you would firstly need to appoint a steering committee. This committee, or team, should consist of representatives from all areas - production, technical development, accounts, personnel, etc.

The team

The main thing to remember is that for a team to be effective, it should consist of a small number of the brightest people, and not become involved in 'office politics'. After all, the future of the firm may well depend on decisions made by the team members m the event of a disaster.

The team should be selected from senior management. It is important for the plan to have, and be seen to have, commitment from the top, and choosing from senior management ensures that the necessary resources are made available. Each individual team member would then take responsibility for the main designated areas of recovery.

The captain

Every team needs a leader, and a disaster recovery team is no different, so, from the team members a recovery coordinator should be selected. He or she must be a senior executive who can have overall control of any situation, as immediate decisions will need to be made on site regarding major issues. The coordinator must therefore also be seen to have the appropriate authority to ensure that decisions are implemented immediately and without lengthy arguments, which could cause costly delays to recovery.

The batting order

Having selected the right people to do the job, the next step is to consider how a disaster would affect the business, and where the priorities lie. As disasters can be minor or major, a DRP should cater for all reasonably foreseeable situations, although it has to be borne in mind that it would be impossible to make allowances for every single eventuality as the document would then be too cumbersome and complicated to use.

Keep the objectives in mind - the best way to formulate a DRP is to start from the worst possible scenario of total destruction which can then be trimmed for possible smaller disasters, and then decide how you would propose to continue to operate your business in the short term, with as little interruption to customers as possible, and progress back to normal working with the shortest possible delay and least inconvenience to staff.

Naturally, the DRP will vary from company to company, as the needs of each will be different. For example, a manufacturer may have its production line as the main priority, whereas others may have paper records as theirs.

This latter situation was found to be the case in the aftermath of the Bishopsgate bombing, where some businesses faced losses because they could not gain access to certain vital documents, including loan agreements and contracts, which were undamaged in fire proof safes, but inaccessible under several tons of rubble.

The team should, therefore, identify critical business processes, i.e., those which are vital to the company, and bee the DRP on their phased recovery.

They should also be on the look out for any weak points in their processes.

Next come the what if questions, of which there will undoubtedly be many. They must, however, be the right testing questions, and consideration should be given to all possible options, however unlikely. In answering the questions, be innovative and imaginative - it is much easier at this stage when time is not pressing than it would be In the middle of a disaster, and it can be quite surprising what possibilities can be put forward in, perhaps, a brainstorming session.

The reserves

It is, of course, possible that any of the selected team members may be on holiday or otherwise unavailable when disaster occurs, and bearing in mind Murphy's Law, it is more than likely that at least one key player will be away. It is therefore essential to appoint deputies to ensure that the plan does not fail due to the absence of one or two people.

The sell

An important part of the DRP is to have an up to date list of names, addresses and telephone numbers (including out of hours numbers) of all employees, bank insurers, insurance brokers, loss adjusters, plumbers, electricians, etc. as well as all current material suppliers. This list should include suppliers of specialist equipment or even other special products relating to the fabric of the building.

The team will, similarly need the names and telephone numbers of the local police and emergency services to enable them to contact the right people and therefore avoid unnecessary delays.

Details of contractors should also be maintained, together with detailed plans of the premises showing specifications and drawings should also be held. Information on where to find alternative facilities which could of course be critical in a major disaster situation, as tune would be of paramount importance

Detailed plans are also needed for the emergency services, for example, the fire brigade will need to know the whereabouts of water supplies and isolation valves.

Loss adjusters are also a good source of information and assistance, with their readily available network of contacts. If possible, arrangements should be made to tap into their resources, and be incorporated in the DRP.

Regular checking of the information kept is obviously of great importance if the list is to be of use in an emergency. In the event of disaster, there may be a long delay in effecting repairs to a building if the original material supplier has gone out of business unknown to the company and an alternative source has not, therefore, been sought. This could in turn delay the recovery inside the buildings as access may need to be maintained to a certain part, to allow, say, essential machinery to be installed.

The fielders

The team, made up of the necessary cross section of players would be divided into male areas of individual responsibility which would include:

-.communication / public relations

- computer systems

- salvage/debris removal

- administration

production

There may be other areas necessary. depending on the individual firm's requirements, but the above main headings are sufficient to illustrate the principle which ls being established. each individual role ls more fully outlined as follows:

communication/public relations

The chosen team will consist of a small number of senior people, and it is of importance to communicate fully with 21 employees. The communications section should therefore start by ensuring that a good method of cascading information down the lanes to every employee is arranged. This should be done by using the pyramid principle. so that each manager has responsibility for keeping informed a given number of people. This will then ensure good dissemination of information to all ranks, which will engender the goodwill of the staff, as they will be well informed and will therefore be able to answer any questions from a sound knowledge base.

