Disaster can strike any time, and prudent planning is critical to organizational survival.
Phillip M. Perry, Legal Management
May/June, 2008 – When a tornado hit downtown Atlanta, Georgia, in March, law firms were not spared the widespread damage. “The area looked like a war zone,” said Simon H. Bloom, a partner at Bloom Law Firm, whose offices suffered some damage from the winds. “The streets were littered with glass, scrap metal, computer monitors, and detritus.” For this law firm and the many others affected by the winds the lesson was clear: Disaster can strike any time, and prudent planning is critical to organizational survival.
PLAN FOR CONTINUITY
Not too long ago disaster recovery planning was confined to the maintenance of data system backups at remote locations. But attitudes changed dramatically after multiple hurricanes hit Florida in the summer of 2004 and Hurricane Katrina devastated New Orleans, Louisiana, the following year. “Law firms started thinking they really had to do something,” said Pamela Hill, Solution Group Leader for the business continuity practice at Chicago-based Project Leadership Associates, a legal-focused consulting firm. “The focus shifted from technology-centered disaster planning to full business continuity planning, covering the people and technical aspects to enable attorneys or staff to work from any location following a disaster.”
A 20-year veteran of disaster planning who has worked on some 85 law firm continuity plans, Hill emphasized that the majority of bottomline- busting disasters are lower key than the headline-grabbing hurricane, tornado, flood, or terrorist attack.
“The most common kinds of disasters are smaller in scale, such as a backhoe taking out your power and communications lines while working on construction next door, or rolling brownouts such as what we see in California in the summers.”
Consider the experience of one Midwestern law firm which lost access to its offices recently when a water main broke. The firm lost electrical power for half a day; unfortunately the story didn’t end there.
“The city fire Marshall determined that the water flow had damaged our public address system, and therefore our ability to evacuate our people in the event of emergency,” said a spokesperson who requested the firm remain unnamed. “We could not go back to our offices until that problem was fixed, a process that took two weeks.”
In this case the long term damage to the firm’s operations emanated less from the immediate flooding than from a city ordinance. “We could not have envisioned that at the time,” said the spokesperson. “You usually anticipate fire and water damage but you don’t think about the other ‘gotchas.’”
The experience taught the law firm that it must plan for unexpected interruptions. As a result, it reworked its disaster response plan to include an extra layer of security in the form of a daily backup to a removable hard disk (with encrypted data to obviate security breaches if the disk is lost), which a partner takes home after work hours.
“The lawyer with the backup could conceivably run the law firm from his house, with the exception of the database requisite to billing activities. Such responses are not uncommon,” said Hill. “These every day disasters may be low profile to the public in general but they are high profile to your clients who expect you to be able to service them immediately – regardless of the circumstances.”
Indeed, added Hill, the growing law firm interest in continuity planning is partly driven by client pressure, with clients are now asking, “What is your business continuity plan?”
LEGAL ADMINISTRATORS TAKE LEAD
So who’s going to put together these business continuity plans? Often legal administrators are called upon to do the job. That’s the case at O’Melveny & Myers, where Gail B. Ballinger, Administrator for the firm’s Newport Beach, California office, had the challenge of creating a program that could be utilized by the entire firm.
Like many others in her position, Ballinger came to this task with no background in disaster recovery, and as a result, she was forced to start from scratch. She took a series of nine courses from the Disaster Recovery Institute International (www.drii.org). Her firm also uses the consulting services of Project Leadership Associates.
That Ballinger turned to outside resources illustrates the good news in this area: There is a lot of material available in the form of courses, books, magazines, and associations. (For a rundown of some of the most useful material see the LearnMore box.) Over the past year, Ballinger has made progress in bringing this program to fruition.
“We created a framework for the Newport Beach office, which we provided to our offices in Century City, Silicon Valley, and San Francisco as a starting point for their local efforts,” said Ballinger. “We will also use it in our New York, Washington D.C., Los Angeles, and international offices.”
The business continuity plan is intended to ease the ability of the firm to get back up to speed quickly by mapping out the steps that need to be taken following a disaster. Ballinger continued, “We tried to create procedures that answer the question: ‘How will we work if the physical office or systems are unavailable?’ With that in mind, we tried to categorize all the firm-wide operations, processes, and applications by identifying across-office similarities versus those that are regionally driven.” One example of a universal process is in the area of technology: The framework details what supporting computer applications need to be up and running before the time keeping system can function correctly again. An example of a regionally specific operation would be the identification of alternative worksites where staff members could go in the event their regular offices were not accessible.
“In each region we will identify three or four alternative locations,” said Ballinger. Creating a framework saves time because the firm does not have to re-write routines that are not regionally specific. “This minimized the amount of work we need to do for each office and ensures continuity across offices where it counts,” she said.
EMPLOYEE COMMUNICATIONS
When disaster strikes your employees will be scattered to the winds. How will you determine if they are okay? And how will you know who can make it into a temporary office to keep things going? “The single most important thing you can do in building a recovery capability is to have an emergency notification system,” said consultant Hill. Creating an efficient one, though, can be easier said than done. The larger the law firm the more unwieldy the traditional phone tree, that labor intensive system where each individual is assigned a list of fellow employees to call. The new wrinkle in this area is “mass notification software” which automates employee communications through multiple channels.
“It allows you to contact your personnel instantaneously in any number of different ways by automating your calling trees,” said Hill.
For example, the software may be programmed to send each employee a text message, an e-mail, and then a follow-up message via cell phone, and finally a fourth message by home phone. When the employee responds to one of the messages the later ones are canceled. That this is all done by a remote system without human intervention is a huge efficiency breakthrough.
O’Melveny & Myers has selected one such system called AlertFind. Ballinger noted that there is yet another benefit to such software: It tracks employee responses. Individuals can respond to e-mails or phone calls and reflect their status, location, and their availability. Then you can track all of the responses in real time by looking at the vendor firm’s electronic dashboard.
“The software might record that Gail and her family are fine and she can come to work,” said Ballinger. “And it might note that 75 people have responded that they are okay, three need assistance, and 25 are able to come to the office for emergency work.” These systems are Active Server Pages (ASPs) which manage communications from a remote and unrelated system so that communications remain functional if a law firm’s offices are damaged. “Emergency notification systems have received a lot of attention since 2005 when Hurricane Katrina showed that crises can decimate a law firm’s internal communications,” said Paul D’Arcy, VP of Marketing at MessageOne. “Because in many cases it was impossible to communicate with employees affected by that storm, interest in these systems has grown. Law firms learned they could not rely on local communication infrastructure, internal systems, or manual call trees to reach employees. During a crisis, you must be able to account for and communicate with your biggest asset: your employees. Communicating with employees and making sure they are safe may be the most important aspect of disaster continuity planning. As a bonus, such systems are also useful outside of the disaster planning area. If a client calls in with an urgent matter, for example, the system can be set up to find all of the people who serve that client to coordinate a response.”
START SMALL AND BUILD
When designing a continuity plan it is wise to start small. “Don’t try to create a huge plan in response to a 9/11 type scenario or you will never get the job done,” said Ballinger. “It’s better to start with a smaller plan and over the course of time continually improve and expand its capabilities. For example, maybe you start with a plan for what your staff will do if you cannot get into the office for three to 30 days.” The worst approach is to bury your head in the sand and hope disaster never strikes.
“The real risk of doing nothing is ultimately a lack of client confidence in your law firm,” said Hill. “There is also a very real risk of malpractice lawsuits because lawyers are required to be able to perform the practice of law on client’s behalf. In that sense, business continuity planning is really an insurance policy for a law firm.”
