MANDATORY CONTINGENCY PLANNING

WHERE DO WE GO FROM HERE?

By John Copenhaver, CDRP and Raja K. Iyer, Ph.D., CDRP

Consider the following scenario: “You own shares of stock in Company A and Company B, both located in Los Angeles, California. Both of them suffer heavy losses from the recent, devastating earthquake. Company A suffers heavy damages, but it is able to recover and resume operations in two weeks; its stock price went down 20% but, as its operations improved, the price rose close to its original level in three months. Company B, however, was unable to cope with the disaster and recover its operations and market position. Three months later, Company B’s stock prices steadily declined 75%. You are frustrated and annoyed because you had invested over 50% of your savings in Company B’s ‘high-tech’ stock. You now begin to contemplate a law suit!”
Although the above scenario is imaginary, the situation presented could occur soon, if it has not already happened. Be it a natural or man-made disaster, the impact of disasters can be devastating not only to organizations but also to all its stockholders, particularly stockholders of public corporations who are helpless and have no control over the disasters or the impact of such catastrophic events. Or, do they? Are these stockholders really helpless? Do they have any control over the organizations, in the sense that they may require or at least expect that these organizations have plans to mitigate losses from catastrophic events? And, if the organizations are negligent in mitigating disasters through available methodologies, knowledge, and technologies, are there legal recourses to protect and preserve the interests of these stockholders? In this paper, we examine these issues and prescribe actions that need to emanate from our infant, yet rapidly growing, business recovery and resumption planning industry.
As the list of recent and extremely expensive disasters continues to grow (the Los Angeles Earthquake of January 1994, has now surpassed Hurricane Andrew, in August 1992, as the most expensive disaster in United States history), the number of persons who have suffered financial loss from disasters is mushrooming. Many of these individuals have been investors in, or employees of, American corporations that have suffered huge losses; many of these corporations either had no disaster recovery plans, or had inadequate plans that failed to function effectively. So, who should bear such losses? Should it be the investors or employees who had no individual authority to demand that a solid contingency plan be built, implemented, and tested? Or, perhaps the corporate officers and directors of these companies that either knew or should have known that planning resources were readily available, but who chooses not to use these resources and whose judgment in retrospect should be called into question? Let us take a closer look at this issue.

THE CURRENT SITUATION

The need for Contingency Planning (otherwise known as Disaster Recovery Planning, Business Continuity Planning, and any one of a host of other names) has been recognized in several government sectors. The Comptroller of the Currency issued a Banking Circular on this topic, BC 177, in 1983. This circular was revised in 1987 and revised again in July 1989. The 1989 revision to the circular was issued jointly by the Comptroller’s office and the Federal Financial Institution Examination Council (FFIEC). The 1989 revision of BC 177 states that:
“The loss or extended interruption of (business operations, including central computer processing, end-user computing, local area networking, and nationwide telecommunications) poses substantial risk of financial loss and could lead to failure of an institution. As a result, contingency planning now requires an institution-wide emphasis, as opposed to focusing on centralized computer operations.”
The language of this statement is clear; failure to construct and implement an institution-wide contingency plan could have extremely grave consequences. Also, the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) has recognized the need for contingency planning. While less emphatic in nature than the terminology contained in BC 177, the JCAHO policy nevertheless acknowledges the critical need for advance planning and emergency preparedness for healthcare organizations.
Why have regulating bodies in these industries chosen to mandate contingency planning to some degree? And, perhaps more importantly, will other industries be required to follow suit and mandate disaster recovery and contingency planning? The answers to these questions lie in the more general provisions of the Foreign Corrupt Practices Act of 1977, an amendment to the Securities and Exchange Act of 1934, which deals with the fiduciary responsibilities of officers and directors of publicly-held corporations toward the assets of these corporations.

