Learning Lessons from Hurricane Sandy

  Learning Lessons from Hurricane Sandy

Having a business continuity/disaster recovery plan in place before a disaster
                             hits can be critical

Business Wire

TORONTO -- November 14, 2012

Hurricane Sandy left a trail of destruction on the Eastern Seaboard and, two
weeks later, some communities are continuing to struggle. Some have suffered
devastating personal loss and many businesses have been severely disrupted.
Canadian businesses that have customers or suppliers in the affected
areas—including IT service providers or call centre services—have been

For most, the primary concern during any natural disaster is ensuring the
safety of your family and home. Fortunately most Canadians escaped unharmed by
Hurricane Sandy, but many will have experienced the last-minute panic of
trying to buy essentials like bottled water and flashlights before the storm
hit, only to find store shelves were already cleaned out as people scrambled
to prepare. This is a good reminder of why it is so important to have a plan
in place before an emergency hits.

But it’s not just individuals and families. Business owners need to make sure
they have a plan, too. Though rare, businesses also come face-to-face with
communication systems outages, fires, earthquakes, floods, tsunamis, ice
storms, blackouts and even terrorist events.

Businesses need to maintain and recover critical business information and
minimize the impact on their day-to-day operations in the event of an
unforeseen occurrence. Some businesses that fail to plan for disasters may
even go out of business within a year or two of a disaster striking, while
others can lose significant revenue or market share. Business must ask
themselves how long they can survive if their doors are closed or their
systems are down.

Business owners and managers should start by being able to identify their
critical business processes and dependencies, assess the impact of a
disruption (both internal and external), and then prioritize processes for
continuity and recovery. A good recovery plan must also consider things such
as ensuring the safety of personnel, the impact of the disruption of
transportation, establishing and testing alternative ways of getting the job
done for the most important business processes and systems, the protection of
important paper and physical assets, site recovery and alternative office
space, and the loss of key vendors.

And although it’s natural to think about problems related to the physical
location of a business during a disaster, what if something happens to the
data or IT infrastructure? We’re living in an increasingly digital world in
which IT applications and infrastructures are moving to a virtual rather than
physical platform. While cloud computing is on the rise, a recent study showed
that only 24% of survey respondents are using the cloud for backup and
disaster recovery.^1

Once a Business Continuity and Disaster Recovery Plan is established, it must
be a living document that is tested regularly. Will the backup power systems
work? (New York’s University Langone Medical Centre had to evacuate all 215
patients when BOTH back up power generators failed during Hurricane Sandy.)
Has the data been properly backed up? (It’s estimated that nearly a quarter of
all data backups are not complete.) When things go wrong, who is in charge,
and who is on the response team? (In an interview with the BBC, ousted British
Petroleum CEO Tony Hayward stated that his company was caught flat-footed when
the oil spill disaster began in April 2010, saying “BP’s contingency plans
were inadequate. We were making it up day-to-day.”) What about your customers
and stakeholders—what will their needs be, and can you deliver?

There’s no way to completely insulate a business from every disruption or
disaster, but the right plan can go a long way towards ensuring things go as
smoothly as possible when the unexpected happens. Business Continuity and
Disaster Recovery Plans can help to reduce potential financial losses, legal
liability, and increase organizational stability and orderly recovery. The
right plans can even lower the possibility of a disaster event occurring and
decrease “outage” time. Businesses everywhere would be wise to use the lessons
of Hurricane Sandy to spur them to look at their own preparedness.


1.First and foremost, have a plan for keeping your employees safe. Establish
    a central meeting point in the event of an evacuation of your premises. Do
    a dry run.
2.Keep the basics in good working order. Just as you change the batteries in
    your home smoke detector twice a year when you change your clocks, run
    through a checklist for the business. Make sure that the fire detectors
    work, check that the “uninterruptible power supply” (UPS) really does kick
    in, and try restoring the offsite data backups to ensure you have the data
    you need to run the business.
3.Plan for effective communications in a crisis. Make sure you have a clear
    employee communication plan, including a phone tree with everyone’s
    personal contact information. Have a plan for how you are going to deal
    with shareholders and media.
4.Protect hard copies of business critical documents in storage cabinets
    that can withstand physical damage to your premises. Archive critical
    documents in a second, secure location.
5.If you have outsourced important business processes, ask your service
    provider about their disaster preparedness. Ask how you can ensure you are
    going to get the attention you need when you really need it.
6.Establish a plan for re-locating the business in the event that the
    premises are temporarily disabled. Develop a check-list of things you’ll
    need (desks, chairs, phones, printers and storage space for salvaged
    inventory) to get a skeleton staff up and running quickly.
7.Remind your staff to take their laptop home every day, particularly if
    there’s a chance that the office will be closed. Ensure that they all know
    how to log into the office LAN (or alternate system if your premises are
    hit) and that they have their passwords in a safe place.
8.Buy a backup generator for the office and ensure employees know how to use
    it safely.
9.Build a recovery plan on the assumption that a third of the staff won’t be
    available. If a serious disaster hits, like Hurricane Sandy, people are
    going to focus on the safety of their home and family—not your business.
    You would, too!
10.Once the crisis plan is developed, test it at least once or twice a year.
    Just like fire drills, the real value of the plan comes when employees
    have experience with a dry run before the real thing hits. Practice today
    so that employees aren’t doing it for the first time under the stress of
    an emergency.

To learn more about how businesses can better prepare for the unexpected,
Chris Anderson, CA and Partner in Grant Thornton LLP’s Business Risk Services,
is available for interviews.

About Grant Thornton LLP
Grant Thornton LLP is a leading Canadian accounting and advisory firm
providing audit, tax and advisory services to private and public
organizations. Together with the Quebec firm Raymond Chabot Grant Thornton
LLP, Grant Thornton in Canada has approximately 4,000 people in offices across
Canada. Grant Thornton LLP is a Canadian member of Grant Thornton
International Ltd, whose member firms operate in close to 100 countries

^1 The Acronis Global Disaster Recovery Index, 2012


Grant Thornton LLP
Tania Freedman, +1 (416) 647-2745
Senior Manager, Media Relations
Press spacebar to pause and continue. Press esc to stop.