Business Continuity and Disaster Recovery for Law Firms CAROLINE POYNTON

Transcription

1 Business Continuity and Disaster Recovery for Law Firms CAROLINE POYNTON PUBLISHED BY IN ASSOCIATION WITH

2

3 Contents Executive summary... VII The regulatory landscape...vii Part One Business Continuity and Disaster Recovery Planning and Management for Law Firms Chapter 1: The business continuity landscape... 3 A more risk-aware culture... 4 A catch-up job?... 5 Learning from experience... 5 The regulatory framework... 5 From recovery to continuity... 6 A US perspective... 7 Chapter 2: Putting together a business continuity plan... 9 Risk assessment... 9 Pulling the plan together Testing and monitoring the plan The basics of a BCP Chapter 3: IT and business continuity Data protection So what are firms doing? Information security/data protection Outsourcing data Remote working Different models of data-centre outsourcing Chapter 4: Crisis management when reputation is on the line What constitutes a crisis? External crisis management Internal communication Q&A The white-knuckle ride of reputation management Facing the future III

4 Contents Chapter 5: The psychology of disaster recovery The wide-ranging likelihood of trauma A human-factors checklist Chapter 6: The road ahead Practical steps for developing pragmatic plans Part Two Case Studies Case study 1: Allen & Overy When disaster strikes The drive for BCM Preliminary processes Scope The importance of communications Responding to the media during and after a crisis People issues The drive for resilience Exercising the plan Maintenance and review Creating awareness Case study 2: Ashurst Continuity planning and review What do you think are the real drivers for business continuity planning among law firms today? 49 How do you assess the likely risks that might affect business continuity in your firm? What key elements does your BCP include? What recommendations would you have for testing the plan? How do you ensure that your fee earners and other staff would know how to respond in the event of a crisis? What plans, if any, do you have to further build on your business continuity planning? Case study 3: Clifford Chance The importance of communication Tell me about the major challenges of your role as business continuity manager at Clifford Chance In your view, what are the biggest obstacles to establishing a working BCP in a law firm? What do you consider to be the most important elements of an effective BCP? How do you work with others across the firm? What do you think are the most important factors in making a success of a BCP? How is your BCP tested and monitored? In your opinion, what would be the major reasons for a BCP failing when put to the test? How do you keep people updated on your BCP? How do you put together your crisis management team? What further plans, if any, do you have for building on your BCP? IV

5 Business Continuity and Disaster Recovery for Law Firms Case study 4: Irwin Mitchell Implementing the security standard BS The importance of information security Choice of partner Rolling out the project Looking to the future Case study 5: Irwin Mitchell Fighting the floods Case study 6: Virtually bombproof Learning from the past Waste not, want not A neat trick Virtualisation to the rescue The road to recovery Server state Data replication Knowledge is power The right time to invest Case study 7: Norton Rose LLP It s all in the IT-security planning How did Norton Rose Group achieve this level of protection? Case study 8: The abrupt audit of a crisis sink, drift or swim? Crisis management Reed Elsevier delivering a realistic table-top exercise Case study 9 Risk management trends The main issues Roles and responsibilities A framework for training delivery A virtual benchmark Real-life case studies: this could happen to you! Influencing behaviours and adding value Case study 10: DLA Piper Managing business continuity Business continuity strategy Plans for key risks Plans for specialised support functions Education and training Communication Rehearsals and tests Where next? Index V

