Can You Afford NOT to have Disaster Recovery/Business Continuity Plan?

In the wake of Hurricane Ike, 97% of all Houston homes and businesses were without power. That is effectively 7.8 million people. It is estimated that most businesses were without power for an average of 10 days. Can your business afford to be down for 10 days? Is ten days long enough for your customers to find another source for goods and services? Is your business so mission critical to others that even one day is unacceptable? For most businesses, unless you are an ambulance service or home medical care provider, this is not the case. However, criticality is not the only reason for many companies to recover as quickly as possible. Other factors such as goodwill, community service, customer loyalty, value, spoilage, and expenses can determine an organization’s desired recovery time.

In my business, I deal mostly with information technology so data security and recovery are my top concerns. But disaster recovery is more than how fast can you recover data from an offsite storage site or how quickly your cash registers can restart. It is about business continuity. It’s about how quickly you can get back to business as usual, or close to it.

Most executives cite security and recovery as one of their top three priorities. In my experience about 80% of companies either don’t have a disaster recovery (DR) plan, have an outdated one, or have never tested their DR plan. This isn’t as illogical as it sounds. Many organizations create a DR plan as a direct result of having gone through a disaster. Some companies never experience a disaster. Some experience a threat of disaster once every 5-10 years. A few actually experience a disaster and chalk it up to luck (or lack thereof) or nature. A disaster doesn’t have to be a category 4 hurricane. It could be a fire (Brenan’s as a recent example), a power outage, or lots of rain.

The largest worldwide Disaster Recovery planning event was centered around the anticipated problems caused by changing the two numbers of the year (from 99 to 00) when we moved into the year 2000 from 1999.  Many systems were upgraded and replaced as a result of effective DR planning and most of the problems were averted.  Without the worldwide effort associated with those plans and their implementation a worldwide infrastructure crises would have occurred and most of the worlds’ systems would have been inoperable.

When planning for disaster recovery, we consider the following key points. First is safety, the safety of your employees, your customers, your contractors, and your suppliers. An easy thing to accomplish is drawing up a phone tree and sharing it with your employees.
<p>Next have a plan for people that are already at work and those who are due to report to work. Do you tell people not to show up? Or can they do their work from home? Can you setup an offsite location away from harm’s way?

Third, protect your assets. This could be inventory, data, or intellectual property. If you have refrigerated products, what’s the best way to prevent spoilage? Do I need a generator? If you have time, where can you move your inventory to? Can your supplier hold your inventory? Is your data backed up and stored offsite? How quickly can that be recovered? Do you have a mirrored environment at another location? Are ideas and research protected?

Get a reality check. You can’t plan for everything…The key is to be better prepared than your customers.

And then there is loss of revenue to consider. What can I do to continue sales and services? How do I serve my customers without power, phone, transportation, etc…? What are my basic needs? One of our clients had forms for taking orders by hand in case their computers were down. Sounds simple but it worked
Can I relocate my operations temporarily? Another client was a mortgage company in South Florida with customers nationwide. There was a hurricane in Miami but the homeowner in Phoenix still wanted to close on their home. Some of the paperwork was shifted to the Tempe office.

This all sounds good but planning for an off chance that a disaster might debilitate your business could be costly. Consider the cost versus benefits. If it costs you $100,000 to have backup power that would keep your coolers cold and cash registers open until power is back up and you would only lose $10,000 in beer and hot dogs sales for the shutdown period.  If you had to shut down for only a day, you might not want to go with that plan. However, if that $10,000 in actual revenue loss could mean the loss of 100 customers to the convenience store across the street, resulting in $300,000 annual loss, you might want to reconsider.

Lastly, get a reality check. You can’t plan for everything. Even if you could, let’s say your store is hurricane proof, flood proof, fire proof, powered 24/7 no matter what and you’re not a data center, what are the chances that your customers are in the same boat and wouldn’t be able to visit the store anyway? The key is to be better prepared than your customers. Galveston is a prime example. Everyone had to evacuate. Restaurants, gas stations, department stores. Even emergency crews had to hunker down for 10 hours as the storm waged around them. The trick is that after it’s all over, be ready when your customers are ready. Home Depot opened for business with plenty of flash lights, cleaning supplies, and bug spray the day after everyone was allowed back on the island. How did they do that? An excellent DR plan, great distribution system, management with foresight, and employees willing to work hard.

I tell my clients, large or small, that all businesses should have a disaster recovery plan. I use the analogy of a family safety plan. In case of fire, where are the escape routes in your home? What should you grab if you have 30 seconds to leave your home? If you have a two story home and the downstairs is on fire, how do you get out of the house? (If you don’t have a family safety plan, please, please start one now.) And like family safety plans, you have to communicate that plan. Share your DR plan with your people, your organization.

The difference between having a Disaster Recovery plan and not having one could mean be the difference between being in business or in the unemployment line.