In the first of two articles about business continuity management, Jillian Simms outlines the basic procedures law firms need to follow when faced with disruption to the workplace




Alongside Lexcel, some kind of business continuity is now required of law firms under the new Solicitors Code of Conduct. Business continuity management (BCM) is a core part of this, as it is the process of ensuring that an organisation can continue to provide at least the minimum acceptable level of service, whatever the circumstances.



It is no longer acceptable to be unavailable or unable to complete a transaction owing to a disruption of a working location.



For most lawyers, the provision of advice and support to clients is the focus of their work, but they are unaware how this would be provided if their place of work were unavailable. Issues such as transferring incoming telephone calls, maintaining client confidentiality and managing documentation all need to be addressed if an organisation is to protect its reputation and maintain its revenue.



During the recent floods in the UK, numerous offices and homes were disrupted. However, one sole practitioner I know who worked from a home office commented on how worthwhile it was that she and another sole practitioner had established a process of emailing a password-protected list of their current clients to each other at the end of each week. Even though her normal working location was disrupted, she was able to contact her clients, update them on her situation, and provide confidence in her management of their affairs.



Business continuity arrangements have to be appropriate to the size and complexity of the organisation. When establishing business continuity, it is essential to understand what the organisation does and what level of disruption can be tolerated. In other words, the organisation needs to evaluate the minimum level of service that would be deemed acceptable and how it can best ensure that this minimum level is always reached.



We have recently been involved in looking at business continuity for two similar-sized organisations. Both employ around 50 people in three offices, with the IT based in the head office.



The first firm asked us to facilitate a partners' meeting to discuss business continuity. This meeting resulted in detailed discussion about the firm's priorities at the time of a disruption, how quickly their clients would expect them to be working, what IT would be needed, and how much they should spend.



The second firm delegated business continuity to the IT and facilities manager. He decided that the firm should back up the IT and subscribe for desks at an alternative working location, but was unclear about how quickly back-up IT needed to be operational and how many desks were required. He asked our advice about the industry standard, but was loath to ask any of the partners for an opinion.



Needless to say, the former organisation now has an effective business continuity plan, and the latter is left with the IT and facilities manager still trying to justify the cost associated with his proposed solution.



Crisis management

Once a firm has appreciated the need for BCM, it must look to complete three key stages of work. The first stage, which should be established immediately, is crisis management.



This is the procedure for decision-making and communication at the time of disruption. There is no point in spending on contingency arrangements if there is no procedure to decide when to use them. When an office is evacuated, sometimes people will be able to return to their desks within an hour, but at other times alternative arrangements need to be invoked. Often the right thing to do is not readily apparent - but decisions have to be made. Crisis management is the process by which a firm ensures that key individuals know how to gather information so that the situation can be assessed. These individuals are empowered to make the decisions and these decisions are efficiently communicated.



Recovery planning

The second stage is recovery planning, which is the establishment of contingency arrangements that enable the firm to cope at the time of disruption. These arrangements may include alternative working locations, alternative IT facilities, reciprocal agreements, procedures for postponing non-critical work and other arrangements for use at the time of disruption.



Business resilience

The third stage is business resilience - minimising the likelihood of disruption. All firms should continually assess the risks associated with how and where they conduct business, and do as much as possible to prevent a disruption. For example, the working location should be well maintained and only accessible by appropriate people. Critical documentation should be stored securely and scanned wherever possible and IT equipment should be in a suitable environment.



BCM is good business practice. It enables a firm to be confident that its reputation will not be damaged by a disruption to the working environment. This article has considered what BCM is and why it is needed. In next week's article, we will look at some practical ways of implementing and embedding it into all organisations, both large and small.



Jillian Simms is a director of Cornwood Risk Management. www.cornwood.co.uk.