Disasters Require Recovery: Recovery Requires Planning
By Richard Oppenheim, CPA.CITP
Disasters can happen in minor and major ways. Lessons need to be learned from all varieties of disasters: hurricanes like Katrina and Rita, terrorist attacks like on 9-11, snow storms that block roads and collapse power lines, construction mistakes that burst water mains or crack telephone cables, computer failures of all types and causes. Disasters are never part of the current agenda as they never occur in any predetermined timeline.
The key to handling any disaster is to have sufficient information about your resources and operations readily available after disaster strikes. This applies most significantly with the computers, software and data that are an integral part of most companies. Unfortunately, it is just these assets and resources that are often not managed with sufficient documentation and data back-ups to enable a speedy and successful recovery.
Companies can develop checklists and entire manuals of what to do if a disaster strikes. The key point for any plan is to put into the thinking process what would happen if any component or the entire complex was suddenly no longer accessible. There are a lot of possible outcomes that can result from a single or multiple disasters. Disasters can create a loss of:
- Electric power
- One or more data files
- One or more hard drives
- One or more computers
- Personnel
- Valuable papers, documentation, etc
- Fixed assets such as buildings and heavy equipment
- Customer business operations
- Access to supplier and vendor products
- Accounting records, tax returns, financial data
- Cash
- More…
The loss list can expand depending on the quantity of any of the items. A retail store would typically have more cash on hand than an accounting firm. Large companies would have more computers than small companies. For this article we will be focusing on the technology sources, resources, equipment, and data that can be lost or destroyed that would require time and effort to recreate.
When a company faces a disaster, whether it is a local or regional situation, the range of issues has to be addressed in a timely manner. Starting to plan after the disaster is too late and could exacerbate the losses. See all of the news accounts about how FEMA made too few planning decisions before the hurricane and did not have a plan to handle the problems as they arose.
This article is a starting point – find the set of information that is appropriate for your situation and start the process of preparation. Most often, companies need to step through the preparation for a disaster in phases. All issues need to be addressed to understand damage and minimize ongoing risks. It is likely that the allocation of resources will require some time and effort that has to be integrated with current work.
Here is a starting list of categories of content for any disaster planning manual.
Resources
- People – personnel within the company, their contact information, roles and responsibilities.
- Assets – non-computer, such as furniture, trucks, inventory
- Computer equipment
- Communications equipment and services
- Business Resources – how the company operates such as what it depends on from outsiders and insiders other than assets listed above.
- Other
Procedures and Guidelines for business operations and activities
- People contacts
- Organization chart
- Phone Tree for contact
- Backup Procedures for business operations
- Data
- Transactions
- Reference data bases
- Programs
- Backup procedures
- Computer
- Systems operations
- Identification of all equipment, licenses, warranties, support telephone numbers
- What to do when disaster occurs
- Assessment of damage
- How to determine damage
- Guidelines for disaster recovery
- What to do next
- What to do if disaster results in total destruction
Each of the items above has to be complete and current. For example if new computers are installed, it is bad to not update the documentation for the computer configuration, systems and applications. Large companies have major staffs and very large budgets to cover all forms of IT support. Small and medium sized companies must also include disaster recovery within their business operations and within their budgets. Here are issues that every SME business must review and implement –now.
1 Top execs need to have major involvement
Panning starts at the top. The design, implementation, testing, and continuous review of disaster planning and recovery are part of the senior executive and manager responsibility. The whole company, suppliers, vendors, customers need to understand that disaster recovery planning is a priority
2 Disaster Plan must be in writing in a digital file and on paper
Any disaster plan has to be shared throughout the organization. When it is in writing, it can be reviewed and implemented by all personnel. A duplicate copy of the plan must be maintained in a distant location, not just on another floor or one block away. This plan includes a risk analysis and assessment of all operations.
3 Backup data daily and implement procedures to periodically move one copy offsite
Disasters occur in regions and it is critical that the backup not be in the same area as the original processing. How far away is enough needs to be assessed by the potential risk of loss. Consider the wide destruction of the hurricanes. As for the frequency of moving data off site, it depends on the current nature and frequency of updates. Banks and financial institutions need to move data daily or even hourly. Restaurants can move data weekly, or maybe even monthly. (Small office backup support)
4 Test everything
All backup IT resources need to be tested to be sure that they are functioning. This includes testing the data storage at least annually or when there are any significant system changes. This includes equipment, software (knowing what version is current), data, and staff services.
5 Understand who the users of the IT system are and where they are located
If customers shop and access your business through an e-commerce site, then supporting the growing global market is essential. In this case, having a backup for your web site must be done at some remote computer servicing location. If users are only local, such as a restaurant or small store, then providing access is more physical and you must make appropriate plans for location management. In any event, the staff who rely on access to the various computer applications must continue to be supported.
6 IT files and business documents (including manuals for operations, training, etc.) must be in writing – digital file and on paper
If business processes are supported by memory alone, then when the person with the memory is not available, there is a risk of not being able to complete the task. Digital and paper files can provide the starting point for reestablishing management and control of operations.
