Making Do In Chaos | The Importance of A good Disaster Recovery Plan
By: Ryan Hoult
In late June, Calgary suffered a significant flood with the entire downtown and many surrounding communities under a mandatory evacuation order. We were quite lucky at Exempt Experts to not have any physical damage from the flooding; but as we returned to our office, twelve days later, it was obvious that we were still impacted. While we had managed to keep many things going, others had completely gone by the wayside.
So, like a team after an iffy game, we decided to debrief our performance. We looked at our disaster recovery plan or DRP, (also known as a business continuity plan or BCP) and how well we implemented it. Here is what came out of it.
So you have a plan…
Great! Where is it? A plan only helps if you have access to it. We decided to close in advance of the worst flooding, but this decision was difficult to implement as all of the staff’s emergency contact information was at the office. Sure, we could send a mass email, but what about those employees that do not have email access at home? For instance, our receptionist does not normally have much need to work remotely. Given our small size, 10 employees, we were able to get around this issue by asking everyone who received the email to call anyone that they had the number for. It did not take very long for word to get around to everyone, but if we were a bigger company it could have been a serious issue.
Key take away: Ensure anyone with a role in the DRP has a copy of the plan with them at home.
Who does what, and when?
A contact of ours that runs a larger company in Calgary, and their Human Resources department and Executives all had copies of their plan at home, and immediately went to work implementing it. However, a problem was quickly encountered as unknown to other executives, the communication of the only person authorized to shutdown the company had been impacted by the flood. After a night of waiting, another Executive eventually made the call to close the company the next morning, but most of the staff was already on their way to the office. While the news did finally circulate to everyone, it was far from an ideal situation and had employees out needlessly during the state of emergency.
In our case, either the President or I could make the call to shut down the office. After weighing the information from city hall about likely evacuation orders, we made the call at 6 pm Thursday that our office would be shut down for Friday. We were closed for the entire next week as well.
Key take away: Set a deadline to make the shutdown call (between 6 and 9 pm is a good option), and have multiple levels of responsibility. Our example company’s policy now states that any 2 executives can agree to close the office.
Work through the pain.
Assuming the shutdown is not just a one-day affair, the next step of a plan is to restart operations at another site. What you need to implement this can vary greatly based on the type of work you do. As a service company, our operations are nearly completely computer driven so we have invested in robust cloud-based systems for all aspects of our operations; as a result, we can operate remotely. However, even service companies can have important documents. In our case, that was cheques; we had a couple critical payments to make during the flood and we were lucky our bank was able to perform some miracles for us. We have now stored some cheques securely offsite for use in a future shutdown.
Companies that work with physical goods can have a much more difficult time establishing remote operations and for some it may be impossible. Additionally, if there is damage to your premises, physical goods may be completely lost. While most of our industry is computer based, there are still many firms operating with paper client files that are susceptible to loss.
Key take away: Assess if continuing business is possible and what you will need to do so. Identify key business processes that must continue (for example, payroll) and design a plan to ensure they do. If your current arrangements are not appropriate, consider online options, there are fair priced offerings available for companies of all sizes.
Help is only a call away.
While we have discussed a few points to consider in a disaster plan, the needs of every company are different and there can be countless issues to address. Certified Information Systems Auditors (CISA) and Certified Internal Auditors (CIA) can be great resources if you would like a professional review of your plan or need help in crafting a new one. Your local Chamber of Commerce is also a great resource if you are in need of help.
While the preparation of disaster recovery plans can be tedious and potentially expensive, they are invaluable when you need them. By having a plan, and implementing it, our employees at Exempt Experts were able to work throughout the shutdown, limiting the financial impact and ensuring our clients were still well served.