Does your company outsource the provisioning of services, such as Finance, Human Resources or Auditing? These could also be considered part of your supply chain. Some of the companies providing these services may be smaller and less resilient to a disruption to their business.

In order to manage the risks to your company from your supply chain, you need to understand your organization’s activities and processes.

• The critical functions and activities should be identified.
• The impact to the company that a loss of a supplier may have.
• The risks that could impact the supplier.

Once all of this information has been gathered, then you can start to mitigate the risks to your business that could occur due to a supply chain problem.

The loss of a supplier is a major risk today as more business functions are outsourced. It is necessary to validate the supplier’s recovery capability before committing all of your activities to any one supplier.

Every year the plan gets that Auditor’s tick mark and people point to the report and says that they are covered should a disaster occur. And every year the plan gets put back into the binder and put back on the shelf only to be dusted off next year.

So could you really recover using your plan documentation?

Do you know what is in your plan? Has your plan been updated with all of the technology and business changes that have occurred this year? Has it been tested?

An untested plan is not any better than not having a plan. If the plan has not been kept up-to-date then it is best left in the binder during a disaster because it will only hinder your recovery not help it take place.

Testing can be passive for business plans and crisis management plans and active for technology recovery plans. You need to implement a comprehensive testing program for all of your company’s recovery plans.

Before returning home, you better make sure that your plan has the necessary steps and processes required to make the transition back smooth.

A return to normalcy requires collaboration among many internal and external sources. Some of these are employees, suppliers, vendors, customers, insurance companies, insurance agents and brokers, government agencies and financial institutions.

Depending on the nature of the disaster, you may have to have the building structure checked to confirm that the building is habitable. This needs to be professionally done and is the first step before any other action is taken.

If the building is okay, you may be able to get some employees back in sooner than expected. If you can have people working in the building while repairs are made you need to ensure that they are safe.

Make sure that your employees know that they are not being asked to work in an unsafe environment. If something doesn’t appear correct, make sure that they know who to report it to and that they are expected to report unsafe areas or conditions.

After an event occurs, the most valuable asset that a business must use is time. If you cannot begin your recovery processes quickly enough, you may still fail at keeping the business operational. You need to have a method of assessing the impact of the event and making a decision quickly.

So what are some objectives of a good Business Continuity Program?

When developing your program you need to make sure that it can:

• Effectively reduce the disruption to the business and management of your business
• Address any failures in your supply chain
• Keep your customers and maintain good relations with them during the disaster
• Make sure that no negative publicity is put out about your company or if there is negative publicity, you can address it and counter it with more positive news releases
• Keep the company operational so the profits are not severely impacted
• Meet any regulator requirements if they exist
• Get the company back to full operation as quickly as possible

If your Business Continuity Program can accomplish these objectives as a start, plus get the technology back on-line, then you will have a very good chance of keeping your business operational during a disaster and also surviving the disaster.

You also don’t know where the fire was exactly in the building and what the effect will be on your servers and the work area.

A couple of weeks later, you are contacted by the management company for your building and told that you can have limited access to your area. You arrange to have your technical staff go to the site to see what the state of the equipment is.

They report back to you that water did get into 50% of the equipment and that everything will need to be cleaned. They estimate that 75% of the servers can be salvaged and 25% are scrap.

So now you need to:

• Identify the programs and data on the scrapped servers
• Arrange to have the servers cleaned
• Clean your server area, including the area under your raised tiles
• Buy new servers based on your inventory
• Stage the servers in your area
• Confirm that the wring and our LAN/WAN network connections are correct
• Load all of your software

You have started the recovery process, but you may run into many problems that you didn’t expect if you only clean your servers and then start to use them.

We have the typical natural disasters of floods, hurricanes, snowstorms, but most disasters that happen are of a more “mundane” type. Hardware and software failures are two potential types of events, but one of the most potentially damaging types of events that could put you out of business is a power failure.

All information technology systems run on electricity. Without the main supply, your systems have to shut down. You may have an uninterruptible power supply (UPS) but these will only allow you to shut down your systems in a controlled manner, they will not keep you operational. To truly remain operational after a power outage, you would need to install a backup generator.

In most areas, the power is usually very reliable. However, there is always the possibility of a major outage, especially if you are in a hurricane, winter storm area or sometimes, a high concentration urban area. Think of areas that have had rolling blackouts or brownouts.

Plan how you would at least shut down your servers properly in the event of a power outage.

Statistically this appears to be true. The numbers vary slightly from study to study but appear to be consistently grouped around the following numbers:

“The 2007 Best’s Underwriting Guide by A.M. Best found that only 6% of companies that suffer catastrophic data loss survive while 43% never reopen and 51% close within 2 years of the disaster. Best’s Underwriting Guide 2007 also found that 93% of the companies that did not have their data backed up in the event of a disaster went out of business.”

So as a medium sized business, you protect your data and you can survive a disaster.

Unfortunately, there are many disasters that can occur that require more than just a backup system.

You should consider what the effect of a major hardware failure would be on your operation. Most companies do not hold spare parts for their servers, especially disk drives, one of the most common component failures.

By the time you troubleshoot the system, determine the faulty drive, buy and have the drive shipped to your site, if a drive is still available for your technology, and have it installed, your customers may have moved to another supplier. This is a disaster to your business.

Next up, some other types of disasters that could affect your operations.

Because you have been so close to the business and because it has grown, you may not be actually seeing what is really there.

Do you know what the critical activities are that must be performed on a daily basis? What are the consequences if they are not finished on time? Who needs the information that is produced by these activities; both internal and external users? What penalties do you face if this information is not provided?

From a human resources perspective, who performs these activities and what happens when that person is away? Are there trained backup people? Are the manuals and documentation up-to-date and readily available?

Maybe you have activities that were started when the company was young and growing. Have you outgrown these activities but are still completing them because they are part of the business?

By implementing a Business Continuity Program and completing the Business Impact Analysis, you will gain a better understanding of what is really important to your business and what needs to be protected.

After the event, how quickly do you think that you could:

• Find, lease and build-out new facilities
• Determine all of your critical activities and the resources required by those activities
• Know what members of your staff are required immediately and those that can sit and wait
• Replace and recover all of your computer systems and data
• Get new stock or equipment
• Let your customers know your new location

It has been said that once every 5 years a company will experience a major event that has the potential to put them out of business.

If you do not have a plan, then the likelihood is that your company will not survive such an event.

Company management must understand that a Business Continuity Program is something that can save the business after a disaster.

While it is true that you may have some form of Business Interruption insurance, have you reviewed it to see that it covers the loss from the most typical type of disasters you would experience? Many premiums have climbed to the point where companies do not take the coverage.

Another point to consider is how long the coverage will last if you need it after an emergency or disaster event?

Most companies only take the coverage for 12 months. In reality this coverage should be taken out for at least a period of 3 years.

You must also remember that Business Interruption insurance will not cover losses related to:

• New products or services being abandoned
• Loss of new business opportunities in other markets
• Your loss of reputation
• The lost customers
• Your brand’s value not being worth what it was before the disaster.

Business Interruption insurance will provide some financial cushion, but on its own, it will not mean that your company would survive a disaster.