Manager's Guide to Contingency Planning

MANAGER'S GUIDE TO CONTINGENCY PLANNING FOR DISASTERS:
PROTECTING VITAL FACILITIES AND CRITICAL OPERATIONS
2ND EDITION
by Kenneth N. Myers

“With the increased dependency of modern corporations on computer technology
and special-purpose facilities, contingency planning is a rising priority on the agenda of
senior management. This book provides cost-conscious executives with a structured
process to address contingency planning needs. It provides guidance in approving and
allocating funds for plan development and various methods and procedures as well as
standards of performance.”

“With the help of an implementation strategy, guidelines minimizing development
costs, and insight into a proven development methodology, Manager's Guide to Contingency
Planning for Disasters: Protecting Vital Facilities and Critical Operations helps you to:
- Establish a corporate contingency plan policy and strategy that ensure timely
completion of a plan with minimal disruption
- Minimize plan development costs
- Understand the importance of conducting briefings to communicate the proper
mindset before the plan development process begins
- Save time and money by avoiding the consultant's traditional approach of
extensive information-gathering that contributes little to the development of practical
solutions.

“Remember that you have good people on your management team who don’t
need a lot of detailed instruction on how to do things in an emergency situation. Precisely
"how" they do anything will depend on the specific nature of the disaster and the extent of the
damage. Addressing complex hypothetical disaster combinations does not make good
business sense. Just prepare "what if" strategies for a worst case and rely on the judgment
of your line managers to cope with less severe incidents.

“As businesses grow more aware of the need to provide some level of protection
against an unplanned disaster, management needs to know how to structure such a strategic
planning project so that it is completed quickly and with a minimal disruption to operations.
Managers need to develop business continuity strategies that will enable the organization to
retain market share, service customers, and maintain cash flow if a disaster does occur.

“Kenneth N. Myers... now provides you with a time-tested contingency planning
philosophy, an implementation strategy, and a plan development methodology that matches
the low probability of a disaster with the need for low-cost solutions. While other books offer
complex and detailed approaches that are difficult to understand and even more costly to
implement, Manager's Guide to Contingency Planning for Disasters: Protecting Vital
Facilities and Critical Operations presents an unusually straightforward format that deals in
"what if" strategies instead of inordinately detailed procedures. It also emphasizes strategies
to maintain business continuity, regardless of the cause of the disaster.

“Myers lays the foundation by prompting you to document a corporate contingency
planning policy and strategy in writing before delegating the project to anyone. Solidifying
and documenting a contingency planning policy and strategy is, in Myers's words, "the key
to
containing development costs and to completing the project on time." He also stresses the
importance of documenting the assumptions on which a plan is to be based to prevent
“witch-hunting" during plan development.

“What's more, you'll learn that losing the computer system is probably not your
most serious threat; losing vital buildings or critical production operations pose much more
serious problems. And you'll also learn that, contrary to popular belief, risk management
programs and emergency response plans should not be developed first, but only after "what
if" departmental business continuity strategies are documented.

“The first step is using a "worst case" scenario to cover various disaster
possibilities and their impact on your ability to service customers and maintain market share
following a physical disaster. Most computer systems can be restored in an alternate
location, without the costly expense of computer hot-site agreements, within ten working
days. Developing “what if” strategies for continuing to ship products is the real challenge.

“In a highly competitive world where vital buildings and critical operations are
essential for business continuity, your company must have a strategic plan for coping with
unplanned disasters that could suddenly threaten its survival. Manager's Guide to
Contingency Planning for Disasters: Protecting Vital Facilities and Critical Operations
presents a time-tested approach that helps you do just that.”

