Contingency plan details response to business disaster

The terrorist attacks on Washington, D.C., and New York City resulted in horrendous human loss. While paling in comparison, the impact on commerce also was staggering. The ripple effect will be felt throughout the global economy for months or years to come. The notion that "it could never happen to us" has been destroyed, possibly forever. Instead, many business executives are now asking "What if it happened to me and my business?"

Regardless of whether it's terrorism, fire, tornado or another form of disaster, the end result can be devastating to a business. According to the U.S. Depart-ment of Labor, 43 percent of businesses that experience a disaster never reopen, and 29 percent of those that do eventually reopen close within two years. In spite of these grim statistics, many businesses continue to ignore the risk and hope for the best.

When disaster strikes, the inevitable question is "What do we do now?" Time is the enemy, since most businesses cannot survive being shut down for more than a few days or perhaps even a few hours. Finding quick answers amid chaos and confusion can be difficult, but speed is of the essence.

It also is important to retain customer and employee confidence during this difficult time, so quickly regaining control of the situation is essential. A solution to both problems is to develop a business contingency plan before disaster strikes.

A business contingency plan describes in detail how the business will respond to a disaster if it occurs and details the restoration of important business functions. The plan establishes priorities, roles and responsibilities, step-by-step procedures, etc.

The following are the steps involved in developing a basic business contingency plan:

Perform a risk assessment. Every business faces certain disaster threats. For example, flood may be a threat to a business near a river. Loss of Internet service may be a threat to a business that gets a substantial volume of its orders via the Web.

Consider both the likelihood of a disaster occurring and the impact the disaster would have. Rank threats based on these factors and develop plans to respond to those that have a relatively high likelihood of occurring or would have a significant impact on the business. It may also be possible to take pre-emptive steps to reduce the likelihood or impact of a disaster.

Develop emergency procedures. The first priority when disaster strikes usually is the health and safety of the people involved. It is critical that people know how to evacuate the premises, seek shelter, notify emergency agencies, etc. Document emergency procedures for responding to the most likely threats and train people to respond accordingly.

Plan communications. Effective communication with customers, vendors, and employees is essential in a time of crisis. Rumors and inaccurate information can be extremely counterproductive. The plan should clearly define who is responsible for official communications and how that information will be communicated.

Prioritize business functions to be recovered. Prioritize and document the order in which business functions should be recovered so that recovery efforts can be focused on those functions that are most important to the short-term survival of the business.

Define recovery strategies. Docu-ment the basic approach for restoring critical functions. For example, the plan may call for temporary offices to be established at the company's warehouse, and for relocating a computer server from a branch office to the temporary offices. Making critical decisions in ad-vance can speed recovery time.

Identify resources needed for recovery. How many desks, chairs, etc. will be needed? What computer equipment and files will be needed? How much inventory will we need? Where will the re-sources come from? A disaster may damage or destroy existing assets, so the plan should contain provisions for replacing resources that are needed for recovery.

Include information such as the names and telephone numbers of important contacts in the plan to expedite recovery efforts.

Pre-position critical assets. Some resources needed for recovery may be difficult to replace quickly. It may be necessary to pre-position those resources in anticipation of a disaster. For example, a supply of important business forms may be stored at a remote location; backup copies of computer files may be made periodically and stored at a secure off-site location.

Define roles and responsibilities. De-ciding who needs to do what after a disaster has occurred can be difficult, so clearly define and document roles and responsibilities in the plan. Make sure people understand their roles.

Provide detailed instructions. Disas-ters frequently make travel impossible and impact employees, their homes, and their families as well as the business. Therefore, the plan should assume that some key employees may not be available to assist in the recovery. Provide detailed step-by-step instructions for recovering business functions so that someone with limited knowledge and familiarity could assist with recovery.

Test the plan and keep it current. Periodically verify that the plan will, in fact, allow the business to recover. This may involve walking-through a disaster scenario or actually staging a mock disaster and executing the plan. Also, periodically review the plan and update it for changes in the business, technology, etc.

(Gary Farrar is a senior managing consultant with BKD Technologies in Springfield.)