Better safe than sorry

Planning for a disaster is essential good business practise

Hopefully the plans will never need to be put into place, but it's better to be safe than sorry Very few small business owners plan on having a fire, burglary or flood - never mind being caught up in a terrorist incident.

Most will have insurance but more than half have no plan for keeping the business running in an emergency, according to a CBI/KPMG survey, despite 2005's London bombings and the Buncefield fuel depot explosion. Twenty four per cent of London firms lost business after the bombings and the Buncefield blast cost neighbouring companies £70 million.

An East of England Development Agency study, released this week, found that 25 businesses were seriously affected with 16 having to entirely relocate, with 1,422 staff. Still many small companies feel that they either do not need or cannot afford the full-blown disaster recovery schemes of big business - where alternative premises are on tap with computers and phones from day one. Files are neatly backed up and customer calls diverted. This means that small companies often rely on their lone IT manager - or worse, their mate's mate who "knows a bit about computers." Unfortunately, as well as not understanding every aspect of your business, they may not be around when you need them. But there is a middle ground.

Since May, local authorities have had a duty under the new Civil Contingencies Act to provide business continuity advice and assistance to local organisations. Nick Beale, director of disaster planning company CitySafe, advises small businesses to seek partners such as their local council and the police and to consult neighbours.  “If you share a building with other businesses you all need to decide what will be done in an emergency" he says. Ensuring there is power, for example, despite possibly having different energy suppliers.

Relationships with suppliers are key. "Business continuity plans developed and tested in isolation, run the risk of failing, and, more worryingly, disrupting the plans of other businesses within close proximity.  He advises firms to find a business in another location willing to provide support that you could reciprocate if they had a disaster.

After the Manchester bombing, he says, a major retailer was able to operate from the premises of another leading store. CitySafe, backed by Scotland Yard's counter terrorism unit and curiously based on a boat in the Thames, says that the police need to know who you are and what your plans are to allow you through cordons.

Other experts have simple but crucial tips such as to focus on WHAT needs to be done rather than HOW disaster might come about. For example, don't spend time making different plans for flood, fire and so on, make plans for how to run computer systems and access files if you cannot use your normal business premises. If the three things that are key to your business are phones, web site and pricing database - concentrate on those.  

“Companies should have a flexible business continuity plan capable of responding to a variety of scenarios" says Graham Titterington, principal analyst at high-tech consultants Ovum. Chris Mayers, principal security architect at remote access specialist Citrix, adds:  “Clear thinking about how to keep the business running, rather than just getting it back on its feet is the most significant trend we have identified." IT departments often come up with plans that just cover IT failure.

The business owner will hopefully be able to see the big picture, therefore they should take charge of the plan. Connections to the internet are not much good if there is no electricity to run the PCs or indeed if you can't get through the front door. Ask where can you relocate staff, how can you forward phone numbers, how can you make sure your web site stays live? If you need specialist equipment, do you have a trade association that could help you to share resources with another member? Get input from every staff member. As the head of the company, you may not have thought about redirecting mail so you can receive cheques, cancelling food deliveries or moving vehicles for the police.

A wealth of lessons has come from the owners and staff of internet firm Intercosmos Media. They were stuck in their office in the middle of New Orleans for ten days after the Katrina storm last year. Posting what became popular weblogs throughout their ordeal, they said that not only did no power mean no lights, but no power in the area meant no mobile phone service.

Sigmond Solares, the company's chief executive who stayed behind to run the data centre, says to make sure you actually make contact with staff - don't just send out an e-mail or rely on news broadcasts. One staff member unexpectedly turned up for his night shift having slept all day - he was unaware of the scale of the disaster unfolding. Aside from this, you need to make sure they are safe. Have a policy of everyone checking in. Make sure you have a supply of cash, Solares adds, as cash machines will go down and all purchases will require cash. And duct tape - lots and lots of duct tape. They used it, among other things, to bind sofa cushions together to make mattresses.

Many IT companies offer services to help stave off computer disaster. One of the most important is continuous data protection - where frequent back-ups of computer records are made. Experts point out, however, that you should check that your back-ups are readable. The backed-up data should be stored off-site and be made accessible from elsewhere - securely. But don't forget the physical and geographic issues. It's great to have a generator for back-up power, but if there is risk of flood, don't site it in the basement.

Always carry a business card with an address on it so that the police are more likely to let you in to your premises. If you have failsafe locks on the building - that pop the doors open in an emergency - you need to make sure that you can then secure the building afterward. Don't rely on a minimum wage concierge who may not feel inclined to hang around if there has been a bombing. And lastly, don't locate your disaster recovery site next to a major fuel depot, as a certain Government organisation did at Buncefield.

END

If you would like to know more about how your organisation can get involved and benefit from working with the Continuity Forum, please email us HERE! or call on + 44 (0) 208 993 1599.