INDUSTRY

Disaster Recovery: Predicated on Fallacies

By NORM KOEHLER, CRP, CBCP

Years ago, I was often amazed at the number of businesses that had no viable recovery plan in place. These were not just your small to medium size organizations, but companies whose names you would recognize. More often than not, disaster recovery was absent, or passively dormant, within their business culture. Even more disturbing was to encounter those who believed that they had a recovery plan, when, as a matter of fact, they didn’t. In reality, what they had was a combination of two misconceptions that, when married together, had created a false sense of readiness:
1) A reliance on an emergency response plan that’s been labeled a disaster recovery plan, and/or
2) An expectation that outside assistance will address their recovery.
A decade later, very little has changed. Despite our efforts as recovery planners, attempts to carry and deliver the message have not kept up with change. Business priorities change, new companies are born, recovery staff leave (and are not replaced), companies expand to multiple locations, management changes and so does concern of a disaster changes, and so on, and so on. As we gained a little ground here, we lost it there. As such, those of us who travel to new client locations still find that recovery is too often premised on the two aforementioned fallacies. Also, if you’re new to recovery, or about to assume that role, you may find yourself in the same situation. Let’s review both misconceptions.

First Fallacy: AN EMERGENCY RESPONSE PLAN IS A DISASTER RECOVERY PLAN
Wrong! An emergency response plan is just that, a detailed set of procedures on how to immediately respond to an emergency situation. It would include: emergency instructions, attending to the injured, evacuation routes, floor wardens, search zones, assembly points, utility turnoffs, emergency numbers, etc. If your “recovery plan” stops here, and you think you have a recovery plan, you’ve landed short of your true goal of being able to recover. For in reality, responding to an emergency is only a small, yet important part of a complete disaster recovery plan.
By a complete recovery plan, I mean a disaster recovery plan that can both respond and then recover the critical functions of your business. It is a plan that utilizes multiple recovery teams such as: emergency response, crisis management, damage assessment and reconstruction, information systems, communications, administration, your core business functions, etc. Each team has a predefined set of responsibilities, each addressing: the response, restoration, resumption, reconstruction, and subsequent relocation tasks and issues. For each identified recovery function, detailed and specific information must be documented.
I’ve found that this particular false impression is more prevalent in government entities than in the private sector. It could be that in the time of a disaster, the government’s primary focus is on emergency response. As such, and for the same reason, they may feel that an emergency response plan is enough. In reality, they could respond to an emergency, but be unable to recover to provide services identified within their mission statement and subsequent business plan. Furthermore, it may be ironic that these could be the very services needed most immediately after a regional disaster.
Quick Recap: An emergency response plan cannot, and will not, recover your business. A full and complete disaster recovery plan is needed.

Second Fallacy: OUTSIDE ASSISTANCE WILL RECOVER YOUR BUSINESS
Wrong! Once the fire department disconnects their hoses, the Red Cross serves you food, and you hold your insurance check, the recovery is yours. Yes, you own the problem, and it’s all yours. Expect no further outside assistance with your recovery, except what your insurance check will buy. Also remember, if certain staff members are not available, no amount of money can buy lost knowledge, unreadable data, or destroyed records.
This fact holds true for any company, department, business, agency, or office, and it doesn’t matter if you are public, private, or government. It also doesn’t make a difference if you’re a small business, a medium size government entity, or a large corporation. Once the event occurs, your “recovery timer” starts and your business recovery is yours alone. How you respond will determine if your company survives, and survival is predicated on how quickly your services and products are once again available to your customers or constituents.
Just as having a disaster recovery plan that addresses only the response to an emergency will not bring products or services to your customers, neither will reliance on outside help. For those who still cling to the “recovery by outside assistance” theory, let’s take a look at what emergency assistance you could possibly expect from the government:

LOCAL GOVERNMENT
• Provides law enforcement, life and property protection through the Police Department.
• Provides fire suppression, first aid, search and rescue, and HAZMAT through the Fire Dept.
• Removes trash and debris through Waste Management.
• Restores water service through the Water Department.
• Repairs infrastructure through Street & Maintenance Department.

RED CROSS
• Provides health care, food & shelter in an emergency.
• Provides for education & training.

COUNTY GOVERNMENT
Emergency Command Center
• Coordinates a multiple city/county response to a declared disaster by providing: command, operations, planning & intelligence, logistics and finance functions.
Agencies / Departments
• Provides financial assistance through Social Services.
• Arranges emergency housing and shelter through Housing and Community Development.
• Facilitates code enforcement, building inspections and permits through Planning & Development.
• Provides law enforcement, property protection and coroner service through the Sheriff’s/Police.
• Provides fire suppression, first aid, search and rescue, and HAZMAT through the Fire Dept.
• Coordinates health care, health alerts, lake/stream/beach closures and animal control through Health Care.
• Surveys, maps, maintains public facilities and construction through Public Facilities.
• Coordinates the arrival of cleanup debris at land fills through Waste Management.

STATE GOVERNMENT
Office Emergency Management
• Coordinates overall state agency response to major disasters in support of local government.
• Coordinates statewide Fire, Law Enforcement, and Telecommunications Mutual Aid Systems.
• Coordinates the state’s Urban Search and Rescue and Safety Assessment Volunteer programs.
• Assures the state’s readiness to respond to and recover emergencies.
• Assists local governments in their emergency preparedness, response and recovery efforts.

