If your law firm has offices located anywhere in the Gulf Coast area, you had ample opportunity this summer to test your business continuity plan.  If you didn't have a plan, living through Hurricanes Fay, Gustav and Ike likely provided a fast, albeit difficult, way to "help" your firm's management team decide there was no time like the present to start planning. 

No matter where you live, it was hard not to notice the disaster news stories.  Who saw the pictures of the wind damage to the JP Morgan Chase building in Houston and did not think about the arduous task of the resident law firms to deal with the equipment, records and facilities destruction?  The lessons learned by a large number of law firms impacted by this active hurricane season can provide invaluable lessons in developing a realistic plan for your firm.
 
One firm in particular learned a number of lessons during the hurricane season.  McGlinchey Stafford PLLC is a 190-lawyer firm, headquartered in New Orleans with nine domestic offices throughout the United States.  Five of those offices are located in the Gulf Coast area, from Mississippi to Houston.  McGlinchey's New Orleans office was seriously affected during Hurricane Katrina in 2005, and then again this year by Hurricanes Gustav and Ike.  In total, five of their offices where impacted by the two hurricanes over a period of 30 days.  McGlinchey has a comprehensive business continuity plan, as well as a technical recovery solution for their critical systems housed at a collocation facility in Dallas.  Because of its unique perspective, there are important lessons to be learned from McGlinchey.

Communications
Everyone who has lived through a major disaster within the last 15 years will tell you that communication is the key to an effective recovery.  During Hurricane Katrina, the team at McGlinchey learned that the timeliness of status updates helped lessen anxiety for every aspect of the recovery.  "For this year's storms, McGlinchey knew what we were going to say and when we were going to say it, and we had a tool that allowed us to reach the largest possible audience with the minimal amount of effort," says Peg Nelson, director of administration and the firm's crisis manager.  "People knew exactly when we would give them an update each day.  Just having a process everyone understood, greatly reduced the amount of time and effort the firm's administrative management spent answering phone calls and questions, allowing us instead to focus on the recovery."
 
During Hurricane Katrina in 2005, the Southern California wildfires in 2007 or even in the moderate California earthquake earlier this year, standard protocols for contacting people did not consistently work.  Firms often have unrealistic assumptions about how communication devices will work.  In the situations above, cell phones stopped working due to traffic and cell tower interruptions, home phones were not an effective solution as people were evacuated to alternative locations and work e-mail accounts were not reliable as not everyone had access to PDAs.  Users also found that text messaging was self-limiting in the amount of information that could be sent in one message.  Even BlackBerry PIN-to-PIN messages only worked where people had off-site access to the PINs, and emergency websites only worked where people remembered how to access them.
 
The logistics of managing a disaster where staff are geographically scattered is the biggest challenge you will face as part of your business continuity planning efforts.  In order to be effective, I have found that you need to consider the "spray and pray" approach to communications - spray communications in every direction and pray at least one aspect of it will work for everyone at some point during the recovery.  The good news is that reasonably priced tools do exist to help you in these efforts. 
 
The single most important thing a firm can do to help manage through a crisis is to proactively select and implement an emergency notification tool, such as MessageOne's AlertFind or Dialogic's Communicator.  You don't have to spend a fortune on these tools to get the return.  According to Thad Hymel, director of IT services.  McGlinchey had a phone-based emergency notification tool, VoiceShot, which greatly enabled communications across the firm during Hurricanes Gustav and Ike.  Hymel reported that the tool makes it easy to move data from the contact information stored in existing databases, and it eliminates the need to implement time-consuming calling tree protocols, which he said are only somewhat effective at best.
 
Other essential communications tools include an emergency website (hosted externally or within your disaster recovery systems) and an 800 emergency phone and voicemail line (hosted externally or with immediate failover capabilities) as a mechanism to post ongoing status updates. 
 
Remember, nothing is perfect.  Even the best-made plans will not cover every potential circumstance or communications failure.  The best practice is to actively communicate with employees and partners through emergency notification tools, and then passively communicate with them by asking them to regularly check status updates on an emergency website or 800 emergency lines. 
 
When considering your communications strategies, don't forget the power of familiarity during a crisis.  Though McGlinchey's plan was to use an external helpdesk to capture and forward requests from lawyers and employees who were displaced due to Gustav, according to Al Thomas, executive director, "In reality, people called the number they were most familiar with - the main number in the New Orleans office (which had been redirected to another McGlinchey office) - in order to talk with people they knew."  McGlinchey trained staff on the process and then sent out numerous e-mail messages every day before and after the evacuation, informing people of where to call, "And yet they still called the number they were most familiar with," says Thomas.

