Disaster doctrine: life is unpredictable; create a crisis plan that is not.

THE TERRORIST ATTACKS ON SEPTEMBER 11, 2001, SOUNDED A WAKE-UP CALL FOR THE UNITED States and will stand as a significant event in our lifetime. For many of us, it marks the date we began questioning our safety and security as a free and democratic society. For association executives, it is also the date that industrywide and internal business continuity took center stage. Gone is the day when organizations saw natural disasters, burglary, disgruntled employees, or a down computer system as the biggest threat in their contingency planning. In the post--September 11 world, terrorist attacks, biological epidemics, and concerns that an entire city might become inaccessible are the new mantras for planning. Add war and severe acute respiratory syndrome (SARS)--which have both taken their toll on international travel and association meeting attendance--and it's clear why, for many industries and organizations, business continuity planning continues to evolve.

The Futures Industry Association, Inc., Washington, D.C., is one organization that finds itself constantly looking at business continuity as a critical industry issue as well as an important internal issue for servicing members. FIA has learned many lessons during the past two years, beginning when the World Trade Center (WTC) collapsed and staff was sent home. Efforts continued with intensity during that next week, as FIA served as host, moderator, and crisis coordinator of an industry thrown into a catastrophe that no one had previously contemplated. And since that time, FIA has continued to keep business continuity planning as a priority. The background of those efforts and the current plans we have in place may be helpful to other organization leaders who, like the rest of us, face uncertain times.

Events raise the bar on planning requirements

Members of FIA buy and sell futures contracts (i.e., Standard & Poors futures, gold, oil, and so forth) on exchanges throughout the world. The events of September 11 brought loss of life to industry personnel; the destruction of one futures exchange (the New York Board of Trade, located in the WTC); loss of many members' New York City offices; and loss of access to the New York Mercantile Exchange (another futures exchange located near the WTC). FIA had served in the role of industry coordinator during previous crises, such as the floods in Chicago several years ago. But on the morning of September 12, FIA launched into uncharted territory as it coordinated an industry conference call that started with an assessment of what was known: Some firms had suffered the loss of life, others the complete loss of offices, and others were still attempting to assess their losses. As John Damgard, president of FIA, and his senior staff listened from their Washington, D.C., offices, they watched smoke rising from the Pentagon and military police in Humvees patrolling their Pennsylvania Avenue street corner.

During the days before the financial markets were reopened and stabilized, FIA held twice-daily industry calls to deal with operational, business, and regulatory issues; it also served as the repository and coordinator of industry news and information. It did whatever was necessary and used all its resources to provide support to an extraordinary partnership among all industry participants to reopen the financial markets.

The task for FIA did not end there. Like many associations, FIA turned to preparing for the next disaster for its own association, as well as for its respective industries. Business continuity efforts at FIA have been continually refined since September 11. The two primary objectives in this effort for FIA are ensuring the safety of the association's staff and providing for continued operations. The following is a brief look at some of these efforts:

Safeguarding staff

When the immediate concerns of the September 11 events were behind us, we began to focus on making sure that we were prepared for future incidents. With regard to protecting the two dozen staff working at FIA's offices, we took several steps.

1. Worked with building management. We first contacted our building management and analyzed their building policies for safety, evacuation, and air- quality procedures. Based on this interaction, the facilities managers produced an updated operational guide, which was distributed to tenants. This comprehensive manual outlined buildingwide procedures, and we used this to assess what we needed to do for our own offices and staff.

2.Expanded our own safety and emergency policies. This included establishing "safety marshals" to account for staff during an emergency, ensure that staff was evacuated, and guide employees to a predetermined external meeting place. In addition, we did some planning for a citywide evacuation of staff and the use of mass transportation and car-pooling as efficient ways to leave the city. We used city-announced evacuation routes in this planning, as the District of Columbia tins called for the city to be divided into grids to aid evacuation. We wanted to be sure that all staff had some place to go, as well as a way to get there.

3. Collected additional staff contact information. We gathered information such as home e-mail addresses and cellular phone numbers. We encourage each staff member to keep a copy of this information both at home and at work. The information is housed and updated on the organization's intranet for easy access.

