RSM Resources

Hurricane Katrina hit the Gulf Coast with torrential rains, destructive winds and catastrophic floods, destroying many homes and businesses. Access Floor Systems was not one of them.

Access owner Carol Blake developed a disaster contingency plan for her business a year and a half ago, and the plan kicked in prior to Katrina’s landfall. The New York Times chronicled how Blake moved her employees, records and shipping operations safely from Covington, La., to a secondary office in Asheville, N.C. The company transferred its Web site to a national hosting service and forwarded phone calls to its new base. While rescue efforts got under way in New Orleans, Access Floor Systems was up and running, according to the Times.

Blake’s forethought saved her company and livelihood. Her employees also kept their jobs and received an evacuation destination.

Why worry?
The Sept. 11 terror attacks jolted disaster contingency planning to the forefront, but many companies still lack a defined, comprehensive and flexible approach to dealing with major crises. Most business leaders recognize the need for such an approach, but three issues often slow the process or stop it altogether:

Overextension. With the pressures of day-to-day operations and profitability, many business leaders don’t feel they have the time, personnel or other resources to devote to comprehensive contingency planning.

Overreaching. Companies sometimes reach too far and wide, compiling a laundry list of potential threats. Such a list can be overwhelming and make planning seem impossible.

Overplanning. Some organizations maintain several contingency plans for specific situations or departments, but those plans could cause bigger problems if left uncoordinated.

The key to successful continuity planning, experts say, is to define the core functions your company must maintain, then plan to that goal — not to a particular type of event or catastrophe. That way, instead of defining goals and assigning roles amidst chaos, management can monitor progress according to plan and address unexpected complications.

Defining "continuity"
The biggest challenge is narrowing the focus of your contingency plan to core functions you must maintain. According to Curtis Siegel, a director with RSM McGladrey Technology Risk Management Services, "Management needs to ask, ’What resources are we prepared to expend?’ You can go to the extreme and say, ’I’m going to be prepared to deal with any event, anywhere,’ but aside from the federal government, most organizations don’t have the resources to do that."

Instead, company executives should ask themselves, "What are the two or three activities that we can’t do without?" For data-driven companies, IT may be indispensable; for service companies, payroll and benefits may be most critical. Focus on the core functions your company needs to survive.

Of course, different departments within a company may have distinct views of what constitutes a core function or what level of service constitutes continuity. Reaching consensus requires strong leadership and, occasionally, an outside perspective.

For example, when Waukesha County, Wis.,developed its disaster contingency plan, officials turned to outside sources: a continuity planning consulting firm, and federal, state and local law.

"The prioritization  had to be standardized countywide — this eliminated each department declaring that their function was the most critical," says county official Susan Connelly, who led the planning initiative. "If it was a statutory requirement that there be no lapse in service, that function came up first."

As a result, in Waukesha County, juvenile court functions received top priority, followed by tax collection, and so on. However your organization’s functions are prioritized, it’s important to define a baseline for business continuity, then plan to that goal.

Keeping flexible
Once an organization defines continuity and establishes reasonable goals for maintaining core functions, it’s time to develop roles and actions to meet those goals. Too often, companies plan according to specific situations they anticipate and assign roles that correspond to employees’ day-to-day activities. The problem with this approach is that contingency planning is about preparing for unexpected and atypical situations. In other words, if you know when and where a disaster will hit —and that you won’t need to shift personnel — it probably isn’t a disaster.

Flexibility is critical. The best disaster contingency plans:

Function across crises. Think about New Orleans, pre- and post-Katrina: mass evacuations, fuel shortages, power outages, storm damage, flood damage, looting, and the occasional explosion or fire. Many companies that prepared for the storm probably didn’t even fathom the wide-ranging, worst-case scenario that unfolded.

Facilitate personnel shifts. Disasters naturally force people from their comfort zones and can quickly render key team members unavailable. Roles and responsibilities should be defined based on the core functions to be maintained. Team members should understand those roles and be ready to assume them as needed.

Support the greater good. Generally, no department has the resources to maintain the organization’s core functions alone. Teams need to be prepared to work together toward common goals.

Encourage open lines of communication. The only way to deal with unexpected events and unfamiliar roles is to stay in close contact with core team members, employees and external information sources. Frequent communication with all constituents can provide valuable information and reassurance.

Once goals, roles and responsibilities are established, most contingency planning experts urge organizations to test their plans thoroughly through simulation. In such an exercise, companies rehearse a particular scenario and implement their contingency plans.

"It’s educational for the employees and management, and serves as a shakedown of the actual process to validate the plan," Siegel says. "As the plan is tested across situations, we throw in new variables, take out key members, etc. The questions we want to answer are, ’What does it take to stay online?’ and if it goes offline, ’What does it take to bring it back?’"

The results are always enlightening and often empowering. In Waukesha County, Connelly says the experience was gratifying.

"Although the departments understood the merits of developing a plan, the difficulty was getting them to make planning a high priority," she says. "The staff did the county proud — they really responded to the exercises and were well-prepared. After each exercise, recommendations for improvement were offered. [As a result], I feel that our county is better prepared than most."

A plan for every contingency
Contingency planning for disasters doesn’t benefit companies only during the worst of times. Once a plan is established, companies can apply successful processes into other areas — for example, by looking for smart ways to maintain more-peripheral functions, or strategies for moving quickly when opportunities present themselves.

A key to making contingency planning more valuable is to shift thinking from disaster management to incident management. All disasters are incidents, but not all incidents are disasters. For example, if a supplier or competitor faces a crisis, the situation could be an opportunity. Like a disaster close to home, however, realizing that opportunity requires flexibility and quick action.