Managing Through a Crisis
Anyone having experienced a crisis knows that the situations evolve over time as available resources, information or access to technology changes.  As such, your plan must be flexible in applying recovery tactics to a variety of situations.  This is the main reason why creating a scenario-based plan does not work in many situations.  "We learned this lesson during Hurricane Katrina" says Hymel.  "For 32 straight days, the crisis evolved across offices and with varying levels of impact, from telecommunications outages to office closures to differing remote access requirements.  Every day it was a new crisis that required a different recovery approach.  This year we knew we had a good plan, but we were still prepared to improvise." 
 
Indeed, a key element of true crisis management is the ability to get creative when determining the next steps.  The overall plan should include daily meetings to discuss what is or is not working in your recovery based upon changing assumptions about access to resources (information, people, technology and space to work).  "We had a business continuity plan to address an evacuation out of New Orleans.  In reality, our New Orleans office evacuated to Baton Rouge for Gustav and within a few days after the storm had passed, we experienced a 'reverse evacuation,' when many of our Baton Rouge staff ended up heading to New Orleans due to extensive power outages in the Baton Rouge area," says Thomas.  "That required an adjustment to the plan in order to accommodate impacted lawyers/staff and their families in the New Orleans office and the surrounding area."
 
From a technology perspective, adaptability and nimble thinking are standard operating procedure. The "work from wherever you are" approach to recovery planning is solid, but the assumption that people would work from home proved invalid in this emergency due to power outages.  So the McGlinchey team adjusted by setting up users in New Orleans as well as accommodating those lawyers who were lucky enough to have power at home or who were still evacuated outside of Louisiana.  The most important thing, according to Hymel, is to have a solid technical recovery solution in place so you can point users to the document recovery systems from wherever they are located with minimal service disruption to the displaced users and, just as importantly, so you can maintain the standard level of service to other offices outside of the disaster area. 
 
One important lesson learned in hurricane planning (where you have some warning) is to stage your crisis managers outside of the potential disaster zone.  Peg Nelson, McGlinchey's crisis manager, lives and works in Houston.  When Hurricane Ike was barreling down on Houston, Nelson and the management team made the decision to stage her out of town.  "As the firm's crisis manager, it's stressful to be responsible for the firm's disaster response, as well as for my own home and family," says Nelson.  "You have to think ahead to make sure things at home are taken care of well in advance.  If you are on a crisis management team, personal preparedness is just as important as the firm's preparedness." 
 
For IT folks, this approach is just as critical.  "We direct our IT staff to return home well in advance of an impending hurricane to prepare their homes and help their families get ready for an evacuation.  Once they feel comfortable that their homes and families are taken care of, they are more willing and able to help the firm during the crisis," says Hymel. 

Building the Business Continuity Plan
A comprehensive business continuity plan has several equally important parts to consider.

• Crisis management - Start your plan by first addressing crisis management and communications.  Answer the strategic questions:  What defines a disaster for us?  When/how do we know if we have met the criteria?  When do we activate the plan?  Who needs to be involved in the recovery and/or the planning efforts?  What do we focus on first during a crisis?  These are the hard questions to ask when preparing a plan, and the most likely tripping points when trying to affect a recovery without a plan.  Having a clearly defined chain of command, solid decision-making practices and a good understanding of how the firm operates will get you farther than a big, red binder containing a 500-page business continuity plan that no one understands.  To be clear, you still need the 500-page plan, but in reality, the most effective recoveries are done by good decision making, effective exercise of common sense and lots of brain power - with the big, red binder as back up. 
  
• Technology - No matter how great your business plan is, it is always based on a set of working assumptions relating to technology and data.  Don't write a plan that is based upon erroneous assumptions.  Business users and IT must work together to build a plan based upon realistic recovery time objectives.  If you build your plan based upon overstated recovery times, the plan will not be taken seriously the next time you need to use it.  A plan that no one believes in is no beter than no plan at all.  Tell people the truth, and they will find a way to work with what they have. 
  
• People - Build a plan for an alternate workspace to deal with where lawyers and staff will recover, and address how people can manage through the crisis on a personal level.  "No matter what the disaster situation is, our plan is based on the assumption that if you take care of people and their families, they will help you recover the business," says Thomas.  "They get peace of mind knowing someone is looking out for them, and the business gets recovered.  Everyone benefits when the business stays strong, and that doesn't happen without your lawyers and staff being on board." 
  
