Business continuation planning (BCP) is being addressed by many law firms.  Some firms are doing a good job of developing complete plans that focus on all areas of the firm, and others are not.  Generally, when firms are falling short in the development of complete business continuity plans, it is because they are not addressing all of the areas they should or they are missing the key success factors for BCP.   Some of these key success factors follow.

Don't Write the Plan Until You Have First Developed the Strategy for Your Firm
Many firms make the mistake of trying to write the plan with all of the details before they have thought about their overall business continuity strategy.  The first step in developing the plan should be to develop a strategy.  Strategy issues include:

• Will you use a vendor backup site or an internal backup site (an office in a multi-office firm)?
• Will your backup site serve technology purposes only, or will workspace for attorneys and others be included?
• Will your backup site be a hot site, warm site or cold site?
• What is your tolerance for disruption?  How long can critical functions and systems in the firm be unavailable before they must be reestablished?  For example, how long can your firm be without a litigation support system before a backup approach must be implemented.
• Who is responsible for each part of the plan?

Absent first developing the strategy before the plan, firms have found they bog down in details and can't get through the process.

Business Continuity Planning Should Be Firmwide
Too often, firms focus on BCP as a technology issue.  While technology is a critical component of almost all aspects of law firm operations including BCP, it is not the only area that should be addressed.  BCP should be firmwide and address all aspects of firm operations including:

• Health, life and safety
• Human resources
• Docketing and conflicts
• External communications (clients, courts, agencies)
• Records management
• Finance and accounting
• Practice support functions
• Internal communications
• Facilities

In order to develop an effective business continuity plan, representatives from all of these, as well as other key groups within the firm, should be included in the planning process.  Typically, the planning for each of these areas should include the directors and managers of these departments such as the CFO for the finance and accounting areas.

Stakeholders Should Include Senior Management
Business continuity plans are all too often developed in firms without the support of and input from senior management.  While a plan might result from the process without this involvement and input, it is highly likely in these situations that the plan will languish, never to be relied upon, implemented, tested or updated.  You should ensure that the members of the senior management are on board with the development of the plan, that their input for the plan is received and that they support the plan that is developed.  They should communicate their support for the plan to the firm.

One effective way to accomplish this to have a BCP committee or task force established that includes members of senior firm management as well as key administrative department leaders.  While senior firm management should have plan oversight, they would and should not have to put in as much time as other members of the group in developing and reviewing the plan.  In most firms, the executive director or a senior administrator should lead this group with some level of involvement by the managing partner or someone in a similar role.

Include Risk Avoidance in Your Planning
Many firms only focus on how to react if there is a disruption.  These firms do not adequately focus on how to avoid or minimize the risk of a disruption.  Some steps that you can take to accomplish this include:

• Obtain access to backup power.  There are firms that have obtained the ability to use some of the electricity generated by the backup generator in their building and even others have obtained their own generators that they can use to cover some of their power needs, such as their operations centers and some workspace (don't forget your phone system).
• Maintain adequate system security, including virus protection.
• Plan for and monitor environmental controls.
• Maintain reasonable system redundancy, including having multiple paths to the Internet.
• Maintain an adequate inventory of spare hardware so that if you do lose a critical component you will have a replacement on hand.
• Establish and follow "best practices," such as in the area of change control.

Many disruptions that have occurred in firms could either have been avoided or their impact on the firm could have been reduced.  Risk avoidance is critical and is a good first step in BCP.

Establish Priorities
If a disruption occurs, it is unlikely that you will be able to deal with all of the issues that need addressing; thus as part of your planning process you should set priorities for where resources will be focused.  One example in the technology area is how to prioritize systems.  As part of your planning, prioritize your systems with, as noted above, agreement from senior management.  In most firms, the high priority systems will include:

• E-mail
• Document management
• Telephones
• Calendar/docket
• Practice support systems such as litigation support

You need to set the priorities for your firm as part of your planning process.  These priorities should be agreed upon as part of your strategy and should be clearly articulated in the plan.

Identify and Assign Responsibilities
One area that is frequently missed in BCP is the assignment of clear responsibilities in the event of a disruption.  As part of the planning process you should ensure that key tasks that must be addressed in the event of a disruption are identified and responsibilities are assigned.  For example, if there is a disruption, key tasks such as the following may need to be addressed, depending on the nature of the disruption:

• Determining if the firm should close
• Cutting over technology operations to a backup site
• Establishing external communications, such as communicating with the courts, if necessary
• Contacting key vendors, such as the payroll service, if necessary

Responsibility for each of these tasks should be assigned.  The individuals assigned these responsibilities should have a clear understanding of the scope of their responsibilities.  Backups should be assigned also, in the event the individuals with the primary responsibility are not available.  For example, it is not unusual for the managing partner of a firm to have the responsibility for determining if the firm should close and the executive director has backup responsibility for this decision.

Once you have developed a plan, you still have a lot of work to do, including periodically testing the plan and keeping the plan updated.  Business continuity plans should not be static documents; firms change, client expectations change, and, as we all know, technology changes.  You need to keep the plans dynamic.

So Much To Do
There is clearly much to do and consider when it comes to BCP in a law firm, and these key success factors should help in getting these plans developed and implemented.

About our author . . .

Bob Dolinsky is a Senior Consultant and Director of Consulting Services for eSentio Technologies.  He has assisted numerous law firms in addressing a wide variety of technology issues including business continuation planning, technology planning, records management, and technology organization and staffing.  Bob is a frequent speaker at industry conferences including ILTA's annual conference.  He has authored numerous articles on law firm technology issues.  Bob can be reached at Bob_Dolinsky@esentio.com.