Disasters, both manmade and natural, can strike at any time, at any place. And if you’re not prepared, your business might be forced to close — which, even if only temporarily, could lead to devastating consequences.
Ravi Sundara, partner and firm manager at The Stolar Partnership, says that a comprehensive disaster recovery and business continuity plan is key to ensuring a business’ survival in the wake of a catastrophe.
“With proper planning and preparation, a business can place itself in a better position to ensure that it will continue, even in the face of disaster, which is important to a business’s customers, employees, management, owners, business partners and markets,” says Sundara.
Smart Business spoke with Sundara about how to be proactive, the legal issues that may arise if you are unprepared and the importance of having off-site backup.
How can preparing for the worst-case scenario help a business re-emerge from a catastrophe?
Proactive planning and preparation are extremely important in helping to ensure business continuity when disasters or other major business interruptions occur. Everyone is familiar with fire, tornado and other disaster drills. The reason we go through those drills is so that we know in advance how to respond, rather than trying to figure it out on the fly in the middle of a disaster. A disaster recovery and business continuity plan serves the same purpose for the business.
What steps can business owners take to prepare for disaster?
It is important to have insurance coverage for loss of property, liability and business interruption. Also, you should have contracts and alternatives in place to deal with disasters that might happen elsewhere that can affect your supply chain. Take, for example, the recent tornado in Joplin, or the earthquake and tsunami in Japan. Your business may be dependent on other businesses to supply it.
Make sure you have alternative vendor arrangements, or have at least identified where you would turn if a current supplier is unable to deliver shipments. For disasters that directly affect the business, options should be in place for temporary office or plant locations, as well as alternative communication methods. If the phone systems go down or there is no cell phone coverage, how will you communicate? This is important not only for internal communications but external, as well.
What types of legal issues commonly surface for businesses that have been affected by a disaster?
There are a number of legal issues, including contractual issues, regulatory compliance and negligence claims. Contractual issues involve fulfilling obligations to customers in the aftermath of a disaster. If a business is unable to fulfill its goods or services obligations, does it have contracts that require it to come through regardless of the circumstances? If so, it could be in breach of its contract.
If there is a force majeure clause — commonly thought of as an Act of God clause, but broader — the business may be let out of the contract or given an extended period to perform. Even if there is a force majeure clause, however, the business might still be responsible for performing if it could have reasonably planned for foreseeable, yet uncontrollable, circumstances, such as a power outage.
Negligence is a failure to act as a reasonably prudent person would under similar circumstances. Failure to plan for reasonably foreseeable disasters could allow customers, employees or others to bring legal claims asserting negligence based upon the failure to undertake reasonable planning for disasters.
In addition, directors of a corporation have a fiduciary duty of care owed to the corporation, and the failure to undertake reasonable business continuity planning to address foreseeable disasters could be a breach of that duty for which the director may be held liable.
How important is it to back up computer data frequently and keep a backup tape off site?
It depends upon the nature of the business and the type of data that is being stored. In other words, how much data could the business stand to lose and still be able to function? It could be a day for some businesses, and it could be an hour or even just minutes for others.
Off-site backup is very important because if a disaster strikes and disrupts your main systems, and if the backup is located in the same location, the backup could very well be destroyed, as well. This is why many businesses that have good disaster recovery and business continuity plans often use data centers located in other regions of the country for their off-site backup needs.
How do disaster recovery plans and business continuity plans differ?
Disaster recovery — involving data, information and documents — is really one piece of a broader business continuity plan. A business continuity plan includes those essential functions that a business needs to perform in order to continue operating. It covers identifying items such as employees’ roles and responsibilities, systems and data recovery, temporary locations, alternative communications, alternative modes of transportation and funds management. Some companies, such as financial institutions, may be legally required to have both a disaster recovery and a business continuity plan.
How often should a disaster preparedness plan be reviewed?
At least once a year. Contracts change, needs change and technology changes. The last thing you want is to have a disaster occur and when you pull out your data recovery/business continuity plan, you find that most of the items are no longer relevant, making the plan useless when you need it the most. Finally, it should be tested periodically, even if that simply means walking through it with your top management and staff.
Ravi Sundara is partner and firm manager for The Stolar Partnership. Reach him at (314) 641-5143 or [email protected].
