Jeff Judy

Jeff's Thoughts - April 15, 2009

Disaster Recovery: Treat the Symptoms!

In the last issue of Jeff's Thoughts, I wrote about the need to make disaster recovery (or "business continuity") plans much more than dusty documents stored in someone's file cabinet. Every employee should be able to say, instantly, what first steps he or she would take in the event of some catastrophic threat to business operations.

At the same time, I realize that you could spend your whole life planning for disasters. Hurricanes, ice storms, earthquakes, terrorism, economic collapse, and the occasional pandemic just start the list.

A small organization can devote only so many resources to developing disaster recovery plans. That could be one reason why results of the "Pandemic Flu Exercise of 2007" conducted by the finance related agencies of the federal government show that nearly 40% of institutions with less than 500 employees had no business continuity plan for a pandemic at all. (See the "pandemic exercise" site for more about the sponsors of this activity, and links to the final report.)

So how does, say, a community bank or other small financial services provider face this list of potential disasters?

You can develop a very good response plan, as part of your strategic planning, by focusing on the ways various disasters impact your business operations. In other words, identify the symptoms of disaster, as reflected in your business operations, and then treat the symptoms!

Let's take staffing problems, which can have a severe impact in a couple of ways. You could lose a few key personnel, or you could simply lose so many people that it is hard to keep going.

Now these losses, short-term or long-term, could be brought about by many things. A pandemic is likely to severely limit your available staff. But a Katrina-sized hurricane in the right place could do the same thing. Earthquakes, floods, and the collapse of roads or bridges can make it impossible for staff to get to the office for days.

Does it matter much why they don't get to work? Oh, depending on the cause, you might have more options in some situations than in others. But for the most part, your first steps in response to the staff shortage will be much the same, and it is those first steps that can make all the difference.

Or take loss of power. This past winter has seen some communities without electricity for weeks! Are you prepared for an extended power outage?

Again, this is a threat that could have a variety of causes, but you have to focus on your first line of defence against the symptom, against the actual mechanism within your business that disrupts operations.

If you work for a smaller organization, you may not be able to learn all you would like about every kind of disaster. But you know your own business. You can figure out what kinds of "symptoms," what effects of external disasters, would lead to a shutdown of your business. You can boil these down to several key vulnerabilities, and you can develop defences and responses for each of these.

And then, of course, you can take your very first step toward truly protecting your business from catastrophe -- communication! Leaving your disaster recovery plan in the hands of one in-house expert (or small department) can be fatal to your business. Sharing the plan once with all your staff isn't any better.

Only when everyone, absolutely everyone, who works for you knows the first thing to do when one of these "symptoms" occurs, is your prognosis in the face of a serious threat a hopeful one.