AS COURTS INCREASINGLY HOLD FIRMS LIABLE FOR LOSSES CAUSED BY COMPUTER FAILURES, RECOVERY CAPABILITIES ARE FAST BECOMING A...
By Kevin P. Cronin
The business reasons for contingency planningavoiding financial losses, negative publicity, loss of market shareare the most immediate and most important. Obviously, you want to get up and running to minimize your losses. But there is another compelling reason for business resumption planning: legal necessity. You may be required to have it whether you know it or not.
There are three situations where contingency planning and disaster recovery capability are legally required or prudent.
The first is where a law, statute or regulation requires a business to have disaster recovery capability.
The second situation is where a contract requires a business to have business recovery capability.
The third area is what lawyers call the common law, which is contained in court decisions and which may require some businesses to have business recovery capability.
There are thousands and thousands of laws. The Internal Revenue Service code and the federal code together fill about 50 feet of shelving.
Federal laws often are the most important. The Comptroller of the Currency and the Federal Reserve, for example, require banks to develop disaster recovery plans and continually test and reassess those plans.
Banks, in fact, were some of the earliest converts to the business recovery religion. For over a decade now, banks have been required to have disaster recovery plans. To make disaster recovery a high priority issue, banks must have as agenda items at their annual meetings a discussion of how they are meeting their disaster recovery planning needs.
In addition, the federal Securities Exchange Act of 1934 requires publicly held companies to maintain books and records that accurately reflect their affairs. And even if your company is not publicly traded, the IRS wants you to keep accurate records. Eventually, most businesses are audited, and when the IRS comes knocking, you may be required to produce business records going back three or more years. If the IRS suspects fraud, they can go back 10 years or more. There is no statute of limitations for tax fraud.
If you have lost your backup financial data because of a fire or flood or some other kind of disaster, you can ask the IRS to take your word for it. Dont bet on it, though.
States have their own regulations affecting business resumption planning. Some states, especially California, require businesses to be prepared for certain recurring natural disaster, such as hurricanes, earthquakes, or floods
All businesses have contracts, and some contracts require suppliers to perform, come hell or high water.
Banks, insurances companies, large manufacturers, and other sophisticated businesses already know the importance of business resumption planning. Many have been practicing this discipline for five or 10 years, and they do not want to be the weak link in their business chain. They do not what to go down because a supplier failed to deliver after a disaster. Often, they contractually require that their suppliers have business resumption capabilities. So if you want to do business with big companies, you may have to have business resumption capabilities.
Government agencies often have the same requirements. Many government bid requests (RFPs or RFBs) now require evidence and some contractual guarantees of a bidders recovery capability. If you want to bid successfully, you had better provide evidence of that capability.
Some insurance companies now provide discounts for companies that maintain effective business recovery planning programs. The discounts are usually for business-interruption insurance. They give you a break because of your disaster recovery capability.
Eventually, more and more insurance companies are going to mandate that their customers have business recovery capabilities in order to get insurance.
But remember: Business recovery capability is not insurance. Disaster recovery agreements and insurance policies may be triggered by similar types of events, but their purposes are completely different. Disaster recovery aims at minimizing the downtime resulting from disaster. Insurance reimburses, or indemnifies, businesses for certain losses resulting from disasters. Relief comes sometimes weeks, or months, or even years after the loss occurred, instead of within hours.
The common law is a thicket of legal rules that have grown out of court decisions and very old laws. A good portion of the law of negligence and fiduciary responsibility, for example, arose out of the common law.
What does this 200-year-old body of law have to do with modern business? Under the common law, your business may have certain fiduciary obligations and duties of care to its customers and shareholders.
Plaintiffs lawyers can be amazingly creative in crafting high standards of care for businesses whether medical practices, manufacturers, construction companies, or whatever. And these duties can involve having a contingency plan and disaster recovery capability.
Regardless of whether a company is privately held and has just a few shareholders, or is publicly held and has thousands, most jurisdictions require directors and officers of corporations to exercise what is called good business judgement. That is a legal term of art that is used a lot in litigation. Good business judgement extends in some circumstances to disaster recovery.
Lets say, for example, that a manufacturer suffers a catastrophic loss of its data center, losing its records of receivables and delaying thousands of orders. The business has an obsolete contingency plan and, as a result, is unable to recover quickly from the disaster. The business loses megabucks.
The shareholders, feeling the business has been mismanaged, want to get their money back. So they file a shareholders derivative suit against the officers and directors of the business, alleging that they failed to exercise good business judgement in failing to have a current disaster recovery plan, resulting in the huge financial losses. Depending of the other facts of the case, the shareholders could win such a suit.
Another potential source of legal liability arises out of obligations to customers and to third parties. Even if a business is not required by statute or contract to obtain contingency planning/disaster recovery services, the current availability of such services might make a business failure to obtain them negligent and actionable after a disaster.
In a landmark 60-year-old case (In re the T.J. Hopper), several ships sank during a storm off of the East Coast. The vessels were not equipped with radio receivers. If they had been they could have avoided the storm.
Despite the courts finding that only one shipping line in the country then had fitted its vessels with radio receivers (transmitters were already common for S.O.S. calls), it found the owners of the lost vessels negligent for not equipping the vessels with receivers. The court balanced the cost of the radios, which was relatively small, against the harm that could result from not using them and decided that the prevailing custom of not having radios was negligent.
Putting this ruling in todays context, when was the last time you heard the excuse, Our computers are down? The availability of reliable computer technology makes this problem less and less excusable. Likewise, the availability of disaster recovery capability makes lengthy computer downtime more avoidable, and therefore actionable.
And typical business antidotes to negligence claimscontract disclaimers and insurancemight not prevail in the case of computer disasters.
Force majeure exculpatory clauses, for instance, might not be so exculpatory in the case of data center disasters. Why? Because these clauses usually cover events beyond a partys reasonable control. Because disaster recovery capability is easily obtainable, downtime due to a computer disaster is controllable, and so the clauses do not work in these cases.
Limitation (or exclusion) of liability clausesthe no consequential damage provisionmay not be enough to protect a business either. Gross negligence, willful misconduct, and misrepresentation probably will not be absolved by any limitation or contract disclaimer.
And business insurance doesnt always serve as a safety net. All-risk insurance may not cover downtime losses resulting from computer disaster.
Since disaster preparedness liability issues are emerging slowly, lawyers must draw upon parallel situations where liability stems from failing to adopt state-of-the-art measures.
Technology law, in general, in an embryonic field. Scarcely a week passes without a Computer World article about a new lawsuit aimed at establishing some exotic application of copyright or trade secret laws or at concocting a new form of liability. Commentators have even sought to make data processing and related fields subjects to a malpractice standard, like medicine and law already are .
Considering the costs of defending corporate lawsuitsmuch less the costs of losing such suitsbusiness recovery planning is not just smart. Its a bargain.
This article was reprinted courtesy of Sungard Recovery Services, Inc., Recovery Winter 1993.
Kevin P. Cronin is a corporate lawyer in the Philadelphia office of Blank, Rome, Comisky, & McCauley
and is member of the firms intellectual property and international law groups.
This article adapted from Vol. 6 #2.
Disaster Recovery World© 1997, and Disaster Recovery Journal© 1997, are copyrighted by Systems Support, Inc. All rights
reserved. Reproduction in whole or part is prohibited without the express written permission form Systems Support, Inc.