Be prepared

As you watch the emergency services going about their tasks, partners and staff ask you: “Now what do we do?” The same question had, of course, passed through your mind. But, as the risk management partner in your practice, you are the person who is supposed to have all the answers. Do you? Is your response: “Well, we have insurance for this sort of situation.” Fine. Insurance is, no doubt, a “good thing” – and business interruption insurance is available as an element of the insurances that most practices carry – but your answer hardly begins to address the practical difficulties with which the practice is faced. Are you now wishing that you had taken steps to address some of the business continuity planning issues highlighted at the Risk Management Roadshow you attended last year?

If you are inclined to dismiss the need for business continuity planning by thinking “It will never happen to me”, consider that several delegates at this year’s Risk Management Roadshows were able to recount “war stories” where “It did happen to me”. So, before you read on, just take a few minutes to ask yourself how you would deal with the above Friday 13th scenario if it happened to your practice today. Could you deal with it on an ad hoc basis, and if so, how? What things would you have to do? In what order should you do them? How would you avoid duplication and wasted effort? Could you take all the steps you need to take in order to minimise the adverse impact of the incident on your practice and its clients?

Have a plan

Chess grandmasters say that in chess having a bad plan is better than having no plan at all. While the analogy with chess is not exact, nonetheless, if you took a few moments to think about your response to the above Friday 13th scenario, it should hopefully be obvious that a modicum of preparation and planning for continuity of the business is better than struggling to deal with any threat that arises on an entirely ad hoc basis.

Business continuity planning would normally start by: identifying what could seriously threaten continuity of the business, addressing the threats that are controllable, and formulating and implementing a plan to respond to and mitigate the impact of the uncontrollable threats.

However, putting together a comprehensive plan to cover every conceivable situation, could, even if it were possible, take up hundreds of hours of management time and prove to be very expensive. Indeed a business continuity plan that is so large that it requires a lever-arch file to contain not only the plan but several appendices, is likely to be useless in a crisis – imagine trying to manipulate a lever-arch file to find out whether “temporary accommodation” is dealt with in chapter 3, chapter 6 or appendix E, in the pouring rain with an umbrella in the crook of your arm and a mobile phone stuck to your right ear! Moreover, “one size does not fit all”. For example, practices that have branch offices relatively near the affected premises may find it easier to plan for temporary relocation than those that do not. Practices that specialise in certain areas of work, such as investment management, may find they need to plan for certain contingencies that others do not.

Make a difference

Nonetheless with relatively little time and effort, it should be possible to develop a plan that addresses at least some of the critical issues and has the potential to make a big difference to the recovery of normal operation of the practice and how the practice is perceived by its clients. Of course, it cannot, and is not, claimed that such an approach will either address all the problems that are likely to occur or that will suit every practice. But a plan which addresses even just the following critical issues is likely to make a significant and measurable difference compared with the alternative of doing nothing at all.

Organisation

Nobody knows how well people will respond in a crisis until the crisis actually occurs. But someone, a partner, must be in overall charge. There are too many tasks to be accomplished – and the larger the practice, the more tasks there may be to be accomplished – by one individual alone. Others have to be given specific and complete authority to deal with certain matters. All partners and staff need to know exactly what they have to do.

Records

Many practices arrange to have backups made of cashroom records, word processing files, file lists and client lists on a daily basis and, at the end of the day, the backup media will be taken to a bank or some other place for safe keeping.

You should also have, off-site, contact details for clients, colleagues, and suppliers. It goes without saying that these records should be readily available. They need to be regularly updated so that they are actually usable.

The “paperless office” now being contemplated by some practices will create even greater dependence on the availability of firms’ IT systems (particularly when these contain financial data), although arguably less dependence on premises. IT security arrangements and contingency plans therefore become increasingly important.

For firms involved in investment management with records held electronically, it could be enormously disruptive and damaging to be unable to access up to date information on shareholdings, particularly if the problem occurs around the end of the tax year or a Budget involving capital gains tax changes.

Communication

By making sure that copies or backups of records are comprehensive, regularly taken or made, and kept at a secure location, you will at least be able to achieve the following – even if the plan does not include details of who should be contacted and in what order:

• Partners and staff can be contacted and given information
• Clients can be contacted
• Insurers/brokers/loss adjusters can be notified
• The Law Society of Scotland can be notified
• Files can be partially reconstructed (or more than partially reconstructed, if the practice operates a “paperless office”)
• Cashroom records will be available, minimising the possibility of a breach of the accounts rules.

Staff issues are dependent on when a disaster occurs.  If it occurs during the course of the working day, issues arise about how to get staff home (possessions may have had to be left inside the building in the anticipation that the evacuation was a drill).  Decisions also require to be taken about advising staff when they should come back to work, reassuring them about payment of salary etc.

Remember that IT systems are relatively easy to back up and duplicate in the event of a catastrophe.  Managing people and communication with clients can be a lot more difficult and, if handled badly, can result in a far more serious disruption to fee income than having proper IT systems up and running.

Clients will have seen the pictures of your office premises well alight and may be convinced that the firm is no more.  It is vitally important that some effort is made to contact them as soon as possible. In the event of a disaster, there may be potential technical non-compliance with the accounts rules. Therefore the Society requires to be advised. There may also be potential “circumstances” under the Master Policy – advise Marsh. 

Temporary relocation

In many cases it may be impossible to gain access to your offices quickly. Security of your firm’s and colleagues’ possessions remaining in the building may have to be provided. You may need to consider obtaining emergency temporary office accommodation on a short term basis. Investigate where suitable accommodation might be available and keep that under review. Sourcing premises only after an emergency has occurred might be difficult. Assess how much accommodation you will need.

You will need to secure temporary use of telephone/fax services. Arrangements will require to be made to divert telephones calls and the mail. Who, if anyone, has the emergency telephone number for your telecoms provider?  Do you know who your telecoms provider actually is?

What IT equipment do you need and how are you going to source the necessary equipment? It is not much use having backups of computer records if there is nothing for them to run on. At the very least, you will need to get the cashroom operational as quickly as possible. Who is going to set up the equipment? Do not forget to plan for the provision of necessary equipment for those who have to work from home.

Client transactions

Crises never happen at an “ideal” time when nothing is happening in the office. There are always ongoing transactions or cases, many of which may be time-critical. How would you make sure that time-critical transactions were handled so that your clients are not prejudiced as a result of the crisis? In conveyancing transactions, remember there may be no cheque books, no signed deeds and no files. Clients will have to be contacted. What are the priorities in terms of client work?

You won’t regret it

It might never happen to you. But, remember the Scout motto: “Be Prepared”. If it does happen to you, you will be glad you were prepared.

See also the article entitled “Continuity planning – taking the drama out of a crisis”, Journal, May 2003, page 38.

Russell Lang is a former solicitor in private practice and now works in the Financial and Professional Risks Division (FINPRO) of Marsh Ltd (e-mail: russell.x.lang@marsh.com).

The information contained in this article provides only a general overview of subjects covered, is not intended to be taken as advice regarding any individual situation and should not be relied upon as such. Insureds should consult their insurance and legal advisers regarding specific coverage issues.

Marsh Ltd is a member of the General Insurance Standards Council (GISC).