Review your insurance cover regularly to ensure it keeps pace with any changes in the business.

Transcription

1 Top Tips On Disaster Recovery Would you be able to recover if your business suffered a major incident that affected trading? Fires, floods, gas explosions, terrorist attacks, theft and sabotage could all cause substantial loss and damage to your business. Assessing the risks and working out how you would respond to a disaster, both short and long term, is key to surviving an incident. Top Tips Back up data regularly and store copies off site in a secure place. Low cost back up options include CD writers or DAT tape recorders. Practise restoring the data in an IT system outside your own to ensure it works. Ensure that important paper documents, such as contracts and employee information, are protected. Make copies and use fire resistant and waterproof storage containers. Keep a list of contact details for your staff, customers and suppliers off site so that you can contact them in the event of an incident. Also keep a list of emergency contacts for staff. Be clear about what your insurance policies cover and what they don't so that there are no nasty surprises when you subsequently make a claim. Keep copies of the relevant policies off site so that you know immediately what to do in the event of an incident. Review your insurance cover regularly to ensure it keeps pace with any changes in the business. Identify your business critical activities and set out the tasks needed to restore them and resume trading off site. Identify the core resources that support your critical activities and consider how you would source replacements. Have an emergency pack which will include your business recovery plan, as well as a first aid kit, mobile telephone, and masks to protect against fumes and dust. Make an inventory of equipment, materials, products and any other assets to give you an overview of the business. This will make it easier to work out losses and identify gaps in core resources after an incident. Make arrangements for a temporary base - you may not be able to operate out of your existing premises for weeks or even months, depending on the type of disaster. Remember any site must comply with health and safety rules. Test the feasibility of your plan and review it once a year to keep it current. Tasks in the plan should be assigned to designated people. Being organised is a vital part of incident recovery.

2 Prepare Your Business For Disaster Unplanned events can have a devastating effect on small businesses. Disasters such as fire, damage to stock, illness of key staff or IT system failure could all make it difficult or even impossible to carry out your normal day-to-day activities. At worst, this could see you losing important customers - and even going out of business altogether. But with good planning you can take steps to minimise the potential impact of a disaster - and ideally prevent it happening in the first place. This guide will help you to identify potential risks, make preparations for emergencies and test how your business is likely to cope in a disaster situation. Why You Need To Plan For Possible Disasters It's essential to plan thoroughly to protect yourself from the impact of potential disasters - from fire, flood or theft to IT system failure, restricted access to premises or illness of key staff. This planning is very important for small businesses since they often lack the resources to cope easily in a crisis. Failure to plan could be disastrous. At best you risk losing customers while you're getting your business back on its feet. At worst your business may never recover and ultimately cease trading. As Part Of The Planning Process You Should Identify potential disasters that might affect you. Determine how you intend to minimise the risks of them occurring. Set out how you'll react if a disaster occurs in a business continuity plan. o For example, if you're reliant on computer information, you should put a back-up system in place so you have a copy of key data in the event of a system failure. Benefits Of A Business Continuity Plan A carefully thought-out business continuity plan will make coping in a crisis easier and enable you to minimise disruption to the business and its customers. It will also prove to customers, insurers and investors that your business is robust enough to cope with anything that might be thrown at you - possibly giving you the edge over other businesses. Disasters That Could Affect Your Business Depending on your business' specific circumstances, there are many possible events that might constitute a disaster: Natural disasters - for example, flooding caused by burst water pipes or heavy rain, or wind damage following storms. If your business is based in a remote area, there is a higher chance that natural disasters could occur. Theft or vandalism - theft of computer equipment, for instance, could prove devastating. Similarly, vandalism of machinery or vehicles could be not only costly but also pose health and safety risks. Fire - few other situations have such potential to physically destroy a business.

3 Power cut - loss of power could have serious consequences. What would you do if you couldn't use IT or telecoms systems or operate other key machinery or equipment? IT system failure - computer viruses, attacks by hackers or system failures could affect employees' ability to work effectively. Restricted access to premises - how would your business function if you couldn't access your workplace - for example, due to a gas leak? Illness of key staff - if any of your staff is central to the running of your business, consider how you would cope if they were incapacitated by illness. Outbreak of disease or infection - depending on your type of business an outbreak of an infectious disease among your staff, in your premises or among livestock could present serious health and safety risks. Terrorist attack - though this is less likely for many small businesses, it may be worth considering the risk of terrorist incidents if you're based in the centre of a large city. Disasters affecting suppliers - how would you source alternative supplies? Disasters affecting customers - will insurance or customer guarantees offset a client's inability to take your goods or services? Though some of these scenarios may seem far-fetched, it's prudent to give them consideration. For more information, see the page in this guide on how to assess the possible impact of risks on your business. Assess The Possible Impact Of Risks On Your Business You need to analyse the risk of particular disasters that could affect your business. This involves: Assessing the likelihood of a particular disaster occurring - and its possible frequency. Determining the likely impact on your operations if it does. This kind of analysis should help you to identify which business functions are essential to dayto-day business operations. You're likely to conclude that certain roles within the business - while necessary in normal circumstances - aren't absolutely critical in a disaster scenario. Likelihood Of Risks Occurring It can help to grade the risks of a particular disaster occurring, perhaps on a numerical scale or as high, medium or low. This will help you to decide your business' attitude towards each risk. You may decide to do nothing about a low-risk disaster - although remember that it could still be highly damaging to your business if it occurred. Potential Impact Of A Disaster To determine the possible impact of a disaster on your business, it can be helpful to think of some of the worst possible scenarios and how they might prove debilitating for the business.