4. Purchased various supplies. In the event that the Department of HomeLand Security should upgrade the threat of terrorism to code red--the highest alert level--city office buildings are instructed to enforce building lockdown. This means that staff may be held in the building for an unspecified amount of time. Other natural disasters may also require this. Consequently, we've stocked up on canned food, water, battery-operated radios, and other essentials, in case staff has to remain in the offices overnight or for an extended period. Supplies fall into three major categories: medical, survival, and protective equipment.

The protective equipment includes disposable filtering masks and disposable latex gloves. The gloves were used during the anthrax letter scares in 200l and continue to be available to any staff who want to use them.

5. Provided staff with additional information. We gave staff various Web links (see sidebar "Resource Review" for further details) to good safety information and suggested they consider some of the advice, such as keeping their own emergency kit at their desk. Many of the staff now keep a change of clothes, medicine, and sneakers at the office just in case they might need them during an evacuation or an extended stay at the office.

Like most organizations, we have also distributed a packet of safety information to staff, which includes office evacuation procedures, external assembly area, building crisis procedures, emergency contact information, city evacuation information, and an on-site, emergency supplies inventory list.

6. Practiced safety measures. While every disaster is different, we regularly practice safety drills, including staff evacuation. Since we have put new safety procedures in place, our building has had a bomb scare on the first floor. Our evacuation worked well, but we are always looking to improve our plans and preparations.

Informing constituents

The ability to support members, contact the board, and keep in touch with key industry contacts is vital in a crisis situation. To strengthen our capability for accomplishing these priorities, we took several steps.

1. Enhanced information for constituents. Our efforts began with the collection of additional contact information for our board, key industry contacts, and critical vendors. This extra information included nonbusiness-hour contacts, home and cellular phone numbers, and other emergency contact information. Senior staff keep a copy of this information at home and are able to access it via the Web.

2. Established special tracking systems. For two specialty membership divisions of industry professionals--our Legal and Compliance Division and our Operations Division--we realized during the September 11 crisis the knowledge of the whereabouts of these individuals was vital. Therefore, we now allow these division members to change their personal records via the Internet and be accessible to other division members online. In a crisis involving relocation, these individuals would need to have immediate access to others in the industry as well as be accessible to others. This ability provides an industry repository of self-maintainable vital information.

3. Created emergency contact channels. We also established a toll-free emergency Call-in number that provides a voice mailbox for members, staff, and others to call in case our offices are unreachable. If someone leaves a message, that message is sent to a staff "emergency response" team via e-mail. The message can be read on any PC and is accessible via any phone.

4. Participated in cooperative efforts. Many industrywide efforts have been undertaken to address business contingency planning. In this regulated environment, FIA continues to ensure that this topic is focused on at all levels, but contributes in areas such as standardization, education, and other industry efforts to aid member preparations.

In a more specific effort, FIA has also become a founding member of the Financial Services Sector Coordinating Council their Critical Infrastructure Protection and Homeland Security, LLC. This cooperative effort was formed as a public-private partnership and grew out of presidential orders based on directives spelled out in the National Strategies for Homeland Security and Cyber Space Security (strategies developed before the creation of Department of Homeland Security). The council consists of associations in the banking, securities, bond, and insurance segments of the financial services industry as well as various national exchanges and clearing organizations. The current areas of focus for this organization are information dissemination and sharing, crisis and response management, outreach, knowledge sharing, and national strategy.

Protecting infrastructure

At FIA, we realized immediately after September 11 that our offices were vulnerable to disruption and needed to upgrade our facilities so that critical office operations could take place remotely, specifically from employees' homes.

One of the critical components to operating remotely is computer access. Like most organizations, FIA always completed data backups nightly. However, after reviewing critical functions, FIA realized that a better solution would be to locate duplicate server equipment for critical functions off site and perform an Internet backup to this server. This relatively low-cost investment gives FIA the ability to create an ad-hoc office very quickly elsewhere in the event that our Washington, D.C., location is disrupted. In our present configuration, we believe that FIA could create an ad-hoc office with data availability in 24 hours even without access to our current offices.

For some time, staff has had remote access to e-mail and voice mail, but now critical staff abilities have been upgraded to include additional home-office abilities based upon their need. For instance, several staff received virtual private network access--a secure remote file access ability; some staff upgraded their home Internet access to a digital subscriber line from dial-up access; and other staff received new portable computing equipment. Among other things, this effort will permit key staff to operate remotely with all abilities they would require to carry on vital staff functions.

