Legal Matters | Archive

Company responsibility in the wake of disaster

by David Zerbee
for Virginia Business
December 2006

Today, more than at any other time in history, we are faced with crises that have the potential to interrupt our businesses.
Events of terrorism and major natural disasters have been devastating to business. In these situations, assistance to the affected people is paramount, but it is also important for businesses to be able to continue in the wake of such crises to help provide the necessary goods and services to those affected. Do companies bear any responsibility to continue business following crises? What should business owners do proactively to prepare for these pending emergency situations?

No matter what size or type of business, they are all susceptible to emergency situations and unplanned outages. Whether it is a severe weather incident that shuts down a city or region or a simple mistake like kicking a power cord loose causing a server to halt, every business can face some form of outage or disaster. Most businesses cannot afford to be down for hours - let alone days - without suffering loss. At best, you could expect to incur some financial loss and have to assuage unhappy customers. At worst, your business could be forced to close. On average, more than 40 percent of businesses without disaster recovery - or business interruption - plans fail after major emergencies. Having an effective plan to reduce your company's potential liability will assist you to rebuild and protect your business assets. This article addresses a company's potential liability and considerations for an effective disaster recovery plan.

Potential liability
Today, there is a wide array of regulations requiring regulated and publicly-traded companies to develop and maintain disaster recovery plans. The Patriot Act, Vital Interdiction of Criminal Terrorist Organizations Act, HIPAA and privacy regulations have far-reaching impact. Sarbanes-Oxley is another significant piece of legislation that is still being sorted through by regulators, auditors and management. Although some of these regulations don't directly apply to private business, there are many circumstances - primarily as a result of a company's inability to perform after a business interruption event - that may give rise to company liability. These include:
- Loss of key employees, computer systems and records;
- Degradation of company's competitive position;
- Company's inability to comply with contractual obligations;
- Imposition of fines, penalties and/or legal costs;
- Interruption of critical supplies; and
- Interruption of product distribution

If a company lacks an effective disaster recovery plan, it is likely that it hasn't put much thought into the options it has and remedies it can affect in an emergency. As a result, it will not have the tools to take quick action to recover its footing.

Components of an effective disaster recovery plan
Your recovery plan should be a broad-based document covering details that are company-wide in scope. The primarily elements of an effective disaster recovery plan will address in detail these items:
- Protecting life;
- Minimizing risk to the company;
- Recovery critical computer applications and records;
- Safeguarding against litigation and shareholder suits;
- Protecting competitive positions; and
- Preserving customer confidence.

At the foundation of all sound disaster recovery plans is the ability to quickly restore a company's critical computer data, programs and records. Whether you use new sophisticated backup software that allows you to immediately recover data electronically from off-site storage centers, or use tapes that are stored off-site, having the appropriate tools available to quickly restore systems and records is essential for the company's continued viability.

Disaster recovery planning is not just for the large corporation; it is for everyone. By investing a little time on a disaster recovery plan you can help ensure that your business will be back up and running if you should experience a disaster. A disaster recovery plan is like catastrophic health insurance for your business - while you hope you will never need it, you can not afford to do without it.

Summary
Disaster recovery plans are complex and multi-faceted. For this reason, do not hesitate to seek outside help.

In today's world of increased liability and competition, disaster recovery plans are essential. They can make the difference between reasonable planned liability and negligent exponential liability, accompanied by damaging public relations. This can easily be the deciding factor in the very survival of your business.