Not just a fancy name

Introduction

On the first of this month, the Solicitors’ Code of Conduct came into force in England & Wales. Amongst other provisions, that Code of Conduct requires solicitors in England & Wales to have procedures in place for the effective management of “the continuation of the practice of the firm in the event of absences and emergencies, with the minimum interruption to clients’ business”. In effect, the relevant provision of the Code of Conduct, rule 5.01(1)(k), requires solicitors in England & Wales to be able to demonstrate effective business continuity management to their regulator, the Solicitors Regulation Authority.

There is currently no compulsory requirement equivalent to rule 5.01(1)(k) for solicitors in Scotland. However, as readers who attended any of the Risk Management Roadshow events this year (which included three questions on business continuity management) will have learned, the Law Society of Scotland’s Insurance Committee is keen to raise awareness of the importance of business continuity planning across the profession in Scotland and to encourage Scottish practices to have at least a basic plan in place.

The benefits to firms of all sizes in having formal business continuity arrangements in place are indisputable, not only from the point of view of reducing the physical disruption to office systems, procedures and staff, but also minimising the risks of loss of valuable client business, and damage to reputation, which can result when firms experience disruptive events. Such plans need not be particularly complicated or lengthy documents.

And as the Code of Conduct also suggests, effective business continuity management forms an important part of a firm’s overall comprehensive risk management strategy.

So, as Martin Caddick of Marsh (senior vice president of Marsh and UK leader of the business continuity team with Marsh’s risk consulting practice) makes clear in an article in Managing Partner magazine, reproduced here, effective business continuity management makes good business sense for all law firms.

Stuart Skelly and Marsh - Stuart Skelly is a former solicitor in private practice who works in the FinPro (Financial and Professional Risks) National Practice at Marsh, the world’s leading risk and insurance services firm. To contact Stuart, email: stuart.skelly@marsh.com.

The information contained in this article provides only a general overview of subjects covered, is not intended to be taken as advice regarding any individual situation and should not be relied upon as such. Insureds should consult their insurance and legal advisers regarding specific coverage issues.

Marsh Ltd is authorised and regulated by the Financial Services Authority.

---

It is not hard to see why business continuity has grown in importance for British business in the past two decades. Every year has brought with it new risk, and it is important to be able to manage this changing environment. In the legal sector the launch of the new Solicitors’ Code of Conduct on 1 July 2007 will increase the emphasis placed on business continuity requirements, encouraging firms to keep the risk of disrupting client business to a minimum. But what is the true value of business-continuity management (BCM) to legal practices and what else is driving the need for it?

What is business continuity?

The term “business continuity” was once used interchangeably with “disaster recovery”, with a focus on helping large legal practices recover data and records. These days BCM is far more all-encompassing, with firms actively engaged in protecting their reputation and profits from the genuine exposures in their practices.

At Marsh we see and define BCM as “a process that establishes a secure and resilient business environment capable of mounting an immediate and effective response to a major incident”.

Consider these situations:

• How well will your firm cope with the unexpected long-term absence of a principal or fee-earner?
• What would you do if you had to evacuate the building during working hours, unable to return for several days?
• How will you cope with an out-of-hours emergency?

Each will require a different set of responses. It may not be much of an emergency if a particular partner is absent for a short period owing to illness, but if the absence threatens to be long term, does anyone else in the firm have the capability to pick up that partner’s workload?

In a changing environment like the legal sector – where time is of the essence in major deals and reputation and professionalism are all-important – a “tick box” business-continuity plan is not good enough. BCM must be a holistic process that identifies potential impacts and safeguards the interest of your partners and stakeholders in order to respond to any incident.