During the past few years, computer hackers and viruses have raised our consciousness about the need for total network security. We always took this seriously, yet we reviewed again the various aspects of our system security. These included physical security, overall system security, and preventing potential threats by ensuring that items such as our firewalls and virus protection were being properly maintained.

In addition, FIA also engaged the services of an outside firm to perform a business continuity audit. This audit helped FIA identify other areas we had not considered, helped us focus on some overlooked or neglected areas, and allowed us to map out our priorities. While many firms offer this service, we used Attainium Corporation, Chantilly, Virginia, as they had specific association experience. (See sidebar "Disaster Recovery: Assessing Your Risk" for further details.)

The audit indicated a few gaps, including the fact that data backups did not include data stored on desktops. We have since reviewed workstations, making sure that business data are not stored solely on desktop systems. Additionally, the analysis indicated that while we had good documentation on what was to be done to insure that backups occurred, we needed to create equally effective documentation for other elements of business restoration and related decision making. We have since made those adjustments and more completely documented the steps needed following a disruption.

Planning for meeting and conference contingencies

Our efforts in the area of conferences initially focused on looking at our relationships with our hotel partners, working with them to ensure that the contracts identified responsibilities, and identifying scenarios for which we had specific concerns. For instance, what would occur if airline travel were severely restricted or if a crisis in our industry occurred? We used outside legal counsel with expertise within the industry to help in these considerations. The hotels worked with us to come to an agreeable resolution on our more specific concerns related to potential disasters.

We found ourselves looking at our association peers to see what else was being done for meetings and conferences. Some organizations have complete and impressive "Disaster Readiness Manuals" created for each meeting. After looking at some of these, we applied the parts that best fit our situation. (See companion article "Your Meeting Deserves Its Own Crisis Plan," beginning on page 33, for a comprehensive discussion of contingency plans for meetings.)

Increasing financial flexibility

Finance was another area that needed a few minor adjustments, and the overriding plan was to use technology as much as possible. We took the following steps:

1. Instituted Internet solutions. We started the effort by making a change with our payroll-processing vendor to migrate completely to Internet processing. This allows authorized staff to process payroll remotely and at any time.

2. Encouraged electronic payments. More and more of our dues payments, conference registrations, and other payments come in a form other than a check, generally by credit card, electronic payment, or wire transfer. We continue to promote this option with members, as this reduces the reliability on the mail, as well as improves our cash flow.

3. Arranged for backup payment options. While bank account and other banking information can be managed via online Web access, we realized that it made good sense to keep some blank checks off site. With our accounts-payable checks located elsewhere, we could continue this vital function during a crisis.

4. Reviewed insurance coverages. While not necessarily a finance function, with help from our insurance agent, we reviewed our commercial insurance, as we now had a broader view of potential disasters. This review unearthed some areas where we added more or new coverage to better meet our needs.

Business continuity experts outline four phases to planning: 1) preparation for a disaster; 2) prevention or mitigation of potential threats; 3) response when a crisis occurs; and 4) recovery from a disaster. FIA's efforts have fallen into all these phases. We learned many lessons from the September 11 tragedy, not the least of which is the knowledge that this is an important business issue and one that requires regular review. For the Futures Industry Association, actively addressing business continuity allows us to better manage the next crisis and prevent the situation from turning into a catastrophe that would affect our ability to serve our members and our industry. After all, business continuity professionals say that it is not a question of "if" there will be a disaster in your future, but "when."

RELATED ARTICLE: Disaster recovery: assesing your risk.

BY BOB MELLINGER

The biggest challenge you face when preparing a business continuity--disaster recovery strategy is figuring out what you need to anticipate so that you'll know how to prepare. A disaster can severely affect an organization's ability to perform critical functions and, therefore, to continue normal business operations. To ensure the most positive business continuity scenario, you need to assess your organization's readiness in crucial functional areas. A business impact analysis, or business continuity audit, is the tool that can help you figure it all out.