4 For instance, how could you access data on your customers and suppliers if computer equipment were stolen or damaged by a flood? Where would the business operate from if your premises were destroyed by fire? It's essential to look at risks from the perspective of your customers. Consider how they'd be affected by each potential disaster. Would they be likely to look for alternative suppliers? Consider whether you would be able to keep to service-level agreements if a particular disaster occurred - and what the consequences might be if you couldn't. Minimise The Potential Impact Of Disasters Once you've identified the key risks your business faces, you need to take steps to protect your business functions against them. Premises Good electrical and gas safety could help protect premises against fire. Installing fire and burglar alarms also makes sense. Think what you would do in an emergency if your premises couldn't be used. o For example, you might suggest an arrangement with another local business to share premises temporarily if a disaster affected either of you. You may consider using a business continuity supplier, which can make alternative premises available at short notice. But this can be expensive. Equipment/Machinery If you use vital pieces of equipment, you may want to cover them with maintenance plans guaranteeing a fast emergency call-out. IT and communications.installing anti-virus software, backing up data and ensuring the right maintenance agreements are in place can all help protect your IT systems. You might also consider paying an IT company to regularly back up your data offsite on a secure server. Printing out copies of your customer database can be a good way of ensuring you can still contact customers if your IT system fails. People Try to ensure you're not dependent on a few staff for key skills by getting them to train other people. Consider whether you could get temporary cover from a recruitment agency if illness left you without several key members of staff. And take health and safety seriously to reduce the risk of staff injuries. Insurance - Insurance forms a central part of an effective risk-management strategy. Plan How You'll Deal With An Emergency You should draw up a business continuity plan setting out in writing how you will cope if a disaster does occur. It should detail: The key business functions you need to get operating as quickly as possible and the resources you'll need to do so. The roles of individuals in the emergency.

5 Making the most of the first hour after an emergency occurs is essential in minimising the impact. As a result, your plan needs to explain the immediate actions to be taken. Consider whether you'll need to give staff specific training to enable them to fulfil their responsibilities in an emergency situation. Ensure all employees are aware of what they have to do. Arranging the plan in the form of checklists can be a good way to make sure that key steps are followed. Include contact details for those you're likely to have to notify in an emergency such as the emergency services, insurers, the local council, customers, suppliers, utility companies and neighbouring businesses. It's also worth including details of service-providers such as glaziers, locksmiths, plumbers, electricians, and IT specialists. Include maps of your premises' layout to help emergency services, showing fire escapes, sprinklers and other safety equipment. Set out how you'll deal with possible media interest in an incident. Appoint a single company spokesperson to handle questions and try to be positive in any statements you issue. Ensure staff, customers and suppliers are informed before they find out in the media. Finally, make sure hard copies of your business continuity plan are lodged at your home and with your bank and at the homes of other key members of staff. Test Your Business Continuity Plan Once your plan is in place, you'll need to test how well it's likely to perform in the event of an emergency. Although by their nature disasters are hard to simulate in a rehearsal, you can assess your plan against a number of possible scenarios in a paper-based exercise. Think about the things that would cause most disruption and that are most likely to happen to your business. Then make sure that your plan covers each of the risks. Ask yourself the following key questions: Does it set out each employee's role in the event of each emergency? Have you set out the right steps to take? Is the order of the plan correct so that priority actions to minimise damage will take place immediately after the incident? Make some telephone calls to check that the key contacts and phone numbers that you have given are correct. Having to find the right number after a disaster could use up valuable time. Keep Your Plan Updated Remember to update your plan regularly to take into account your business' changing circumstances. If you move into new premises, for example, you could face an entirely new set of risks. You'd need to draw up new maps for the emergency services and amend any contact numbers necessary. You should test your plan regularly, even if your business hasn't undergone significant changes.