Key drivers for business continuity

The need for BCM in the legal firm is not new. Over the years many different types of event have created a wide variety of impacts – impacts that could have been lessened with better BCM practices.
The Solicitors’ Code of Conduct is the latest legislative driver for BCM. But there have been others in the past such as the Lexcel Standard 2004, which started to embed BCM in the legal sector. But the need for BCM should not only be viewed as a compliance process. An effective BCM programme can help to resolve a number of key risk issues that are fundamental to law firms of all sizes.
At the top of all law firms’ agendas is reputation. Credibility and reputation are probably the number one assets of any law firm, and any mishandling of an incident can jeopardise these. Conversely, effective and timely management of crises will enhance your reputation and build the confidence of both clients and partners.
The continuation of operation and support to key clients is vital. The protection of records and relocation of staff will help to minimise any disruption to the service offered. Also, as more firms have an international presence with globalisation, the need to understand risk across borders is important. Plans should be developed to minimise the impact of disruption to international business. Practical steps for developing pragmatic plans Increasingly, larger firms have some form of business-continuity plan in place. However, a recent survey from the Gazette in 2006 indicates that 37% only have a “basic” plan and 27% of firms don’t have a business-continuity plan at all. For a busy firm that is new to BCM, developing a programme that meets the requirements of the new Code of Conduct represents a real challenge.
There are four key steps towards developing an effective and pragmatic BCM programme:
1.    Business-impact analysis. Identify the critical business processes driving the business and analyse the losses expected from an interruption to each. This is the most important stage of the process, as it enables firms to determine the focus, prioritisation and resources required to successfully survive a disaster.
2.    BCM strategy development. Identify the options available to your firm to recover the business (remembering to think “outside the box”, for example using manual processes instead of IT). Then develop the chosen strategy to recovery for each of the key business processes. The overall strategy will link the recovery activities undertaken in different practices, locations or departments to the common set of objectives defined within the overall BCM policy for the business.
3.    Plan creation. Plans should be easy to read and follow under pressure (rather than vast complicated documents covering every eventuality). Plans should follow three distinct phases in order to focus resource on critical activities at the right time (Figure 1 please see printed version or PDF download of the Journal for tables / charts).
4.    Exercising. It is vital that a company continues to maintain its plan, and regular exercising is one of the most effective ways, both of creating awareness of the programme and spotting problems in a “live” situation. Without testing, failure can be virtually guaranteed.

Checklist

BCM does not need to be complicated, but some level of preparedness is required and is a key part of prudent business-risk management. Implementing BCM can feel like a real challenge, even for larger firms that have a plan, but getting a few fundamental things right can go a long way.

• Have the partners told the business precisely what level of business continuity is expected?
• Has every member of staff been told what business-continuity management is and what to do in the event of a major incident?
• Do department heads know how they will recover the business-critical processes for which they are responsible and how the required services and resources will be provided after a disruption?
• Are critical data and records backed up and protected?
• Do partners have the procedures to follow and the necessary information to deal with a crisis?
• Are there simple written procedures, which, if followed, will protect the staff and assets, and allow the business-critical processes to recover quickly?
• Is everyone confident the plans are current and up-to-date?

---

CASE STUDY: BUSINESS CONTINUITY PLANNING SAVES £20 MILLION

A law firm with offices in the west of England and London was concerned its business continuity plans were limited to IT recovery, and did not provide the business with sufficient protection in the event of a disruption.

The electrical substation providing power to the firm cut off the power supply to the head office one morning, at a time when the firm was on the brink of closing a business deal worth close to £20m.

The BCM plan was successfully carried out and the firm was able to close the crucial business deal even though it was nearly two days before power was restored. The existence of the BCM plan at the time of the power loss demonstrated the professionalism and the execution of a successful response to their client, and the difference between a company with or without a BCM plan.

---

Martin Caddick and Marsh

Martin Caddick is a senior vice president and UK leader of the business continuity team with the risk consulting practice at Marsh, winner of CIR magazine’s 2006 Award for Excellence in Business Continuity in the insurance industry. He can be contacted at martin.caddick@marsh.com .

The information contained in this article provides only a general overview of subjects covered, is not intended to be taken as advice regarding any individual situation and should not be relied upon as such. Insureds should consult their insurance and legal advisers regarding specific coverage issues.