Your first step is to identify all of your key business processes and assess the impact of each on normal customer or member service levels: What would happen to your operations if one or more of these processes were unavailable for a period of time? The following three elements will help you identify potential risks, their likelihood, and their probable impact on day-to-day operations:

1. SERVICE-INTERRUPTION TIME BANDS. Identify the time limits for your ability to do without your key business processes, including those that are outsourced to a third-party vendor or organization. Use a range of time periods--less than 2 hours, 2-24 hours, 24-48 hours, 2-5 days, more than 5 days--and identify the critical time band for each key process. For example, how long could you do without your Web site or e-mail system before normal service levels and continued viability would be affected?

2. EMERGENCY INCIDENT ASSESSMENT. To determine the types of disruptive events that are most likely to affect your normal business process, review any plans, policies, and procedures relating to the areas under investigation (evacuation plans, building management documentation, backup procedures, and so forth). Consider any unique operational risks of your business. Examine each potential disruption, and develop a list of consequences for each threat. Determine the likelihood of each threat (probability rating of 1 to 5--very low, low, medium, high, very high) and its possible impact (impact rating of 1 to 5--irritating, controllable, critical, devastating, terminal).

3. OPERATIONAL IMPACT. Overlaying the service-interruption time bands and the emergency-incident assessment results will help you establish areas of "significant impact" on normal operations. Significant impact represents a level where members' service levels will be negatively affected. This overlay will guide the development and help you prioritize the elements of your business continuity plan. As you will read in the accompanying article, "Disaster Doctrine," the Futures Industry Association, by conducting a business continuity audit, was able to identify neglected areas and map out priorities to upgrade its preparedness for future unanticipated events.

Bob Mellinger is president of Attainium Corporation, Chantilly, Virginia, a consulting company specializing in business continuity, disaster recovery and preparedness, and online backup and recovery services to associations and commercial entities (www.attainium.net). E-mail: [e-mail].

RESOURCE REVIEW

Volumes continue to be written on the subject of crisis management and disaster recovery. Following is the short list of articles, Web sites, books, and an online newsletter offering guidance in areas from disaster management support to information systems backup to first aid and safety. For the comprehensive list of resources, contact ASAE's Information Central by phone, 202-626-2847, or e-mail: infocentral @asaenet.org, and ask for crisis management resources.

RELEVANT ARTICLES

ASAE has published several features and newsletter articles focused on disaster planning and prevention. Go to www.asaenet.org/magazine and click on the dropdown box to search by title or author.

* "In the Face of Disaster," by Guy Sheetz (Dollars 8 Cents newsletter, ASAE, July 2002).

* "Be Prepared," by Brenda Luper, CAE (ASSOCIATION MANAGEMENT, July 2002).

* "Suggestions for IT Risk Management," by Sandy Ward (ASSOCIATION MANAGEMENT, July 2002).

RICH WEB SITES

Numerous organizations have posted rich archives of material related to disaster preparedness. Here are a few.

* See www.uschamber.com/resources/preparedness/resources/agencies.htm for a list of government and nonprofit resources.

* Go to www.drii.org for checklists, news alerts, and sources for professional assistance in disaster recovery.

* See the Professional Convention Management Association's Web site at www.pcma.erg/resources/resources/crisis/resources.asp for links to crisis management resources related to the various business groups involved in convention and meeting management.

TIMELY BOOKS

Books targeted on effective planning for the unexpected include the following:

* Avoiding Disaster: How to Keep Your Business Going When Catastrophe Strikes, by John Laye (2002, John Wiley and Sons).

* Blindsided: A Manager's Guide to Catastrophic Incidents in the Workplace, by Bruce T. Blythe (2002, Portfolio).

* Disaster Recovery Planning: Strategies for Protecting Critical Information Assets, by Jon William Toigo and Margaret Romao Toigo (2002, Prentice Hall).

* Defining Moments: When Managers Must Choose Between Right and Right, by Joseph L. Badaraco, Jr. (1997, Harvard Business Press).

COMPLIMENTARY ONLINE NEWSLETTER

Attainium Corporation, Chantilly, Virginia, a company specializing in business continuity planning, provides a free online weekly newsletter with links to content relating to disaster planning, business continuity, and emergency preparedness. Subscribe by going to www.attainium.net/newsbriefs/subscribe.html.

Jeff Morgan, CAE, is chief operating officer, Futures Industry Association, Inc., Washington, D.C., and an. ASAE Fellow. E-mail: [e-mail].