top stories

How would your organisation cope with the aftermath of a major disaster? Richard Harbord shares his first hand experience of implementing a business continuity plan.

In my recent career I have been very involved with the business of the local government’s role in planning for civil and other emergencies. Every local authority has its own emergency plan and is well prepared to assist the blue light services in the swiftest possible return to normality after any sort of emergency.

These emergency plans are not glossy documents, kept on the shelf gathering dust and rarely used. A large local authority can expect to refer to its plan as frequently as every week to cope with a small emergency affecting a handful of residents. Common examples include gas leaks, burst water mains and power failures.

However, the full emergency plan would normally only be required in the case of a major – or catastrophic – incident.

The terrible incidents of 11 September 2001 in New York altered the way in which planning for possible emergencies was considered and it suddenly brought very much into focus the need for organisations to consider how they would continue to provide services should an emergency make life difficult for a prolonged period of time.

Reports came from the commercial organisations who lost their accommodation on September 11 about some of the difficulties they had in continuing their businesses elsewhere without disruption. Translate this need to public sector organisations whose communities rely on them for basic services and the real need for business continuity planning becomes very obvious.

There are, however, a number of problems associated with it. There can be no finite set of emergencies to plan against. In a large local authority where several different services are provided in a variety of locations, to plan for a specific set of givens is not possible. The business continuity plan must be generic but it must also be fairly flexible.

Compiling a Plan
Business continuity planning is a sensible and pragmatic view of risk management which has to include all of the following:

Crisis Management
That is to say the immediate handling of the emergency. The safety of those on site, their evacuation, contact with blue light services etc. This needs a plan of its own – who will take charge; who are your wardens; are they trained and properly equipped; is the organisation rehearsed; does everybody understand their part in the safe dealing with the crisis?

Planning
Every organisation needs to anticipate potential crises. Organisations are given the broadest warnings when risks are high. Particular events which might cause difficulty should be examined. Individuals soon forget their roles and forget to be on their guard, so communication is very important.

Business Process
Whatever the business it needs to consider how it would continue to function following a crisis incident. This may involve a temporary move elsewhere. The need to use other premises and the need to adapt and be flexible. All the evidence is that under these circumstances staff respond magnificently and the organisation will benefit from enormous good will.

However, this no substitute for a proper plan and using that good will in an organised fashion. Emergency organisations have had to plan for the possibility that their normal command centre will not be operable. Terrorist activity often strikes at the centre of cities where these command centres historically have always been centred. So whether your business is a school or a local authority, you need to know how it is going to operate under different scenarios. Disruption may be temporary – until power is restored, roads opened etc – or it may be long term, with a need for alternative accommodation etc.

With some flexibility of use it may be possible to share your solutions with similar organisations, but only following careful pre-planning and clear agreement in advance. It is vital to maintain updated records of staff, customers, clients and business activity – stored off site and updated every night. On 11 September there were organisations who lost all their employee records.

Contingency and Recovery of Technology
Normally all organisations have these plans in place. They must meet the needs of allowing business to continue as normal regardless of where the crisis has struck. Traditionally this would involve sharing of mainframe computer etc. Today there are often small systems spread across the organisation, which means each system or department must be assessed separately. Remote storage of back-up data is an essential part of this planning.

Other Issues
Even if the technology is in place, there is a need to ensure that individual managers know what to do in an emergency. Communication is the key priority in the aftermath of a major incident. Phone networks may be out. The mobile networks may be reserved to the emergency services. Nothing can be assumed. It may not be possible to use e-mail. All management staff must have been involved in discussing the options when formulating a plan, understand the solution, and be able to communicate this to other staff. Goodwill should be a given but is not much use if you cannot communicate with your employees.

Investment
It is no good pretending that business continuity planning can be achieved without spending money. However, this need not be a major expenditure and it should be seen as a major investment in maintenance of vital services.

Practice
The most complete plan will fail if it is not regularly tested. Such exercises are difficult to arrange – they are time and resource rich – but are essential. Local authorities might regularly use sections of the emergency plan, but it is a major exercise bringing everyone together. Such an exercise should be practised annually to ensure roles are clear and that newer staff are familiar with all procedures.

Conclusions
Every organisation needs these plans and they must be able to cope with any crisis however large or small. The key is that the business continuity plan is there to help meet the demands of employees, customers, suppliers, auditors and regulators.

Richard Harbord has 15 years’ experience as a chief executive of several London boroughs. Since June 2002 Richard has acted as a consultant to the London Resilience Committee and Cabinet Office.

Back to top