White Papers | Business Continuity Essentials For Law Firms
With the beginning of the 2006 hurricane season just weeks away, law firms throughout the Gulf Coast region are gearing up for what some predict will be a ferocious few months. This year's hurricane season, which begins June 1 and will last until November, is expected to be intense.
Studies show that the majority of businesses have taken action to minimize the impact of a potential disaster on their business operations. Still, a sizable percentage has failed to embrace business continuity planning. In the legal sector, business continuity planning is even more important.
If the operations of a law firm are interrupted, it can have a profound ripple effect. For instance, if a law firm that is representing a company in a merger experiences a fire or other prolonged business disruption, it could derail the client company’s merger.
Any interruption of a law firm’s operations can have a severe negative impact not only on the law firm, but on every company the firm is representing.
Knowing their vulnerabilities, some law firms in hurricane-prone areas have made significant investments to outfit one or more remote global data centers, which are designed to be disaster-proof. Often located in areas that are less prone to weather-related disaster, these facilities warehouse the firm's e-mail, billing, electronic case files and other information.
While off-site data centers are worth considering for very large law firms, that type of infrastructure may be over-kill for the vast majority of law firms. It can be a significant monetary investment, particularly if other, less costly methods of data protection do an adequate job.
Many law firms use tape backup and have a protocol that calls for taking tapes off-site. This approach can be sufficient, as long as the firm understands and accepts that in a real disaster, their data may be recoverable, but their business processes almost certainly will be interrupted for a period of time if they need to secure usable space, acquire and install replacement hardware and restore the tapes.
It’s a trade-off, and as is the case in all risk management, the firm needs to assess their vulnerability, consider the costs of the various levels of preparedness and then decide what amount of disruption of their normal operations could be acceptable, if any.
Here are some basic recommendations:
1. Double-check the backup. Make sure the backup system your firm is using is working correctly.
2. Accessibility is key. Implement a process that ensures that the most recent tapes are removed from the office and stored in a place that is secure and accessible in the event they’re needed. We know of a firm that stored its backup tapes in a bank vault, but the vault was in an underground tunnel system. When Tropical Storm Allison inundated Houston, the tunnel system was flooded and the tapes weren’t accessible for recovery.
3. Think creatively. You don’t need to maintain an off-site data center to keep your data off-site. Put your most recent tapes in an envelope and overnight them to a relative outside the danger zone with instructions.
4. Remember redundancy. Not only is it a good idea to have multiple tapes, it’s also a good idea to make sure multiple people know where the tapes are being sent and/or stored. It’s possible that the firm’s personnel could be affected by a disaster, so having a single human repository of information is asking for trouble.
5. People come first. It doesn’t really matter how much you spend and what you do to secure your data if you haven’t adequately considered what the firm will do about its personnel. Put processes in place through which the firm’s attorneys and staff can reconnect in the wake of a disaster. It can be Web-based or over the phone. For instance, some Gulf Coast employers used toll-free numbers that relayed messages to employees regarding their status and what employees should do. This also enabled employees to communicate where they were and how they could be contacted.
6. Understand that employees won’t be focused on the firm. When a disaster strikes, employees will be focused only on survival. Therefore, the steps for rapidly getting a firm up and running again need to be in place in advance.
7. Be flexible. In developing a plan, you may envision how a scenario will unfold, but that vision may prove incorrect when put into practice. Have options available and be prepared to use your options when necessary.
8. Have realistic expectations. If you are operating in a recovery mode, don’t expect your firm to operate with the same productivity and under the same procedures it has on a normal workday.
9. Establish responsibilities. Develop an organization chart for use in a disaster and make sure everyone knows their role. Don’t expect the managing partner or business manager to be solely responsible for the firm’s recovery. It can be a long tough, demanding job so share the load among several people and empower them to take action.
10. Consider the way your staff currently works. If your centralized physical file is still your best source of critical case information, the firm is extremely vulnerable. Going forward, it is essential that law firms adopt work processes that aggregate electronic firm data more closely aligned to what currently exists in the physical file. This is the first step in effectively moving to a full electronic platform that can be protected in the event of a disaster.
Some consultants suggest that law firms set aside up to 10 percent of their annual budgets on disaster plans. Unfortunately, this type of guidance may contribute to the reticence among many managing partners to embrace business continuity planning as essential. It’s difficult to set aside that much money on something that may or may not occur.
However, the amount of money a firm invests is not as important as the amount of time it invests. Firms that spend time considering and establishing standards for how to preserve, protect and then restore their data will be the ones that recover most quickly. The firms that establish methods for how employees can check in and perhaps enable employees to function temporarily from virtual offices will be able to restore client service rapidly.
If, as is being predicted, this year's hurricane season will be intense, law firms also need to consider contingencies for the unexpected. Employees may not be able to get to the office because of gas shortages or they may need assistance with bare essentials, such as housing, transportation and electricity.
It’s very possible that restoring your firm’s operations becomes a relatively low priority in the bigger scheme of things.
And that’s perhaps the greatest benefit of spending the time focusing on business continuity for your law firm. It helps you realize that the most important thing to protect – the thing on which your organization depends more than any other – is not your data, but your people.