7 Personnel must also have backups.
Some staff may lose everything. Disasters can also result in loss of valuable people who have knowledge and expertise with the system processes and operations. It is essential that all positions have written procedures and that other people must be able to fill in for staff who are on vacation, sick or not accessible for any disaster reason. Further, it is essential that all personnel are aware of the recovery plan. In small companies it is not uncommon for several people to quit at once. The description of how jobs are to be performed can also be important.
8 Contracts for outsourced support and services need review
These services include IT services such as web hosting, application support and contract systems development. Non-IT services also should be reviewed, such as banking and other business support service vendors. Review financial stability, third party certification, and other due diligence work before assuming they will be available to assist your company in a disaster.
9 Synchronize IT - IT recovery needs to be consistent with business recovery
Computer operations resources must be synchronized with business operations and business recovery needs. This includes the support for staff, customers, government reporting, inventory control, etc.
10 Obtain expert support as needed – experts, professionals, support
If the plan and recovery issues cannot be answered within the organization, then it is essential that outside support be sought. Pride and ego can be set aside for the benefit of business continuance.
11 Accounting for damage
Determine how the company can account for and measure the loss in terms of real assets, computer operations, loss of customer revenue, replacement of equipment and business tools, loss of staff time, additional medical costs for staff recovery, etc. This requires a competent accounting system to be in place before the disaster.
12 Hardware redundancy – test and manage
The hurricane disasters have certainly displayed examples of damage from wind and water and fire. All companies rely on computer systems to manage their business. Consequently, it is mandatory to have options as to what can be done when a disaster strikes. Depending on the requirements of the business done through computers, complete system redundancy or access to a few computers in another location would be appropriate. In addition, the access to the redundant computers needs to be tested at least annually.
When Disaster Strikes
If it is known that a disaster is pending, such as Katrina and Rita, then preparation can start early. It is when the disaster is not predicted that the surprise may test the company’s response capabilities. Listed below are some steps that need to be included as part of your overall disaster planning guidelines. Of course, when the disaster strikes, these are the procedures to be followed to manage the company’s recovery.
People
1. Determine where employees are. Identify employee location at home, in a shelter, or traveling. If any are missing start process of locating. Determine a means for people to people communications for continuity of operations and efforts for clean up following the disaster.
2. Review all data about employees and their families and contact them to determine if support is needed.
3. Organize a system for everyone to have a point of contact - staff, vendors, customers, insurance agents.
4. Consider the emotional, psychological and behavioral issues that may require counseling.
5. Start the process of getting everyone productive and moving operations back to normal.
Operations
6. Assess business continuity status. Create lists of any commitments, deadlines, and due dates for work that is finished, in process, or about to be started. This would vary depending whether the company is manufacturing, retail or a service oriented enterprise.
7. Determine what equipment and systems are working and which are not. It is significant to assess the status to know the efforts needed to reestablish functions. Consider immediate needs, such as space, communications equipment, telephone service connections, skills and roles that need replacing immediately. Redeploy people as needed.
8. Identify and communicate with employees, customers, clients, key owners and shareholders, insurance companies, creditors, banks, suppliers and vendors, strategic partners, and analysts.
9. Establish plan for alternate postal deliveries – both incoming and outgoing.
10. Consider outsourcing production to competitors or other vendors to enable meeting existing customer commitments and demands.
11. After initial accounting assessments, determine whether insurance coverage exists for losses to property, inventory, business records, individuals, and other business interruption impacts.
Some simple ideas
1. Set up and maintain sufficient emergency supplies on site, including some food, water, flashlights and batteries, a source of heat, and a source of communication. It may also be recommended for everyone’s home and home office.
2. Distribute disaster recovery information to all employees and their families in a form that is easily accessible. Consider adding the information on the company web site in an employee only accessible page.
3. If the company web site is hosted at the office location, set up an alternative hosting location.
4. Use the existing business plan as a template to develop a new business plan based on the results from the disaster.
Conclusion
For computers and computer systems, it is imperative to plan for and implement how to recover, resurrect and restart all of the following:
Data
Programs & Processing
Passwords & all required licenses
Web sites
Network & Communications services
Some other ideas from CIO magazine
Disasters are terrible events that have to be managed before, during and after the actual occurrence. Not being prepared has to be unacceptable.
About Author:
Richard Oppenheim, CPA.CITP, has used and written about technology for more than four decades. He currently provides advice through the Oppenheim Business Group. He can be reached at richopp@oppenheimgroup.comor through his Web site, http://www.oppenheimgroup.com .
Comments/Feedback about this column:
If you have any feedback or comments about this article we'd like to hear from you... (Feedback Form)
|
|
Sponsor Messags & Links
Red Wing Software
With more than 25 years of experience developing accounting software, Red Wing Software knows businesses. We specialize in providing software at a reasonable price to companies who are outgrowing their current software and need more functionality, especially where inventory is concerned. Red Wing Software offers a complete suite of software products that can integrate and work together, including General Ledger, Accounts Payable, Accounts Receivable, Inventory, Order Entry, Purchase Orders, and Payroll. For more information about Red Wing Software products, please call 800-732-9464, or...
Visit Red Wing for more details
AS411 - Software Search Service
Tired of searching for software?
AS411's complimentary software search service will help you locate professionals in your area who can help you with all your software needs. It's simple, easy and only takes a few minutes.
Click Here to learn more
|
|
|