Business continuity planning covers a vast territory, from the normal type of disruption that can affect any IT installation, to the most terrifyingly abnormal disruption caused by terrorism or natural disaster.
However accustomed people are to scenes in the media of horror caused by terrorism and natural disaster, when it happens to you it is totally different, says Poli Avramidis, director of information management and technology at the British Medical Association (BMA), outside whose headquarters a bus exploded in the London terror attacks on 7 July.
Fortunately, among the 450 people in the BMA building - including 150 working for the British Medical Journal (BMJ), commercial tenants and a branch of the Natwest Bank - were doctors.
"They were the first on the scene and saved at least two lives with prompt treatment," says Avramidis.
Others were less fortunate. "Among the 14 who were killed by the explosion, two victims died in our courtyard. The meeting rooms on the ground floor became a treatment and consulting area," he says.
The explosion penetrated the BMA's offices on the lower floors of the building.
"The front of our building looked like a war zone," says Avramidis. "We evacuated staff from the back following instructions from the police. In such a state of shock, fear and distress, with some staff injured from blast-shattered glass, no one could care less about business continuity. Everyone just wanted to phone home and find out what was happening. There was chaos and confusion for half an hour, but within an hour we had got into shape and invoked the business continuity plan."
That the BMA had a plan at all was largely thanks to Avramidis.
"The BMA is 173 years old and we had never had a disaster," says Avramidis. "I had to convince the board of the case for a continuity plan for IT and the rest of the business, which was agreed this year. We had signed off the contract two days earlier, on 5 July, planning to test it in August."
Instead, the plan was tested for real. "The building was sealed off by the police for two and a half hours to allow for the injured to be treated, but then I was allowed in. We had to do everything under pressure - and with fragments and the remains of a major incident in the courtyard waiting for forensic examination.
"We checked our IT infrastructure and it was intact - we had one comms centre at the front of the building where the blast had hit, but it had not been damaged. For five hours, between 2pm and 7pm, we ran our operations from the BMA's other premises in Purley and our call centre in Glasgow," says Avramidis.
"Some things had to run. Our mission-critical IT goal was to ensure that the BMJ, which has never missed an issue in 160 years of publication, and the BMJ Careers journal, which generates a third of BMJ income, met their deadlines. We also had to run payroll, as well as sort out how we communicated with our staff, the members, our suppliers and the media."
Despite the psychological stress of coping with the trauma of what had happened, together with the physical difficulties caused by the BMA remaining an official crime scene for 12 days, and therefore sealed off to normal access, everything went to plan, according to Avramidis. "We met our publishing deadline and there were no financial losses. Only a few projects were delayed for a short time," he says.
In retrospect, Avramidis feels the evacuation procedure could have been better, as could business planning for the immediate aftermath.
"Since the attack we have presented the lessons we learned to the board in a thorough report and conducted a questionnaire among staff to gather their experiences and thoughts, in order to make our long-term recommendations. We still have staff off on long-term sick leave, and a few are receiving counselling. But business goes on, and we pulled through."
- Ask how your organisation would fare if significant numbers of employees were unable to get into work
- Set up procedures to identify staff who might be affected by such an event
- Ensure you can communicate through multiple channels with your staff. Remember that cellular phone networks are usually ineffectively around the immediately affected area and may get overloaded
- Develop a crisis management capability and establish who will make decisions
- Develop succession plans and cross-train people appropriately
- Ensure people can work from home or alternative locations.
What to do when chaos erupts
- A continuity plan is essential to identify which systems are most important at any given time. It should list which people need to be in place and alternative processing and communication sites
- When people are dying and critically injured, the absolute priority is protecting human life
- Evacuation plans and practice are essential
- Allow for extreme chaos and confusion in the immediate aftermath, plus prolonged classification as a crime scene
- It is vital to know how to contact staff, and how they can communicate with their families, especially when mobile networks are stressed or shut down
- In the aftermath, the emotional fall-out will continue, with staff on sick leave or requiring counselling
- Debrief staff and gather their experiences and input
- Consult with senior management for long-term recommendations.
Integrating natural disaster planning into your BC/DR plan