- - - - - - - -
-

CONTENTS

PREFACE

1 INTRODUCTION
MANAGEMENT'S RESPONSIBILITY
HOW MUCH MARKET SHARE WILL IT COST YOU?
PROTECT AGAINST WHAT?
CONTINGENCY PLANNING REQUIRES SPECIALIZATION
INCREASED TECHNOLOGY DEPENDENCY
Foreign Corrupt Practices Act
Interpretation Problem
CORPORATE ISSUE
DISASTER LIFE CYCLE
Risk Management Program
Emergency Response Plan
Business Continuity Strategies
DISCRETIONARY EXPENSE

2 DEFINING THE PROBLEM
BUSINESS CONTINUITY CONCERNS
Telephone Communications
Computer Processing
Vital Facilities
Only a Computer Recovery Plan
Present Plan May Not Work
CHARACTERISTICS OF A SOUND PLAN
COST-REDUCTION OPPORTUNITIES
How to Contain Plan Development Costs for New Plans
Where to Look for Cost Reductions in an Existing Computer Disaster Recovery Plan
Audit Concerns Involving Department Managers
NEED FOR COST-EFFECTIVE SOLUTIONS
BACKUP

3 AWARENESS AND EDUCATION
BUSINESS AND ENVIRONMENT
TYPES OF DISASTERS
POTENTIAL IMPACT ON BUSINESS
Computers
Remote Data Communications
Voice Communications
Vital Facilities
Loss of Efficiency
PLAN OBJECTIVES
Safeguard Assets
Prevention
Organized Response
Business Continuity
Cash Flow, Customer Service, and Market Share
INSURANCE CONSIDERATIONS
Insurance Policy versus Disaster Recovery Plan
What Impacts Insurance Premiums
HOW MUCH DETAIL?
ESTABLISHING A FIRM FOUNDATION
KEY RESULT AREAS
Approval
Flexibility
Maintenance
Cost Effectiveness
Business Continuity
Organized Response
Responsibility
Testing
CONVINCING OTHERS
Organizational Needs
Personal Needs
Selling Process
EXECUTIVE BRIEFINGS
Corporate Contingency Planning Policy and Strategy
Disaster Recovery Life Cycle
Risk Management Program
Emergency Response Plan
Business Continuity Strategies
Corporate Concerns
Departmental Issues

4 PROJECT PLANNING
POLICY AND STRATEGY
LIMIT SCOPE
Which Types of Disasters?
How Wide an Area?
Individual Business Units
LIMIT THE TIME PERIODS
SURGICAL PROCESS
GAM E PLAN
Establish a Corporate Contingency Planning Policy and Strategy
Select a Plan Development Methodology
Communicate Corporate Contingency Planning Policy and Strategy
Develop "What If" Business Continuity Strategies
TEAM CONCEPT
Organization Chart
Telephone Directory
Auditors' Comments
PROTOTYPE PLANS

5 BUSINESS IMPACT ANALYSIS
OBJECTIVE
WHAT IS REALLY CRITICAL
A Word of Caution
AWARENESS AND EDUCATION
Mindset
Education
Cost
REGULATORY AGENCY REPORTING REQUIREMENTS

6 IMPLEMENTATION STRATEGY
TAILOR PRESENTATIONS
ROLE OF SENIOR MANAGEMENT
ROLE OF A STEERING COMMITTEE
ROLE OF DEPARTMENT MANAGERS
ROLE OF FIRST-LINE SUPERVISORS
ROLE OF OUTSIDE SPECIALISTS
DEVELOP PLAN WITH FIRST-LINE SUPERVISORS
How Long Can You Do Without?
How Would You Survive?
Industry Examples
OBTAIN DEPARTMENT MANAGERS' APPROVAL
Present Findings
NONCOMPUTERIZED BUSINESS FUNCTIONS
Telephones
Buildings