6

7 Executive summary UNTIL RELATIVELY recently, law firms would likely have associated a business continuity plan (BCP) with a major disaster terrorist incidents, widescale floods or fires, or pandemic flu perhaps. In the globalised business landscape, however, there are myriad issues to face some seemingly fairly minor that could cause major disruption to business operations. And even a fairly insignificant interruption to business continuity can cause unforeseen consequences. A recent survey carried out by the Economist Intelligence Unit, for example, found that almost half (47 per cent) of organisations risk managers said unplanned downtime of IT systems for just 24 hours could take their business to the point of no return. In the fast-paced environment of today s business world, management has to have a back-up plan. Thankfully, the same survey showed that three-quarters of the respondents are investing more time and money into operational risk management with 71 per cent focusing on BCPs. Nor is it just the forward-thinking corporates that are taking the lead; the legal profession has also woken up to the importance of business continuity management (BCM). Incidents that might impact law firms could range from a simple power failure to terrorist bombings, such as we have witnessed in recent years in New York, London and Madrid. In the UK, another late summer of storms and consequent flooding are timely reminders of the need to prepare for the worst from IT downtime to the potential loss of office space. BCM is a comprehensive process that should include a risk management analysis and assessment, as well as the resourcing and testing of a fully-documented BCP that is then reviewed regularly. It goes far beyond the financial aspects of insurance cover, in that it deals with all the tangible and intangible aspects of doing business, including data and IT systems recoverability, the safety and security of staff, office operations and even reputation management. Although not concerned only with financial aspects of the business, business continuity planning may come into a firm s proposal for insurance cover. An insurer is likely to ask about a firm s risk-management capability and, indeed, its BCP specifically. In this situation, the better equipped the firm is to deal with business continuity issues, the greater its negotiating power will be when it comes to insurance cover. Having said that, despite the numerous incentives for implementing business continuity planning, many firms have yet to give sufficient time and resources to their BCPs. The regulatory landscape For firms that have not as yet implemented comprehensive BCM, there are, however, several drivers to change. For a start, many clients will consider it essential that a law firm client has implemented BCM. In the UK, the Financial Services Authority (FSA) VII

8 Executive summary requires financial organisations to verify the recoverability of their critical suppliers; and for some of those companies a law firm client will be just that. In addition, new regulations and standards are forcing law firms to consider their abilities to respond effectively to a crisis. Rule 5.01 of the new Solicitors Code of Conduct requires all law firms in England and Wales to have a BCM in place. In addition, standards such as the BS audit toolkit support businesses to implement and demonstrate an adequate BCP. Failing to quickly and effectively respond to a business disruption may have farreaching repercussions on revenue, incoming work and, perhaps most damagingly, reputation. It is quite simply an essential responsibility for law firm senior management that requires time and investment. In this Ark Group report Business Continuity and Disaster Recovery for Law Firms, we will look at various aspects of BCM. Beginning with the changing landscape, we will explore the myriad risks facing firms especially where many are expanding quickly to open new offices or branch out overseas. In today s business landscape, there are ranging implications for business continuity planning arising out of very different disaster/ crisis scenarios for example, the impact of an avian flu pandemic versus a city-wide power cut lasting 24 hours or longer. Taking the various potential incidents a firm might face, we will look at how a firm can evaluate the likelihood and severity of business disruption and establish a BCP accordingly. We will then examine the regulatory imperatives and why clients and regulators are driving firms to implement BCPs that go far beyond an IT recovery plan. We will also discuss the internal factors in effective business continuity planning in particular, engaging and communicating with staff on the processes involved in the BCP, and ensuring that everybody knows and is trained in exactly how to respond in the event of a crisis. IT-systems resilience will also be a key focus, given the importance of data security and the need for IT-systems access, no matter what the situation. Indeed, as part of this, we will look at some of the latest developments (such as virtualisation) that make IT business continuity more manageable than ever. In considering the above issues, we will also consider how they might translate into a BCP, and how that plan should be tested and monitored at various intervals to ensure ongoing resilience. And, in the event of an incident occurring, we will finally discuss communication strategies and how a firm s reputation can be protected when business disruption occurs. In Part Two of the report, we include a variety of contributions from leading law firms that have either experienced disasters themselves, or have implemented wideranging plans to protect themselves from the ongoing threats. The case of Irwin Mitchell in Sheffield is perhaps one that will particularly resonate with anyone in the UK or US who has experienced the increasingly severe weather of recent years. The Sheffield floods of 2007 left the firm s riverside offices in disarray, with the ground floors extensively damaged by the rising waters. The firm not only had to deal with immediate problems such as staff trapped in the offices by the flood, but also had to manage ongoing challenges as the city struggled with power cuts in the two weeks following the crisis. Much as the firm must have wished it hadn t happened, the real-life disaster was also a great demonstration to clients that the firm could cope if the worst happened. Indeed, the office was up and running and open for business at 9am on the following day. VIII

9 Business Continuity and Disaster Recovery for Law Firms The ongoing obstacle for many firms considering BCM is finding the time and the resources to support a plan that it is hoped will never be invoked. But as we all know, we live in testing times, where businesses large and small have been hit by a whole range of disasters from bad weather to terrorist attacks. In this environment, firms can just not afford to overlook the importance of business continuity planning. IX

10