August 23, 2004—Three years after 9/11 and one year after the Northeast blackout, nearly a quarter of companies in the United States are conducting business as usual without developing, implementing and testing contingency plans, according to a new study by AT&T and the Partnership for Public Warning.
The study also found that companies in cities now on Orange code alert are only slightly more likely to have plans than companies in lower risk areas.
The report, “Disaster Planning in the Private Sector: A Post 9/11 Look at the State of Business Continuity in the U.S.,” surveyed 1,000 executives from 10 large metro areas—New York/New Jersey, Los Angeles, Chicago, Philadelphia, Washington D.C., San Francisco, Miami, Detroit, Minneapolis and Dallas—with responsibility for their organization’s disaster planning.
More information on the report and an executive summary are available from AT&T.
The survey indicated, surprisingly, that New York and Washington, D.C. were among those least prepared. In both cities, nearly 25 percent of companies lacked a plan. South Florida was the most prepared-only 15 percent of business respondents admitted not having a business continuity plan. Los Angeles came in last, with more than 30 percent working without one. Dallas ranked higher than D.C. and New York, with only 21 percent of Dallas-area companies lacking a plan.
But, says the survey, even those with business continuity plans are failing to test or update them regularly. On a national level, nearly 25 percent haven’t been updated in the past 12 months and more than 40 percent haven’t been tested in over a year.
Apparently in response to this year’s threat levels, companies in New York tended to test and update their business continuity plans far more frequently than companies elsewhere. Nearly 90 percent of New York companies have updated their plans while less than 70 percent of South Florida companies have. And nearly 80 percent of New York companies have tested their plans in that time period, while only 50 percent of South Florida companies have.
Of the 1,000 companies interviewed, nearly 200 of them suffered a disaster resulting in business disruption, causing several to lose as much as a million dollars a day during the interruption. But nearly 20 percent of companies that had suffered interruptions still took no actions to reduce their impact in the future. More than 75 percent of those companies failed to improve their plan, or develop one if they didn’t have one previously, after the disaster.
“The goal of any good business continuity plan is to avoid down time,” said Eric Shepcaro, AT&T’s vice president of business strategy and development. “And in an economic environment such as this, any disruption can cripple a company, sometimes for good.”
According to Shepcaro, continuity plans must specify redundant systems, back-up sites and alternative work sites. They also must include a process for maintaining customer and employee communications immediately after the disaster and until things are back to normal.
The survey indicates 40 percent of companies have neglected to establish redundant servers and/or backup sites. On the other hand, 25 percent said they added alternate power sources and 15 percent said they upgraded their telecom systems.
Shepcaro said one of the reasons company executives cite for not developing their business continuity plans is the difficulty of the process. “They believe developing the right plan can be too complicated, too costly and too lengthy a process,” he said. “But there are many things they can do with minimal effort, right away, before disaster strikes.”
At a minimum, Shepcaro says all companies should develop a plan to communicate with employees and customers while a company is experiencing a disruption. This can be as simple as keeping emergency contact lists in a safe place at home, and making sure there’s a way to keep customers up to date on the company’s progress in getting back to business.
An increasing number of companies today are turning to experts to handle business continuity planning. According to the study, nearly 35 percent of companies now use a service provider for business continuity needs. In fact, among firms where business continuity is a priority, nearly 50 percent are currently using an outsourcing service. Companies in New York and Washington are the most likely to use service providers.
Shepcaro advises that all companies, large and small, begin the planning process by identifying their critical business components and managing the risks around them.