FEDERAL GOVERNMENT
Federal Emergency Management Agency (FEMA)
• Advises on building codes and flood plain management.
• Helps equip local and state emergency preparedness and teaches how to get through a disaster.
• Coordinates the federal response to a disaster.
• Makes disaster assistance available to states, communities, businesses and individuals.
• Supports the nation’s fire service.
• Administers the national flood and crime insurance programs.
U.S. Department Of Transportation
• Provides roadway and bridge design, construction, maintenance, planning and highway safety.
• Ensures safety and certification of airports.
• Promotes emergency operations, vulnerability reduction, and damage control at civil airports.
• Plans for emergency management of civil airports; and the direction of Federal activities and their restoration after attack or a natural disaster.
Department Of Defense
• Provides staff to the states to protect life and property, and defense through the National Guard.
Department Of Energy
• Manages and ensures the implementation of the Department’s emergency management system.
• Serves as the Department’s single point of contact for emergency management activities.
• Ensures the maintenance of the DOE’s emergency response capabilities to respond.
Health And Human Services
• Prevents outbreak of infectious disease, including immunization services.
• Assures food and drug safety.

These are but a few of the government entities that provide emergency services at time of need. Each agency is highly trained, skilled, and knowledgeable in their field of expertise, and dedicated to emergency response situations by addressing life, health, and or/and safety issues. They are a great group of individuals. However, not one of them is chartered with, or trained for, the recovery and resumption of your business functions. They know as much about your business operation as your local doctor or lawyer. In fact, your local butcher, baker and candlestick maker might well achieve the same results.
To bring it home, and illustrate it another way, see if you can guess the success of this facetious and absolutely absurd recovery scenario:
A fire spreads to your building. Using your emergency response plan, you evacuate the building and phone the emergency authorities. They arrive, suppress the fire, and the smoke clears. You turn the page of your emergency response plan and find no recovery instructions (fallacy one now proven to be true). Remembering your anticipated reliance on outside assistance, you simply make a few calls to all the right people, in all the right places. And, as this is an imaginary scenario, we can say that everyone spontaneously arrives. With the multitudes assembled, you assign each government entity to a recovery team, advise them that you’re not sure what needs to be done and then instruct them to “go forth and recover.”
1. The County Emergency Operations Center is activated to control your business recovery.
2. Your Accounts Payable and Receivable will be handled by the Treasury Department, immediately after they find some checks, determine who to pay and identify what is owed.
3. Waste Management will handle the damage assessment and guess at what’s critical.
4. The Federal Communications Commission will connect your voice and data network by using old phone records.
5. The National Guard moves in to take over, start up and run your manufacturing line once they figure out what you make and what equipment is required.
6. The Department of Energy, now your purchasing department, is waiting on the National Guard to identify the inventory level, material requirements, and equipment needs.
7. The Department of Transportation will ship the manufactured orders as soon as they can determine who ordered the stuff, and where it goes.
8. The Police Search and Rescue Department will try to find your backup tapes.
9. The FBI will trace the serial numbers on the burned equipment to determine who the manufacturer was so that the Department of Energy can order the hardware and turn it over to FEMA.
10. FEMA will restore your system(s), using trial and error, from one of the dozens of possible recovery techniques.
11. The Humane Society will handle payroll, the moment they determine who to pay, at what hourly rate, federal and state taxes, withholdings, etc.
12. The City Council will attempt to write job descriptions, interview and hire.
13. The Red Cross will secure tents for your work location.
14. The CIA is actively involved in something, but can’t tell you what.
15. And you can be the public information officer and explain to the media, creditors, stock holders, customers, constituents, and suppliers just how things are going and how fallacy two may also have been wrong.
Quick Recap: Following a disaster, your business recovery is your internal responsibility. No one from the outside will do it for you, nor can they.
In other words, once the emergency response departments/agencies leave, and you turn toward your building, the recovery is now in your hands. Yes, you’ve got “the ball.” From this point forward, there is only one unique group of individuals that understands your business, and that group is your staff. Furthermore, it is only your staff that has the capability to recover your business. If you’re holding a recovery plan that addresses only emergency response issues, you’ve started a long uphill journey that may be ugly (even uglier if you lost staff), long, and possibly insurmountable.
I have also found that there is a group that holds to the belief that an insurance check and bank loan, combined with an emergency response plan, will equate to a recovery. As with false expectations of a government assisted recovery, all the insurance payments and, all the bank loans, will not put your business back together again. Insurance payments will not buy you instructions, procedures, records, processes, destroyed information, etc.

Summary
An emergency response plan is not your recovery solution. Furthermore, anticipated reliance on outside assistance will only give you false hope until the actual disaster. Though every business entity should have some form of a disaster recovery plan, that goal falls miserably short. In fact, I will go on record by saying that less than five percent of all businesses, with a couple dozen or more employees, have a disaster recovery plan in place. Still fewer have tested their plan and have kept that plan up-to-date.
As recovery planners, we have failed to disseminate the message often enough, and to the right individuals, and it’s not for lack of want. For the most part, this can be attributed to the fact that there are so few experienced recovery planners, and we often focus on larger business/government entities. It is my hope that this article finds its way into the hands of those who can use the information to their advantage. And finally, don’t throw these remarks away, as they will, unfortunately, be just as timely a decade from now as they are today.

Norm Koehler, CRP & CBCP, has more than 20 years of experience in disaster recovery planning. He has written and tested recovery plans for dozens of companies, including several in the Fortune 500. In 1997 he founded BRProactive, Inc. (www.brproactive.com), a company that provides disaster recovery plan software.

To comment on this article, go to 1501-11 at www.drj.com/feedback.

«BACK to the Articles Index