Form a commitee
A disaster committee is a group of individuals responsible for directing the development and execution of the business continuity plan. The committee is also responsible for declaring a disaster and providing direction during the recovery process. When you think of forming your committee, you should include staff members from all levels of the organization including managers and executives. These will be the people making decisions during an emergency, so be sure to choose people you can trust to keep their cool when the going gets tough.
Perform a risk analysis
Next, the committee should perform a risk assessment—this can range from a self-test to an engineering study and allows you to identify the natural, technological and man-made hazards in your area.
With this knowledge, carefully assess how your company functions, both internally and externally. Next, take a look at the minimum business functions you need to stay in business. What staff, materials, procedures and equipment are absolutely necessary? By looking at your critical business functions, you can make decisions about assigning emergency responsibilities to individuals in your organization and the order of management succession.
Develop a plan
Once the committee is in place, it needs to develop the disaster plan. Plans can be simple or elaborate depending on your needs and work environment. The committee should start by reviewing internal plans and policies for evacuation and fire plans, as well as safety and health programs. The committee should also consider meeting with government agencies and utilities to estimate the probability of the risks discovered in the risk analysis. Once the information is gathered, the plan can start to take shape. It should include the following:
• Executive summary
• Emergency management elements
• Emergency response procedures
• Support documents
Crisis communications plan
Communication is essential to any business operation. This sub-plan should be folded into your larger emergency plan. Consider putting plans in place for family communications, employee, management, customer and government notification. This warning system should be tested regularly. In addition to the plan for communicating with your employees, it is essential to have an alarm (not just a smokeactivated fire alarm) on your premises to be sure everyone is alerted during an emergency. One firm conducted its first test of a sophisticated alarm system 21 years after installation and discovered that it played Christmas music—not alarm bells (fema.gov).
Assemble an emergency kit
Because you may need to survive on your own for a few days after a disaster, you should put together a three-day supply of food, water and essentials for your staff. Some additional items to include are: a National Oceanic & Atmospheric Administration (NOAA) weather radio with extra batteries, copies of important records such as site and building maps, employee contact and identification information, bank account records, supplier and shipping contact lists, computer backups and other priority information in a water- and fire-proof, portable container.
Review your business insurance
No matter what the crisis is, once you ensure your people are safe, one of your first thoughts will be to wonder if your insurance is going to cover your damage. Just as you advise your clients, you need to also review your own business insurance regularly—especially whenever your business makes any significant change, such as moving to a new building, adding new office furniture or technology upgrades.
Keep copies of your documentation in more than one off-site location—preferably one that is out of state, in case your whole area is affected by an emergency.
Back up your data
After your people, what could be more important to your business than your data? As part of your risk analysis and plan, answer these questions:
• What data is being backed up?
• Where is your data backed up?
• How often do backups occur?
• What procedures need to be followed in the event of an interruption?
• Who is in charge of performing backups?
In the event of a disaster you will need to have a valid, current and restorable copy of your database, accounting files and core documents.
This means that data needs to be validated—did it back up correctly? It needs to be current because old data is the same as no data. And it needs to be restorable since research suggests that more than 60 percent of backup tapes fail to restore. There are a couple of ways you can back up your data: use internal resources or outsource to a technology provider.
In-house, back-up solution
With an in-house solution you may feel your data is more secure with quicker recovery and you may think the costs are lower, but there are challenges with backing up your data in-house. The initial set-up and maintenance costs can be very high. You may choose to back up your tapes every day, store them in a secure facility, purchase new tapes and rotate the old ones out and validate backups. Or one rule of thumb, the 2x2x2 rule states that you should have two sets of backups held by two people at two separate locations. An in-house option can be cumbersome, costly and prone to human error.
Out-sourced, back-up solution
In the event of a catastrophe, you only need to take a laptop to the nearest powered location to be up and running. One additional advantage of moving to a hosted solution is that ongoing backup of your data is guaranteed.
If you don’t choose online but want the security it offers, take a look at Disaster Recovery Service.
Measure and test your plan
Finally, you need to test your plan. Go beyond planning and frequently practice with drills and exercises. For example, hold education and training seminars, include preparedness training in new-employee orientation, schedule drills and shut downs, restore a random backup without telling the IT department and evaluate and revise your processes. Research shows that “doing” is the most powerful training tool—your staff will be far more likely to react appropriately if they have done it before in a practice scenario.
Getting back to business
After a disaster or business interruption, you want to make sure your customers can reach you. Internet and phone are the two most important communications channels to address from the start. If Internet access is still available, have a web page ready with emergency contact information. Think about providing links to services for FEMA and Red Cross, local news sites and authorities.
The Internet offers a lot of advantages but this is still a phone-based industry. Phones are usually the first to go, but you might be able to route your calls through the telephone company or a web-based service.
Call your phone and Internet provider before an incident to advise them that they should put your agency on the priority list since you will be servicing clients who need immediate recovery help after the storm.
Damage assessment
After you have given your customers an avenue to reach you, you need to do a damage assessment of your office and equipment. Determine what can be done to bring your office back online. Create damage and salvage lists and remember to track your costs. Try to make your office as safe as possible. If you can’t, identify another location you can use until it’s safe to return to your main office. Again, make a sign or post it on the Internet directing people where to go. You might want to have a few things on hand in your emergency kit for your policyholders, such as water and snacks.
Taking care of your staff
One of the most important things to remember is to take care of your number one asset, your people. Put steps in place for longterm follow up with your employees, as events can affect people differently. Be sensitive to the pressures on your staff. Even if the disaster just affected your office—the change and loss can be very disconcerting. If it was a large-scale event, they will also be taking thousands of claims from many different types of people. Not only will they be hearing horror stories but they will be dealing with their own loss. Schedule daily checkup calls or face-to-face meetings to monitor burn-out and schedule shifts that will give your staff time to rest and take care of personal needs. By using these seven steps as a guide, you can be prepared to get your business back up and running after just about any type of event.
Source: Vertafore Business Continuity newsletter