6 Examples Check Lists 1. What to do immediately following an incident (if evacuation is needed): Evacuate. Is everyone accounted for? (employees and visitors and myself?). Possibly co-ordinate this with Human Resources or Heads of Departments. Staff list and their contact details. Inform Emergency Services. Listen to radio or TV for advice. Contact emergency services/ local authority for advice. Contact utility companies if needed. Has everyone who is responsible for the business continuity plan been informed? Inform the top of the Staff tree of the incident. Tell non-critical staff to go/stay home. Tell critical staff to get on with their business continuity responsibilities. Establish Staff Information hotline (if organisation large enough). Check that all essentials are accessible (see practicalities for a list of essentials) Begin media / public relations process (if relevant) 2. What to do immediately following an incident (if evacuation is not needed): Is everyone accounted for? (employees and visitors and myself?). Possibly co-ordinate this with Human Resources or Heads of Departments. Inform your staff of incident. Staff list and their contact details. Inform the staff of how it is being dealt with. Inform staff whether they can/ cannot leave the building. Listen to radio or TV for advice (if relevant). Contact emergency services/ local authority for advice (if relevant). Contact utility companies if needed. Has everyone who is responsible for the business continuity plan been informed? Inform the top of the Staff tree of the incident (if relevant) or those not on company premises. Tell non-critical staff to go/ stay home (if relevant). Tell critical staff to get on with their business continuity responsibilities. Establish staff information hotline (if organisation large enough). Begin media/ public relations process (if relevant).

7 3. What to do after the first hour after the incident (if a move to an alternative site is taking place): Check business recovery objectives. Contact alternative site/ site supplier. Check and make arrangements for work area requirements, technology requirements. Check and make arrangements for resource requirements: office equipment, hardware and software, furniture, machinery. Vital records inventory: make sure you have all your contacts, important documents and battlebox items. Is the phone system working remotely from the old site? Is the phone system working on the new site? Test other utilities at the new site to see if they are working. Switch off dangerous utilities at the old site if applicable to the situation. (If not possible, contact utility supplier). Carry out inventory (if possible). Contact insurance company. Contact Vendors (if needed). Check that everyone on the telephone tree has been contacted. Set up a personnel advice line (If organisation large enough). Start/ continue your PR process: check which customers/ suppliers you had appointments with today and tomorrow and contact them to inform them of your situation: reassure them that everything is under control, that your business continuity plan has been put into action, that there will be such and such a delay, but that everything will be fully operational within such and such a date. Continue talking to your staff: reassure your employees that your business continuity plan has been put into action, that some of them need to proceed as previously agreed and that all will be well. 4. What to do after the first hour after the incident (if you are staying in your premises): Check business recovery objectives. Vital records inventory: make sure you have all your contacts, important documents and battlebox items. Is the phone system working? Test other utilities to see if they are working if you suspect damage, contact your respective utilities companies. Turn off gas immediately if you suspect leakage. Are IT systems working? (If relevant). Carry out inventory (if relevant) Contact insurance company (if relevant). Contact Vendors (if relevant). Check that everyone on the telephone tree has been contacted and is aware of what is happening. Set up a personnel advice line (if organisation large enough). Start/ continue your PR process: check which customers/ suppliers you had appointments with today and tomorrow and contact them to inform them of your situation: reassure them that everything is under control, that your business continuity plan has been put into action, that there will be such and such a delay, but that everything will be fully operational within such and such a date.

8 Continue talking to your staff: reassure your employees that your business continuity plan has been put into action, that some of them need to proceed as previously agreed and that all will be well. 5. Contents Of a Disaster Recovery Box (Battlebox) Essentials: Up-to-date copy of your business Continuity plan. Copies of any dormant contracts with external resources such as contractors and copies of employee contracts. Building site plan. Computer back-up tapes/ programming disks. Computer Software and Hardware Inventory. Insurance Papers. Other essential papers, such as Bank details, sales records, gross profit records. Chequebook. Stationary/ Company seals. First Aid Kit. Radio and spare batteries. Copy of a list of to do's immediately following an incident. Copy of a list of to do's past the immediate first hour after an incident. Useful Items: Torch and megaphone plus spare batteries for radio, tape Disposable camera with flash Message pads and flip chart Coloured pens and pencils, chalk A charged-up mobile phone An old-fashioned plug-in phone Dust and toxic fume masks Water/ Food Supplies Waterproof plastic bags Tool Kit (basic tools, gloves, etc) Generator

9 6. Computer Hardware, Software and Peripheral Inventory These will be useful for insurance purposes or when you need to re-purchase items. You should include: Software Vendor or Leasing Company Information, as well as Off-site Data Backup information. Contact details of your hardware vendor/ leasing company, as well as hardware supplier/ repair vendor. Written Down Info on your Peripheral Vendor or Leasing Company, as well as your peripheral Support Vendor info, (These include modems, zip drives, scanners). Company Name Address Telephone No. Account No Contact Name 7. A Description Of Your Premises This should contain information on: Location of the emergency exits. A primary meeting point in case of evacuation A fall-back option if you have to evacuate in a different direction Details of what the premises contain. Information that is important and specific to your premises i.e. storage facilities