Preparation for Disaster Response and Recovery
Message from Aon Direct Insurance Administrators
Reprinted here is an article by Thomas P. Sukowicz that originally ran in the December 2001 The Quarter Hour. Although no one can ever be fully prepared when disaster strikes, this article provides some guidelines to help you ready your firm in the event of a disaster.
Preparation for Disaster Response and Recovery
By Thomas P. Sukowicz, director of Lawyers’ Risk Management Services at Hinshaw & Culbertson. He works out of the firm’s Ft. Lauderdale, Florida and Chicago, Illinois offices. The firm’s risk management Web site is located at www.lawyeringlaw.com.
Disaster can strike a law firm at any time and in totally unexpected ways. It can strike in many forms, such as fire, hurricane, tornado, flood, explosion, mudslide, armed intruder, or terrorist attack. One thing is certain — Once it strikes, it’s too late to start planning how to deal with it. Every firm should have a plan in place to protect personnel, records, and other property.
The safety of your staff, clients, and visitors to your office always comes first. The need for a plan providing safety of office staff was illustrated by the attack on the World Trade Center. The law firm of Ohrenstein & Brown was located on the 85th floor of Tower One. The National Law Journal reported that, when Flight 11 crashed into the tower, the firm’s managing partner was faced with leading the lawyers and support staff to safety.
Learning that the main entrance to the office was filled with smoke, he led them through a filing room to a stairwell. They descended seven flights of stairs, only to find that the stairwell door on that floor was locked.
They went through the sky lobby and, after a frantic search, found a second stairwell on the other side of the building. Descending further, they were again confronted with a locked door. This time, someone had a key, and they eventually made it to the ground floor and safety.
In most situations, having a plan that includes knowing all stairwell locations can save precious time so that, for example, evacuation can occur before the building collapses.
Another issue faced by the managing partner of Ohrenstein & Brown was accounting for all personnel after the building was destroyed. Fortunately, that firm’s missing employees were located.
A disaster recovery plan should include a communications system to contact staff to confirm that they are safe or, if disaster strikes after normal office hours, to inform them of the occurrence and to provide instructions.
One way to maintain contact is to establish a “telephone tree,” assigning persons to contact in an emergency and designating certain individuals with cellular phones as persons to call in case there is no telephone service.
After addressing the safety and well-being of personnel, the next issues for consideration include space and facilities plus access to and preservation of files, records, systems, and equipment. The Ohrenstein & Brown firm had another office in Garden City, New York. From that office the managing partner tracked down missing firm members, spoke to computer consultants about getting new equipment, and began the process of finding temporary space for his 90 displaced employees. Fortunately, the firm had backed up most of its files and was able to access them. It also kept a document log so it could ascertain which documents were missing.
In situations like the aftermath of the World Trade Center attack, it becomes necessary to find temporary or permanent office space. Sometimes the office hasn’t been destroyed but may have been severely damaged. In that case, safety issues must be addressed before the office can be reoccupied. If documents and files have been exposed to fire or water, it’s important to try salvaging what you can before they become damaged beyond repair.
Whether the disaster strikes with some warning, such as a hurricane, or without warning, such as the terrorist attacks on September 11, 2002, a disaster response and recovery plan will help limit many of the resulting losses.
Necessary components of a disaster response and recovery plan include the following steps:
1. Identify the Potential Causes of a Disaster, Both Natural and Human
The first step in developing a plan is identifying the kinds of disaster that could possibly occur. Your geographic location may determine some of the risks involved, such as susceptibility to floods, hurricanes, tornadoes, or blizzards. The kind of building your office occupies also will determine the details of your plan. These days, because of the threat of a terrorist strike, you might include the bombing of your office building and anthrax exposure on your list of potential disasters.
The key is anticipating what might happen and establishing a procedure to follow when something does occur. For each type of emergency, your plan should describe action steps to minimize adverse consequences and make the firm operational as soon as possible.
2. Review Insurance Coverage
Adequate insurance coverage plays an important part in a disaster recovery plan. Consult with insurance professionals to ensure that critical coverage is in place, including coverage for business interruption, extra expense, valuable papers, and computer hardware and software.
3. Designate and Train an Emergency Response Person or Team
Any disaster preparation and recovery plan should include the designation of a specific person or team (depending on the size of your firm) who is responsible for maintaining and implementing a plan plus making decisions and providing leadership during an emergency. The persons responsible for various duties should be clearly designated with back-ups.
One or more persons should be responsible for regularly updating the plan to address potential emergencies that previously weren’t likely to occur but now could.
