One Year Post-Katrina, Few Firms Have Continuity Plans

A week or so after Hurricane Katrina roared out of the Gulf of Mexico and devastated huge portions of the coast, it became clear to officials at the Louisiana Department of Economic Development that they would have to rethink their long-term game plans.

“The mission of the LDED is to expand existing business while bringing in new investment,” Lana Sonnier, a spokesperson for the agency tells the E-Commerce Times. “Katrina, and later that month, Hurricane Rita, impacted 40 percent of the state economy. We knew we would have to do something beyond our traditional mission to help companies stay afloat.”

One step the agency took was to establish a US$10 million rapid response fund. Authorized by Governor Kathleen Babineaux Blanco to redirect its original funding, LDED began to help companies in the immediate aftermath of the storm remain solvent instead of concentrating on bringing in new businesses, which would be highly unlikely to move into a hurricane-devastated area.

Poster Child

Unwittingly — and no doubt unwillingly — LDED has become a poster child illustrating the need for business continuity planning. “It is essential to have a plan in place beforehand,” says Brian Turley, president of Strohl Systems, a provider of business continuing planning and software services.

Sometimes, though, a situation develops that is beyond the worse case scenario ever imagined. Then, companies and organizations must be prepared to think creatively — and, most importantly, quickly.

Preparing a Plan

Unfortunately, it appears as though many companies have not even embraced the first, fundamental step: putting a plan in place.

“Every year, there are horrible disasters that affect hundreds of businesses, and yet awareness for the need for preparation is only slowly increasing,” Reinhard Koch, senior Business Continuity Consultant with Avaya, tells the E-Commerce Times. In fact, he says, the primary impetus for the planning that does take place is largely government regulations — not internal motivation.

Turley is only slightly less pessimistic about preparation planning. “I don’t think enough companies are making detailed preparation plans — and those that are, are behind in their testing efforts — but I do think more have done so after Katrina.”

Risk mitigation in general has moved higher up the hierarchy of corporate needs, he says. “A few years ago, when I would be called in to consult, I would speak with mid-level managers. Now, though, I speak with CIOs and chief risk officers.”

Steps to Take

Developing a business continuity plan can be a complex endeavor, as a proper one should touch upon every aspect of a business — from supply chain operations, to employee assistance, to data protection and recovery, to alternative communications strategies with customers, employees, partners and vendors.

Following are some tips for getting an in-depth plan underway:

Promote From the Top. The commitment for developing a business continuity plan has to come from the top of the organization, Koch says. “A telecom manager might well know there has to be an alternative communications strategy in place, but if an executive over him cuts that plan out of the budget, it does little good. This is not something you can push up a corporate hierarchy. Commitment from the top is essential.”

Know What You Stand to Lose. With senior management on board, it becomes easier to allocate resources to support the planning process.

“You have to understand what your company’s individual needs are,” Koch says. “You can’t just put a general purpose disaster planyou bought from somebody off the shelf in place. You have to do a Business Impact Analysis that measures, for example, hourly cost per downtime — how much revenue would be lost if a contact center were to stop operating, for instance; measures what would be the loss in customer confidence if you were to stopoperating; measures the loss in market share and so on. The BIA tells you what you stand to lose if a disaster strikes and you are not operating the nextday or next week.”

Take Care of the Basics First. “I think the No. 1 lesson people learned was to focus on the human aspects of recovery,” Turley says. “So many companies spent time developing plans for data backup, recovery locations and related procedures, but few focused on the HR aspects of recovery. During Katrina, we saw that if employees are worried about their families and homes, they won’t focus on getting a business back on track. Companies that set up shelters and offered tangible assistance to take care of their employees were in far better shape to then take care of business.”

Devise Alternative Communication Strategies. Hours after Katrina landed, it became clear to residents and companies that communications in the state were, well, completely down. It would take several weeks for landline communications to be up and running. Even cellular phones — the default communication strategy in most emergency situations — would be out for a significant period of time. Text-messaging became the dominant mode of communications for residents and businesses alike. Indeed, some commercial providers have begun offering text-messaging services packaged as an emergency communications backup, citing this very purpose.

In other cases, companies were forced to resort to lower-tech communications methods. Banks and insurance companies, for example, were literallyposting signs on or near destroyed branches directing customers to the closest functioning unit.

Few disasters deliver such an extensive blow to infrastructure in an area, Turley observed. In many cases, standard alternative communication strategieswill be able to work. “If there is a large group of customers that have to be notified or assisted, a typical recovery plan will include an 800-number tocall. It might offer automated notification by phone or e-mail or devote a special portion to a Web site to deal with the problem.”

That is how British Airways handled a sudden, and quite unexpected, influx of calls this summer. Like the rest of the world, the company was taken unaware by the news that British intelligence had uncovered a terrorist plot to bring down numerous planes over the Atlantic using liquid bomb technology.

New carry-on regulations were imposed immediately. Many flights during the first day and week after the news broke were delayed by hours. “When a situation like this occurs, it is not uncommon for an organization to get a huge spike of inquiries,” says Greg Gianforte, CEO ofRightNow Technologies, which helped BA put together content on its Web site to help deal with theincrease. “Self-service technology is a good way to keep customers informed.”

Communications is a key area that requires a risk assessment strategy before a disaster strikes, Avaya’s Koch says. “Even simple planning can avert a significant loss. During Hurricane Allison a few years ago, customers in Texas lost communications because they had placed their telecom switches in the basement, which were then destroyed during the flooding.” He says there are literally hundreds of potential vulnerabilities in any building that could affect communications — ranging from the building itself to narrower issues such as whether the vectors and routers are properly configured for rerouting calls on the fly.

Once alternative strategies have been developed, Turley says, it is essential to test them. “That is the step that everyone seems to skip.”

Be Prepared to Ditch the Plan. As Katrina so painfully showed, sometimes the worst-case scenario does unfold. In those times, a business continuity plan may be inadequate for the situation. Granted that it is impossible to plan for every horrible scenario, Koch encourages companies to at least brainstorm how they would react.

“Imagine that you are arriving at work at 9 a.m., smoke is pouring out of the building, the fire department is hosing down the property, and a TV newsanchor is approaching you with the cameras on for a statement. What are you going to say? More important, what you are going to do?”