FOREIGN CORRUPT PRACTICES ACT OF 1977

What, you may ask, could anything entitled the “Foreign Corrupt Practices Act” have to do with the responsibilities of officers and directors of domestic corporations - and more specifically, those officers and directors who are NOT engaging in “corrupt practices?” Actually, the Foreign Corrupt Practices Act deals specifically with a concept called the “standard of care” by which the actions of officers and directors are judged, in this instance with respect to the management (or mismanagement) of corporate assets. In the legal publication entitled Corpus Juris Secundum (CJS), this “Standard of care” is enunciated as follows, “A director or officer is liable for loss of corporate assets through his negligence, fraud, or abuse of trust.” [CJS Corporations, Volume 19, Section 491] In this same section, CJS states even more clearly that “The directors and officers owe a duty to the corporation to be vigilant and to exercise ordinary or reasonable care and diligence and the utmost good faith and fidelity to conserve the corporate property; and, if a loss or depletion of assets results from their willful or negligent (emphasis added) failure to perform their duties, or to a willful or fraudulent abuse of their trust, they are liable, provided such losses were the natural and necessary consequences of omission on their part.” [CJS Corporations, Volume 19, Section 491]
Now, the real question becomes much clearer: Should officers and/or directors of a publicly-held corporation that did NOT have a functional disaster recovery or business continuity plan, and, as a result of this lack of planning, sustained significant losses from a disaster be held liable for that part of the loss that could have been averted, had a functional disaster recovery plan been in place? The positions of the Comptroller of the Currency, the Federal Financial Institution Examination Council, and the Joint Commission on Accreditation of Healthcare Organizations seem to lend considerable support to the argument that the failure to plan ahead is an extremely serious omission on the part of the officials of financial institutions and healthcare organizations. But, the question remains: Should officers and/or directors of publicly-held corporations be considered negligent for their failure to plan if a corporation suffers losses that could have been avoided, at least in part, had a contingency plan been in place at the time that the disaster occurred?
Looking back 60 years to an often quoted case, the answer emerges. To an article published in the winter 1993 edition of Recovery (from Sungard Recovery Services) and reprinted in Volume 6, Issue 2 of Disaster Recovery Journal, Kevin Cronin discusses the case of “In the T.J. Hopper” as follows: “In a landmark 60-year-old case ... several ships sank during a storm off the East Coast. The vessels were not equipped with radio receivers. If they had been (equipped with radio receivers), they could have avoided the storm. Despite the court’s finding that only one shipping line in the country then had fitted its vessels with radio receivers (transmitters were already common for S.O.S calls), it (the court) found the owners of the lost vessels negligent for not equipping the vessels with receivers. The court balanced the cost of the radios, which was relatively small, against the harm that would result from not using them and decided that the prevailing custom of not having radios was negligent.” If one looks at modern corporations and substitutes “contingency plan” for “radio receiver,” the question posed above must surely be answered with a resounding YES.

WHERE DO WE GO FROM HERE?

Earlier in history, it is doubtful that corporate officers and directors could have been found negligent, and consequently liable, with regard to losses that could have been reduced, had a disaster recovery plan been in place. After all, true, institution-wide “disaster recovery planning” (or “contingency planning” or “business recovery and resumption planning” or “business continuity planning”) is a young discipline, and courts may be reluctant to find individuals negligent for failure to use products, services, or procedures that were either extremely new or very scarce (for example, had radio receivers been only in an experimental stage or in such short supply that they were incredibly difficult to obtain, then the outcome of the Hopper case would likely have been different).
Today, however, there exists an abundance of methodologies published widely in books and journals, software programs, consultants, education, training, testing and certification programs in the area of business continuity and disaster recovery planning as to invalidate any possible claim of ignorance. “I tried to get help to build a contingency plan, but there was nothing available...!”
So, where are we now? With ample answers available to assist in developing, testing, implementing, and executing contingency plans for organizations in most industries, and with all too many examples that have recently occurred of what can happen to businesses that have not planned for potential disasters, corporate officers and directors should not be allowed to escape liability for an otherwise-avoidable loss of corporate assets resulting from a disaster simply by claiming ignorance of disaster recovery and business continuity planning. These officers and directors either knew or should have known about the need for contingency planning and the availability of resources to help in this process.
A sticky issue arises when a business unit that has a disaster recovery plan experiences a disastrous loss due in whole or in part to the fact that the plan did not function properly. Resolving this issue will be the next major hurdle for the disaster recovery and business continuity industry, because the only way to find corporate officers and directors negligent for losses resulting from an inadequate disaster recovery plan is to give these officers and directors - and the courts that will judge them - clear standards as to what constitutes an adequate disaster recovery planning effort. Without such standards, courts will be extremely reluctant to step in and deem any contingency plan so grossly inadequate as to have the effective of no plan at all. These standards are only currently emerging in this young industry.

CONCLUDING REMARKS

“Where do we go from here?” Those of us associated with the disaster recovery industry need to concentrate on two major issues. First, the continuing education of corporate executives on contingency planning (What is it? Why should we do it? How do we do it? What could happen to us if we don’t do it?). Second, the establishment of a set of standards for our industry to guide these executives, as well as other interested parties, such as courts, regulators, auditors, etc., in their efforts to comply with this “new” responsibility of ensuring that their businesses have effective disaster recovery plans in place.

John Copenhaver, CDRP, is the Director of Business Continuity Services for BellSouth Business Systems, in Atlanta, Ga. Raja K. Iyer, Ph.D., CDRP, is an associate professor of Information Systems at the University of Texas at Arlington.

Disaster Recovery Worldİ 1999, and Disaster Recovery Journalİ 1999, are copyrighted by Systems Support, Inc. All rights reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.