Communications need to be restored quickly to allow customers to be kept informed of the actual situation without delay-After all one cannot always believe everything one reads in the newspapers, and this is where good PR comes into its own. Correctly handled, a disaster can be turned to a firm's advantage but. if badly handled, it can cause a worse financial disaster. The very different public perceptions following the major CU bombing incident, where it coped well, and Perrier's comparatively manor water filtering problems where it did not, clearly highlighted the importance of getting the right message across to the outside world. After all, a company's image, especially if it is in the public eye, can herald the failure or future security of that company

.--computer systems

Disaster can, of course, also strike in the form of serious damage to computers, and the overall effect that this can have m terms of the business as a whole should not be overlooked naturals. It is imperative that back up taped are taken normally on a dally balls, and that such tapes are held off site, ready for use in an emergency off however, there is a major dependence on computer facilities to re-start the business then at would be wise to look at alternative sites This could mean either cold-sites, being computer rooms without computers, or hotsites, being rooms with computers in place ready to use Which one is selected will depend very much on the degree of dependence on computers, and individual requirements of the company

To assist in this choice, there are a number of specialist companies In the market today, although. as with many other matters, cost may be the deciding factor at the end of the day

-Salvage / debris remodel

When walking through the remains of a building (and have you thought who will supply you with the protective clothing necessary to enable you to do this?) it may seem impossible that anything can be salvaged, but to assist in this regard there are several companies who specialist in restoration of property after say serious fire or flooding.

Be it machinery or documents or anything else which needs restoring. there is a specialist somewhere. However, as there ls a wide varlets of such companies in the market, when making a selection of which ones to include on the list of contractors, it is as well not simply to use Yellow Pages, but to seek advice as to which company to use. It is here particularly where the loss adjuster's experience can be invaluable

Using experts to decade what can economically be salvaged. and what needs to be removed, provides not only the solution to the problem on sate. but will have the added benefit of demonstrating to Insurers that a rational and ordered decision has been taken. This should be welcomed by insurers. and will hopefully assist with the amicable settlement of any claim

-Administration

administration ls primarily concerned mitt coordinating and/or organising supplies, in. ensuring that necessary telephone and computer links are established materials for carrying on the busyness are available and that staff have somewhere to work from

Although the fruits of labour will not be in evidence until the later stages of recovery. the person responsible for administration will, of course need to commence work as soon as possible, to ensure that everything is ready in good time for smooth implementation as and when required.

Production

Production, concerned with arranging alternative premises and machines, materials. etc, to allow work to recommence as quickly as possible, will more than likely be carried out in stages.

In all of the areas specified above, and any others which may be required, there will clearly need to be some cooperation between the team members, as although the different sections have their own responsibilities. Some areas will inevitably overlap The team members must not become over possessive of their own area in trying to exclude all others, but at the same time they must not allow others to run their section. This is another reason why the team must be carefully selected, and not allow internal politics to interfere with the smooth recovery of the company.

If the company has more than one location, it may be necessary to go through the same procedure for each, discussing with the local or divisional managers the individual needs which may be very different and will need to be considered separately.

UPDATING AND TESTING

The business strategy of any company will be changing constantly over a period of time, and the DRP must be kept up to date if it is to have any meaning and provide a useful document In the event of a disaster. So, once the DRP has been formulated, it will be necessary to hold regular meetings of the team In order to ensure that the plan is still relevant flexibility must be built in to the plan, as there will rarely be a single response to any given situation, particularly bearing in mind the tact that the shape and nature of both businesses and disasters are unpredictable.

Meetings should be held every 12 months as a minimum, although six monthly intervals would be preferable. This greater sequence would also give greater familiarity with the plan, thus making implementation eviler when the need arises.

The plan must also be tested both thoroughly and regularly, broken down into manageable sections, firstly as a desk top simulation and then as a full scale operational test. This process will have the added benefit of identifying any weaknesses in the plan, so that when it is needed in an actual emergency situation. it will not need to be rewritten among the eyes of the business.

Without testing and updating any DRP would soon become merely a nicely bound document, but be totally useless, or indeed misleading, in an actual disaster

SIMPLICITY

It has to be accepted that while the DRP should be regularly checked, it will probably not be a document which ls in regular use and must therefore be user friendly , enabling anyone who has little or no previous knowledge of its preparation to be guided through its pages easily and accurately

This can be achieved by using a system of colour coding the pages in each defined area, and by careful thought  given to the chronological order of things to be done.

Provision should be made within the DRP document for each decision to be logged, noting not only the time and date of the action taken, but also the rationale behind the decision.

