Published in the Michigan Business Law Journal, Spring 2008.
This column has its roots in a lunchtime conversation between the authors several months ago. The weaknesses in current models of business continuity planning came up in our discussion, and we recall that both of us said, almost simultaneously, “People!” This column is an adaptation of an article previously published by Scott Goemmel.
Businesses are exposed to some form of potential disaster and interruption on a daily basis. Each year, the volume and impact of these events increase, while most companies make little or no effort to be truly prepared. As lawyers, we teach our clients the importance of proactive planning through contracts, estate planning, wills, and trusts, but lawyers should also counsel businesses about the importance of business continuity planning. Business continuity planning is a process that will provide a competitive edge to firms who emphasize the importance of the plan, apply a degree of proactivity by implementing the plan, and continuously monitor and improve the plan’s effectiveness.
The approach to business continuity planning introduced in this article is very different from plans present in the marketplace today. While this column is about technology, the primary difference is that true continuity plans start with people and not the underlying technology. Many firms have a basic level of recovery capability for key system resources, but even in some of the best technical plans, the importance of humans is understated and the overall recovery objectives often unattainable. This is the primary reason that such an approach to continuity planning is needed, regardless of the maturity of the existing plan.
Step One: People—The Critical Resource
The key premise of this approach is the assumption that it takes extraordinary human interaction and focus to continue critical business functions during and after a disaster. With the absence of people and a high degree of energized focus incorporated into the culture, customer service, reputation, and potentially the company’s survival are in jeopardy. An organization’s most important assets affected by a disaster are the employees and customers. In a service business, people must come first in the plan.
Consider the case of New Orleans. During and immediately after Hurricane Katrina struck the city, the evacuation and safety of the community were the first priorities. However, once the storm settled and customers began to come back home, many businesses had no idea where their employees were located. The very people necessary to a firm’s recovery plan were scattered across several states. Without the most vital of the resources, experienced employees, many recovery plans fell behind even though “technically” their systems could have been operational.
Employees and family always come first!
The safety of employees will usually be paramount in the minds of business owners, but the business needs attention too. How should you plan?
- Know where your employees would go if they needed to leave the general area in the event of an emergency.
- Have contact information for their primary and alternative locations that includes the homeowner, phone, email, and mobile access.
- Provide an emergency number for your employees to be able to contact the firm. Recorded messages can let people know what is going on.
It is simple to begin a process for gathering this information and initiating an easy family planning process that includes sharing some key information with the firm. The bottom line is simple: know where you and your employees will go; know what they will do if they need to leave the area; know how to fi nd them, pay them, and enable them to work remotely if needed.
Linkage to the Company
A key benefi t of starting with employee planning is that it begins to instill a real connection between the individual and the firm in terms of working together and building continuity planning into the culture. More importantly, a realistic plan recognizes that it takes extraordinary human focus to work in diffi cult situations, and if there is any question about the welfare of family, then those issues have to be addressed first. Linking this employee communication process to the company’s plan results in a foundation that is better aligned with the business continuity requirements.
Step Two: Keep Yourself and Your Customers in Business
If you can keep your customers in business, then your firm has a much better chance of survival. Regardless of the severity of the situation, there is a positive impact on the firm’s reputation for having planned for continuity.
Once a communication process for employees and a level of knowledge regarding their family’s safety has been established, you can truly begin ensuring that the company “continues” the critical business processes needed to support its customers. Even the smallest of firms have many key business processes that are required for deliverables and to maintain operations. Many of these processes are enabled by one or more technology applications and their related infrastructure. In order to prioritize efforts in both disaster recovery and process continuity, there must be an established priority for each of the required activities. The business continuity plan should clearly indicate how the critical processes will be maintained regardless of the current physical environment.
Priorities
Determine the most critical business processes (in order of importance) and document a simple process for how the operation will continue while the underlying components are returned to their pre-disaster conditions. To assist in prioritizing the processes, a simple matrix can be developed that matches the key business processes against their operational impact. Some example operational impacts often are:
- Impact on customer service
- Loss of customers
- Loss of revenue
- Exposure to penalty clauses
- Exposure to possible litigation
- Loss of key information
- Negative financial impact
- Impairment of firm reputation
Avoid over-complicating the number of critical processes from the onset of the plan. Start with one or two critical processes, determining how they will operate and their priority during recovery. Maintaining simplicity from the start, and building details and scope over time is a practice that most firms can use to ensure the quality of the plan is maintained. Thus, the plan’s linkage to the firm’s culture is achieved.
Linkage to the Leadership
Success starts at the top, so begin with bringing top management into the approach. The champion of the plan must have authority supporting the common goal to ensure that consistent progress is made and incorporated into the firm’s culture over time. This is a way of life in today’s world, no longer a binder sitting on a shelf that we hope to never utilize.
Summary
Business continuity planning and disaster recovery are very important components of any business plan. There is no question, however, that the overall level of detail can be overwhelming and is often the reason why many of the best intentions never get the level of priority needed for success. With the ever-increasing level of risk and related reliance on information technology, we must begin to realize that our responsibilities go much further than our corporate needs. Business continuity planning is about the interrelationships within our families, communities, and businesses. Getting started and ensuring that we incorporate a human element to our continuity plans is an essential responsibility as we engage in business planning and implementation.
About the Authors
Michael S. Khoury, of Jaffe Raitt Heuer & Weiss, PC, Ann Arbor and Southfi eld, practices in the areas of information technology, electronic commerce, intellectual property, and commercial and corporate law. He is the Chairperson of the State Bar of Michigan Business Law Section and past chairperson of the Computer Law Section. He is also a member of the American Bar Association Sections of Business Law, Science and Technology, and Intellectual Property.
Scott M. Goemmel is Executive Vice President and a founder of PMV Technologies, Inc., a provider of business consulting and information technology services based in Troy, Michigan. PMV Technologies specializes in delivering managed information technology services to small and midmarket businesses, service providers, health care and fi nancial institutions. Mr. Goemmel is a graduate of Kent State University and is a recognized industry leader, most recently named as one of the top 25 Most Infl uential IT Executives by CRN magazine.