• Process - First, focus your plans on the business functions that enable communications (human resources for internal communications and marketing for external communications).  Then, focus on those processes that mitigate risk (such as new business intake/conflicts, court filings, docket).  Next focus on processes to recover the operations of the firm (mail, administrative support). 

Every business continuity planning process should start with the premise that the office is unavailable and that the key supporting systems are also unavailable.  This assumption will ensure the plan is reasonably comprehensive and inform your information technology department on the extent of the services they need to provide during a disaster.  As a part of your recovery procedure documentation, do not forget to document systems, supplies, forms, passwords, records, URLs, company identification numbers and anything else that may be required if the office is unavailable.  It is imperative that you provide access for all of this information off-site (whether it is stored off-site or simply recovered from another source).  Once your plan is done, make sure to build processes to keep the plan up-to-date.

Several times a year, McGlinchey examines its plan to determine what needs updating based upon technology, process or organizational changes.  The firm assigns a person to keep the plan up-to-date, and, any time any component of the plan is used or tested, it holds a debrief to establish what worked or didn't work, and the plan is updated immediately.  "The business continuity plan is a living, breathing document that requires constant care and feeding," says Nelson.  It's a lot of work, but we feel confident in the plan because of the amount of effort that goes in to keeping it relevant." 
 
From the technology side, Hymel reports,  "Our current level of preparedness was a long time coming, and it wasn't cheap to build.  As new systems and applications are established, we have the change management processes in place to ensure every critical system is covered in our document recovery solution design as well as in our technical recovery plan.  We also test our systems on a regular basis.  At the end of the day, the only peace you will ever have in disaster recovery is by testing the systems over and over until you are sure they will work as advertised."

Closing the Loop
One of the frequently forgotten aspects in recovery planning is in the management of an insurance claim following damage to facilities and equipment and/or a business interruption claim.  "The true cost of a disaster can take months to understand," notes Thomas.  "A disaster (and the recovery) doesn't turn on and off like a light switch - it evolves."  People come back to work, and then need time off to deal with their personal situations; an office may be open for business, but people simply can't get to it due to fallen trees.  This year, McGlinchey had multiple offices impacted over a period of time; for them, the hard costs are more evident and easier to measure, but for every step the firm took during the recovery, it had a clear understanding of what its insurance provider would cover. 
 
To understand the true costs of a disaster, be comprehensive in how you evaluate them and be prepared to provide a lot of documentation to support your claims.  Consider costs such as expenses to stage critical personnel out of the disaster area, overtime or temporary help, replacement equipment, furniture or supplies, downtime due to an evacuation (and subsequent return), recovery or time spent handling personal issues.
 
Business continuity plans need to be thought out proactively and documented, and they should be flexible.  Crises are fluid, and your plans need to be adjusted on the fly.  You can learn much from law firms that have been through disasters - about what works and what does not.  The key is to develop your plan based on realistic assumptions, know that they'll change and be prepared to make course corrections mid-stream.  Make sure to get your business continuity plans in place now, as you will need the plan as your guide in the event of a disaster or crisis.  Don't be caught without one. 

SIDEBAR
Lessons Learned at Every Stage

Communications
Distribute your communications methodology by utilizing an emergency notification tool, emergency website and 800 emergency phone and voicemail line.  You need all three to ensure reaching the maximum audience. 

Normalize your recovery strategies; keep them as close to standard operating procedures as possible because, in reality, even during a disaster, people are most likely to repeat behaviors familiar to them during normal working situations. 

Crisis Management
Have a plan, but be accommodating and flexible in applying recovery strategies to new situations, as the situation will evolve and change.

Have a daily post-disaster process to evaluate your recovery efforts and determine what needs to change to keep up with the situation.

If you are lucky enough to have pre-warning of an impending situation, stage critical staff and crisis managers out of harm's way, so they can participate in the recovery.

Building the Plan
Build the plan based upon solid assumptions regarding access to people and technology.

Keep the plan up-to-date by implementing change management protocols, and test the plan regularly.

Closing the Loop
Talk with your insurance provider about disaster-related property and business interruption coverage before a disaster.

Document all decisions, tasks and recovery steps taken following a disaster because insurance companies will want to see it as back up for a claim.

About our author :: :: ::

Pamela Hill is the solution group leader for the business continuity planning practice at Project Leadership Associates in Chicago.  She has more than 20 years of experience in business continuity planning and has focused exclusively on law firm planning for the last 12 years.  She can be reached at phill@projectleadership.net.