One or more persons should keep the written emergency plan offsite in case the office copy is destroyed or becomes inaccessible. Copies of other information stored offsite include employee addresses and telephone numbers; telephone numbers of building management and security, vendors, court personnel, and clients; insurance policies and information regarding coverage; the office lease; and any other important documents.
4. Establish a Communications System
The emergency response person or team should keep copies of all employee telephone numbers, including home and cell phone numbers and e-mail addresses. The street addresses also should be on the list in case there’s no way to communicate electronically. The plan should include a telephone tree designating persons to call assigned lists of employees. One or more persons with cell phones should be designated as persons to contact when regular phone service is unavailable.
One or more persons should be designated to contact key management and security personnel of the building to determine accessibility of the building and additional safety precautions that may have been implemented. Those persons can then disseminate the information to the office staff as needed.
Clients will naturally want information about the firm’s ability to function after a disaster. Your plan should include ways to communicate with clients, providing information and instilling confidence. A spokesperson should be designated to ensure conveying the same message to everyone at the same time.
5. Ensure the Personal Safety of Staff and Visitors to the Office
An emergency response plan should include procedures for evacuation. The entire staff should be informed of these procedures. Evacuation routes and other safety notices should be posted.
To anticipate possible fire, periodic fire drills should be held. The staff needs to know where fire alarms and fire extinguishers are located, how to use them, and when it’s appropriate to use them. Assign persons to help those that may need assistance. Use the education and inspection services of the local fire and police departments. Designate a meeting place outside the office in the event of an evacuation.
Security measures can help prevent emergencies. A staff member should always be present in the reception area. Areas not open to the public, usually any place other than the reception area, should be clearly marked or closed off. Visitors should be escorted in any non-public areas. All outside access windows and doors should be secure. All control and alarm systems should be maintained regularly.
Because terminated employees are a security risk, all identification and keys should be collected before the employee leaves for the last time.
Bomb threat guidelines, including the importance of not touching any suspicious packages, should be stressed to employees.
Employees should be instructed to stay away from letters and envelopes containing unidentified powder and to stay away from persons who have come in contact with such substances, even though the inclination will be to come to their aid.
6. Preserve Files and Records
A disaster response plan should designate a person or team to maintain an inventory of all important documents and records. These include the firm’s client list, master docket and central calendar, bank and financial institution account numbers, insurance policies and contacts, employee records, vendor lists, and copies of office contracts.
Computerized records should be backed up, including the data on each individual’s computer. Data should be stored offsite so records and documents can be restored. Some kind of redundant system should be in place that can take over when the primary system fails.
Physical files risk destruction when exposed to fire, smoke, or water. When paper documents become wet, they decay from mold or fungal growth. If documents become wet, freezing may save them until professionals begin the restoration process. Prevent damage by storing files and records in places that aren’t susceptible to flooding.
7. Arrange Relocation
When office space and facilities are damaged, destroyed, or unreachable, your emergency response plan should include possible arrangements to share space, occupy alternative sites, or work from home.
8. Provide for Post-Disaster Well-Being of Staff
A disaster recovery plan should address the material needs of employees to continue receiving wages or salaries plus information about available insurance benefits.
After a major catastrophe, employees may experience post-traumatic stress syndrome, becoming unable to function in the workplace. Your plan should include providing resources to assist in dealing with post-disaster emotional reaction. The plan also should include ways that the firm will continue to function when some of its employees cannot.
There are many resources available to assist in developing a disaster response and recovery plan for your firm. Whether you consult a professional or do it yourself, it’s important to formulate and implement a plan so that if disaster strikes, the resulting damage can be minimized and recovery can proceed as soon and as quickly as possible.
Eight Essential Elements of a Disaster Recovery Plan
1. Identify the potential causes of a disaster.
This article is intended to inform the reader of potential liability exposures for attorneys. This article reflects general principles only and does not render legal advice. Readers should consult legal, financial, insurance, and other advisors if they have specific concerns. Neither the Los Angeles County Bar Association, Aon and its affiliates, nor the author assumes any responsibility for how the information in this article is applied in practice or for the accuracy and completeness of the information.
Reproduction without written permission is prohibited. This article, which originally appeared in the Aon Attorneys’ Advantage Risk Management Newsletter, The Quarter Hour, is reprinted with the permission of Aon Attorneys’ Advantage and is made available to the County Bar Update by Aon Direct Insurance Administrators, administrators of the LACBA Sponsored Aon Insurance Solutions Program. www.aonsolutions.com
# # #