General Practice, Solo & Small Firm DivisionBest of ABA Sections
SPRING 1998 - VOLUME 2, NUMBER 1
Disaster and Contingency Planning: A Practical Approach
By Dennis Duitch and Terri Oppelt
The fundamental objective of disaster and contingency planning is business continuity—keeping operations running, providing professional services, maintaining client confidence, maintaining regular cash flow, and similar strategic activities for survival.
A disaster and contingency plan involves three stages: defining the risk and objectives, determining proactive preventive steps to minimize exposure, and developing a reactive plan. Keeping practical issues foremost in mind will be the key to whether a plan is ultimately workable.
Key considerations in the success of a disaster and contingency plan include: (1) focusing on keeping the business running, not just the computer; (2) addressing only those items that are pertinent and realistic and discarding any highly unlikely disaster; (3) ensuring that functional managers become architects of the plan; (4) limiting the scope of the plan to those functions that impact the stated goals and objectives of the plan (cash flow, continuity of client service, etc.); (5) writing the plan as "guidelines" rather than excessive detail; (6) identifying alternative manual procedures to perform critical functions normally handled by computers; (7) recognizing that inefficiencies will be the norm during a disaster; (8) keeping cost initially at a minimum; (9) making it simple and keeping it simple; and (10) using professional advisors to assist in focusing on the big picture and to ensure that important aspects don’t get inadvertently overlooked.
The following checklist can guide you toward the most critical starting point—asking the right questions. Using it will assist you in preparing your office’s disaster and contingency plan.
Determine Essential Business Functions. Ask key personnel how long the office can be without a computer for these critical functions: (1) A/P and disbursements; (2) A/R and collections/bank functions; (3) word processing; (4) court docket control; (5) court filings and pleadings; (6) billings and work in progress; (7) payroll; and (8) other. Next, gather alternative (paper/manual) ways to perform these functions short-term versus long-term. Determine what types of forms or information need to be taken "off-site" to continue these functions, and how long these functions should continue. Determine what departmental personnel are needed to perform these functions. List all functions in order of importance, keeping in mind the goals/objectives of the plan. Review needs in response to each function (e.g., client files required, copies of current court dockets, etc.).
Organize and Gather Information. Prepare an organization chart. Know the location and other pertinent information for such entities as the post office, police department, and fire department. Prepare a list of critical and useful numbers, including courts, messenger services, banks and banking accounts, insurance agents and policies, and the building manager. Also prepare a list of emergency contact numbers of facilities’ workers (preapproved by the lessor), including plumbers, electricians, movers, carpet cleaners, and contractors. Keep on hand a list of critical equipment and office supplies, including vendors with applicable account and reorder numbers, important forms for quick printing, printers with current letterhead and logo information, essential furniture (six-foot folding table, folding chairs, etc.), operating equipment (calculators, copiers, etc.), computer program information, and computer hardware/network configurations and information. Finally, prepare a list for emergency preparedness, with such items as flashlights for all offices without windows, water, food, blankets, toilet facilities and tissue, and communications equipment.
Protecting Communications. Develop a phone tree and have a list of key personnel, as well as prepared employee policies indicating whom to call during the emergency. Update and distribute the company phone directory, including car/cellular and beeper numbers. Gather information on the current phone system, including voice mail. The information should include data configurations, a forwarding and communications backup plan, and a list of vendors and critical phone numbers. Determine a contractually agreed-on response time. Understand how phone lines work, including the capacity for outside answering service, the direct inward dial system versus two-way lines, and the PBX bypass system. Gather information on alternative phone equipment regarding the use of cellular or portable phones, alternative equipment between floor communications, and emergency phone forwarding to a new or alternative number.
Protecting Primary Work Space. Review insurance policies for appropriate coverage (e.g., earthquake amendments and/or sprinkler damage). Determine whether there is coverage for valuable papers, such as provisions for alternative site storage as a named insured, and employee policies for documents left overnight in autos or homes. Identify what work areas and sectors are most important. This involves determining which personnel could work at home or in an alternative environment, equipment needs (fax, copiers, printers), preparing a list of vendors for equipment purchase or lease, and determining computers and programs and who needs what.
Determine space needs for short-term versus long-term recovery. Prepare a list of alternate sites of recovery (e.g., hotels, buildings in area, and reciprocal agreements with other firms).
Protecting Computer Processing Ability. Prepare a responsibility and execution list for all computer personnel. Prepare, review, and test normal operations backup and security plans. Review where backup is stored and periodically test backup data. Perform periodic software backups. Determine a list of all software applications now in use. The list should: (1) include the name/version/vendor; (2) indicate users/level/importance of software; (3) indicate whether software has had special modifications; and (4) prioritize software regarding installation (short-term versus long-term). Compile and maintain a current inventory list of computer hardware, compile minimum off-site requirements for short-term recovery, and compile a list of potential vendors for quick-ship equipment. Prepare for the restoration of computer processing ability by making a priority list as to which systems are up and running first. Compile a list of outside contractors and data entry operators, and a list of data equipment movers for potential site relocations. Finally, determine what, if any, preventive measures are in place in the office, such as the use of surge protectors, employee compliance with network policies and procedures, the location of equipment in a safe place (e.g., computers on desk, not the floor), and the use of equipment covers to prevent water damage.
Dennis Duitch, CPA, MBA, senior partner of Duitch, Franklin & Company, LLP, Los Angeles, is a consultant to law firms and attorneys. Terri Oppelt, a principal in Duitch, Franklin & Company, LLP, has developed and implemented disaster and contingency plans specifically for law firms.
This article is an abridged and edited version of one that originally appeared on page 38 in Law Practice Management, September 1997 issue (23:6).