7 PLAN DEVELOPMENT: THE MYERS PROCESS
PHILOSOPHY AND METHODOLOGY
Why It Has Worked
SETTING THE STAGE FOR SUCCESS
PLAN REQUIREMENTS
Prevention
Recovery
Accountability
Audit
PLAN DEVELOPMENT STEPS
KEY TASKS
Focus on Essential Business Functions, Not Technology
Protect Ongoing Needs
Emphasize the Low Probability of a Major Disaster
Link Low Probability with the Need for Low-Cost, Simple Solutions
Analyze Alternate Business Continuity Strategies
DEVELOPING "WHAT IF" BUSINESS CONTINUITY STRATEGIES
Identify Vital Records
Evaluate Alternate Operating Strategies
Finalize Alternate Business Continuity Strategies
Obtain Department Managers' Approval of Alternate Business Continuity Strategies
COMPUTER PROCESSING ALTERNATIVES
Accounts Payable
Accounts Receivable
Billing
Cost Accounting
Customer Service
Engineering
Fixed Assets
General Ledger
Human Resources
Inventory Management
Material Requirements Planning
Order Processing
Payroll
Production Scheduling
Purchasing
Receiving
Shipping
DOCUMENTATION
Policy
Strategy
Executive Summary
Risk Management Program
Emergency Response Plan
Stabilization Period
Maintenance, Preparedness Reviews, and Testing
COST BENEFITS
Lower Plan Development Costs
Lower Backup Communications Costs
Minimization /Avoidance of Back-up Computer Subscription Fees
Lower Plan Maintenance Costs
Lower Testing Costs
CORPORATE BENEFITS
Sound Strategy for Plan Development
Focus Is on Keeping the Business Running
Auditors Are Supportive Sponsors
Resolves What Is Critical

8 MAINTENANCE, EDUCATION, AND TESTING
OBJECTIVES
MAINTENANCE
Normal Operations
Emergency Response
"What If " Business Continuity Strategies
CONTINUING EDUCATION AND PREPAREDNESS REVIEWS
Planning
Examination
Education
Feedback
TECHNOLOGY TESTING
Planning
Conducting the Test
Feedback Summaries

9 GUIDELINES FOR INTERNAL CONSULTANTS AND CONSULTING FIRMS
BACKGROUND
OBJECTIVES AND SCOPE
SECTION I: ORGANIZATION
Placement of the Contingency Planning Activity
Organizational Functions
SECTION II: STANDARDS FOR IMPLEMENTATION PLANNING
Methods Standards
Performance Standards
SECTION III: STANDARDS FOR DEVELOPING BUSINESS CONTINUITY STRATEGIES
Methods Standards
Performance Standards
SECTION IV: DOCUMENTATION STANDARDS
Methods Standards
Performance Standards
SECTION V:- STANDARDS FOR ONGOING MAINTENANCE AND TESTING Methods
Standards
Performance Standards

APPENDIX A: Case Studies
APPENDIX B: Sample Computer Contingency Plan
APPENDIX C: Sample Business Continuity Strategies
GLOSSARY
INDEX

- - - - - - - -
-

ABOUT THE AUTHOR

“KENNETH N. MYERS is an internationally recognized contingency planning
specialist. Since 1972, he has been President of K. N. Myers & Associates, Inc., in
Annapolis, Maryland, and has prepared disaster contingency plans for leading organizations
throughout the United States, Europe, Mexico, and Puerto Rico. He has appeared on the
Financial Management Network's Business Tonight and is featured in continuing education
segments for the Financial Management Network. Mr. Myers developed curriculums for
disaster recovery planning seminars for the Battelle Institute and the American Management
Association and was called to New York to consult with the largest tenant in the World Trade
Center following its bombing. He is also the author of the first edition of this book, Total
Contingency Planning for Disasters: Managing Risk... Minimizing Loss... Ensuring Business
Continuity.”

- - - - - - - -
-

1999, 256 pages. Order #DR434.

4 Arapaho Rd.

Brookfield, CT 06804-3104 USA

1-888-ROTHSTEin; (888.768.4783)

Telephone: 203.740.7444; 888.768.4783

Fax: 203.740.7401

"Keep Me Posted" Business Survival Newsletter