COPIES OF DISASTER RECOVERY PIAN

Obviously, it is not a lot of help keeping the DRP document in a safe on site, if you are then unable to gain access to it because it ls buried under tons of masonry or simply that the emergency services have cordoned off the whole area for safety reasons

It is therefore imperative that more than one copy should be kept to avoid difficulties due to absences, etc, and while one copy needs to be kept on site for immediate use (if it is accessible), other copies must be kept off site, usually in the team members' own homes

WHO SHOULD HAVE A DISASTER RECOVERY PLAN?

While one usually thinks of large complex companies when considering DRPs even medium to small companies should be tanking of preparing one. Although it would naturally be more simple and brief, nevertheless the principles of items for inclusion would be similar

One also has to bear in mind the fact that what would be no more than a hiccup to a large plc could well be a major disaster to a small private limited company! and may be enough to sound the death knell for them

To trust the smaller firms, there is available pre-prepared software, which would provide the basis of a dry and may then be adapted to the individual needs of the company.

THE COST

The peace of mind which comes with the existence of a DRP does not come without its price tag.

As can be seen, a properly designed DRP requires the full commitment of all senior executives within the organization, and will therefore be expensive in terms of the amount of time that it will be necessary for senior people to spend in the initial setting up. However, once this initial outlay has been absorbed, the plan should require only minimal time ensuring that it is still current, and carrying out periodic testing.

The cost also has to be weighed against the situation a company would be in if a disaster were to occur, and no plan were available to be implemented.

Just think for a moment of the consequences of not spending the time on disaster recovery planning, and the subsequent long term implications on the business.

Regrettably, however, the initial costs have often pushed disaster recovery planning into oblivion inside the boardroom, as it has been considered a distant ideal to be aimed for, but never quite achieved What is often overlooked is that some of the cost will be onset by the benefits of management training.

THE BENEFITS

In addition to providing a basis for speedy recovery, there are other 'spin-offs' which come with the preparation of a DRP . These include:

Market position

There will inevitably be loss of market position if a company is not back in business quickly. The busyness world is quite ruthless, and customers/suppliers need to look after their own interests fast and foremost. Even friendly customers will soon run out of sympathy if their own income is affected, and they may no longer be able to support you, awaiting your recovery. Others may not have any sympathy in the first place. and go elsewhere immediately.

Legislation

While legislation will help with safety procedures, it will relate to substances and methods of work. In general, preparation of a DRP will focus on such matters, and enable consideration to be given to each area. tailored to meet the needs of individual companies, thus also hopefully reducing the likelihood of disasters.

Problem areas

By preparing a DRP, many of the 'what if questions will also have the advantage of identifying problem areas, which can then be addressed.

Education and training

After the problem areas have been identified. the next stage ls to learn lessons from them, and to help avert possible disasters in the future by arranging for relevant staff to have any additional training they may need.

This can be clearly seen say in the situation of a chemical warehouse, where it is vital for staff to know about the products they are handling. and its safe storage. etc.

Prevention

Other preventative measures can be taken following the identification process, such as changing production flow to avoid bottlenecks, or separating vital machinery into different areas or protecting critical equipment by erecting additional fire break walls

RISK ASSESSMENT

It goes without saying that prevention ls better than cure, and this is where risk management comes in. Having identified hazards and/or bottlenecks, etc. next comes the control of risk, which could range from simply ensuring that more that one warehouse is used for storage of vital materials to completely rearranging a manufacturing process

A good risk management programme will set out its policy statement. which should show the objectives of the company, broken down as appropriate into small units. The statement should also show how the objectives are to be achieved and who should carry them out. The processes are, as can be seen, similar to the identification procedures of a DRP, although the objectives would be preventative measures rather than prodding a cure.

Maintenance is also a necessary part of any risk management, as without a proper programme there could be increased risk, caused by such matters as faulty electrical wiring, or of machinery breakdown due to lack of replacement of worn parts in good time. Not only do poor practices present their own particular problems, they also encourage sloppiness in the behaviour of employees. causing further problems in that the workforce can become demodulated, as management appear not to be concerned for their welfare

The next step is that workers take short cuts, and these are invariably not using safe methods, and therefore incur greater risk.

Even without legislation. there is obviously a very strong case in favour of preparing a DRP, not least the fact that without a disaster actually occurring,  it can help the present situation by making management look carefully at what the company is doing now. and thanking seriously about the future

This should, of course, be carried out in conjunction with the risk management programme, and should indeed be an integral part of it as there are many aspects which overlap. A few pounds spent wisely now on identifying and containing risk can save a company a fortune in the long run, in terms of avoiding lost production.

The main drawback to preparing a DRP is the actual cost in today's budget against possible savings tomorrow by reducing the effects of a disaster, and leads to bit won't happen to me' syndrome. What should really be said by the chief executive. and agreed by the board, is, 'it could happen to us' with this better attitude, the chief executive should then ensure that the appropriate action is taken to prepare a disaster recovery plan without delay