If disaster strikes, is your business prepared?

YOUR COMPANY CAN BE affected by natural disasters and man-made catastrophes, but is it prepared? (1) Preparing for a disaster is a good use of time and financial resources and can determine whether your company survives or fails. The scope of this article will focus on disaster-recovery and business continuity plans. (2) Plans for conduct during an actual disaster such as a building fire can be highly specialized and are beyond the scope of this article.

The first step in disaster planning, also known as contingency planning, disaster preparedness, or business continuity planning, is to create a disaster plan. A disaster plan should be a flexible document that constantly evolves. In creating the plan, you should consider the various disasters that may affect your business: fire, hurricane, tornado, flood, earthquake, winter storm, civil disturbance, biological/chemical attacks, epidemics, communications failure, hazardous materials incident, power outages, radiological accidents, terrorism and vandalism. While you can't prevent these disasters, you can prepare and hopefully minimize the effect on your business.

Before you prepare the plan, you need to have a firm understanding of your business process. Then, you can determine what critical business activities could jeopardize the company's ability to operate if impacted. You also need to determine the maximum period of time given business activities can be unavailable before the company sustains unacceptable consequences, such as financial losses, reduced customer service, etc. Additionally, you should determine the minimum amount of activities you need to conduct to remain a viable business, including any activities expected by government regulators and customers. Then you can set clear priorities among your activities since it may be difficult to return to all activities at the same time after a disaster. If you have a complex infrastructure technlogical component to your business, you may need to consult with experts who can assist you in mitigating risk and developing recovery support plans.

To prepare a basic plan, first address any common elements in potential disasters: loss of people; loss of, and access to, information and facilities. Once you have determined common elements, you can consider available alternatives. In doing so, you may want to consult applicable federal, state and local laws, such as occupational safety and health laws, environmental regulations, fire codes, seismic safety laws, transportation laws, zoning laws, and corporate policies.

If a common element of potential disasters is loss of people, your company should consider a line of succession plan, much like the government has. If the person normally in charge is injured in the disaster, is unavailable, or worse still, his whereabouts are unknown or he has died, you need to have delegated full authority to another individual to be able to act quickly. You may need to train others in case you need backup assistance. Whatever you choose, make sure your employees know their disaster responsibilities in advance and assign specific tasks, such as calling your vendors and suppliers to halt deliveries or inform them of interim location, and calling customers and board members.

In addressing loss of people, you should also consider communications issues. How will you communicate with your employees and other key people? How will they know where the interim location or command center is? Could your employees telecommute? Do they have the necessary equipment?

You may also consider creating a crisis management team. In planning the recovery phase, what people (specific employees, vendors, suppliers, equipment providers, etc.) will you need to accomplish your goals? You should develop a list of alternate suppliers or vendors to use if the disaster shuts down a key supplier.

In addressing loss of access to information and facilities, and loss of information, you may want to start by answering the following questions. Can you designate another location as your alternate worksite? What type of equipment and inventory is necessary to continue operations? Is this equipment and inventory available off-site? Do you need a backup generator to maintain operations or perform mission critical functions? Do you have a designated location (e.g., a command center) from where management decisions and directives can be made and carried out? How will employees, customers and vendors know how to contact you?

Do you need a hot site (an alternative facility that is prepared before a disaster to duplicate the computer work environment of your original site)? What types of information (accounts receivable; payroll; customer contacts; etc.) will need to be immediately accessible? Is a copy of this critical information stored off-site? Do you have a backup connection to your main computer in the event you must relocate to your alternate worksite? Do you regularly back-up your electronic files and store the back-up tapes off-site? Do you keep originals or copies of critical paper records (extra checks, insurance policies, loan applications, contracts, building plans, etc.) off-site? Do you keep a second copy of back-ups and paper documents in a safe, second off-site location (preferably some distance from your location and first off-site location)? Can you bank online so that your accounts and records are readily available to you anytime, anywhere?

Every disaster plan should contain call lists, which are stored off-site, and which contain the contact information for employees, vendors, suppliers, utility providers, emergency responders, hospitals, contractors (including plumbers, electricians, mechanics, engineers, architects), transportation contacts, temporary help agencies, media contacts, and anyone else you may need to contact. You may also want to consider setting up a phone tree, password-protected page on your website, email alerts or a pre-recorded message on the company telephone system.

If you are located within a building or industrial complex, you may want to share your plans and coordinate with your neighbors. Make sure your building and site map indicates where utility shut-offs, water hydrants, water and gas main valves and lines, electrical cutoffs and substations, storm drains and sewer lines, exits and stairways, escape routes, alarms, fire extinguishers and sprinklers, and hazardous materials, are located. You may also want to coordinate your plan with first responders, building management, utility providers, suppliers and vendors. Frequently review and practice your plan and include all employees in drills and exercises.

Once you have established your priorities, you can assess the economic consequences of a potential disaster. What costs are involved in fixing damage to your physical structures? If you lease, what is the process when all or part of your building is being fixed? What costs are involved in fixing equipment and machinery? What disruption in sales and services might you face? What property, equipment, or laborers might you need during recovery? Once you determine what economic consequences you might face, you can consult your insurance carrier to make sure you have adequate coverage.

Keep a copy of your disaster plan off-site! It does no good if you can't access the disaster plan when disaster strikes. Finally, review your disaster plan regularly to assess whether changes need to be made.

About the Author: Heidi Abegg is an associate at Webster, Chamberlain & Bean--a Washington, DC-based law firm. She can be reached at [e-mail].

1. The information provided herein is for general informational purposes only and is not intended to constitute legal advice.

2 For additional assistance, consult the websites of the Federal Emergency Management Agency, the Department of Homeland Security, OSHA and the Red Cross.