Planning for the Unplanned

Thankfully, you can protect your firm and get back on track as soon as possible if you have a business continuity plan (BCP) in place. These written documents can go a long way helping your firm get back on track should disaster strike.

“[A BCP] details out all critical information needed for the law firm to be able to respond quickly to a crisis, manage that crisis and then recover by continuing to provide seamless service to the law firm’s clients,” says Kathryn N. Scourby, Principal of KNS Consulting, LLC, and a presenter at this year’s ALA Conference & Expo.

Scourby, who helps law firms construct their own BCPs, says it’s important that they have these plans laid out, as then firms are prepared to continue business in the face of any crisis or disaster that may negatively affect the workplace, people or the firm’s reputation.

THE CURRENT STATE OF BCPS AND LAW FIRMS

According to a survey of more than 50 law firms by the Instant Group and Sandpiper Partners, 98 percent of firms have a BCP in place, and some even have separate ones for IT, human resources and communications disasters. Most of the disruptions affect businesses for seven or more days, and it can take seven to 28 days for businesses to find a new workplace if they rely on a physical office space.

Among the 98 percent of firms that have BCPs, 77 percent reported that they had conducted an internal BCP audit or test run in the past 12 months. Thirty-eight percent said that their BCP would cover them for more than a month if they were displaced or there was an outage. Thirty-five percent would be covered only for one to five days.

Michelle Bodick, Managing Director of Sales and Marketing (Americas) for the Instant Group, says that firms could not suffer these disruptions to their workflow. “With ever-increasing threats and a more competitive marketplace, firms cannot afford threats to operational viability or client service. As more legal organizations adopt new technology, their security and recovery systems will be of paramount importance.”

CRAFTING A PLAN

When creating a BCP, your law firm has to write it out, test all of the components of it to identify vulnerabilities and conduct a business impact assessment (BIA). “[This helps] to identify gaps in the essential personnel and resources that would be needed in the hours, days and weeks following a crisis or disaster that might affect a firm,” says Scourby.

She also stresses having a solid communication and notification system for all lawyers and staff, and well-trained crisis management and communication teams to help ensure a quick response and recovery from a crisis or disaster that occurs. Additionally, you need to detail your alternate workspace plans, whether it’s another location or you have a remote plan. And don’t forget to include all pertinent information regarding your business interruption and cybersecurity insurance coverage.

Hacks and cyberthreats are becoming more common and disruptive to law firms in general, so you need to stay ahead of the curve with instructions in your BCP on how to deal with these events.

Christian K. Adams, Treasurer, Federal Bar Association, says that your BCP should also include technology backup plans and actionable items to confirm that your staff is safe and your office is protected. You need information on how your clients will be able to access services even if personnel are not available, and how you will secure your data, property and other assets.

But, Adams says to keep in mind these plans are not a one-size-fits-all undertaking. Types and intensity of disasters vary, as do the resources available to ensure recovery post-disaster.

Oftentimes, law firms will look at sample BCPs to come up with their own. The American Bar Association’s guide Surviving a Disaster: A Lawyer’s Guide to Disaster Planning provides approaches to business continuity planning, a preparedness checklist and a sample plan that you can turn to when you’re just starting out. Legal Management also published “Staying Afloat When Distraction Strikes,” which covers things to consider.

However, keep in mind that because of evolving technology and high-level threats, you need an updated 2018 sample to turn to.

ENSURING YOUR BCP IS AUDIT AND RFP-FRIENDLY

Your BCP is going to come with some legal issues of its own that you must not overlook. You also may want to hire a law firm consultant to help you come up with your plan and guarantee that you are compliant with audits and RFP regulations. Otherwise, your firm could be in big trouble, on top of all the disruptions you’ll be facing if a disaster strikes.

“Lawyers must safeguard clients’ property and maintain client confidentiality and communications,” says Adams. “These obligations are neither excused nor waived following a disaster. The failure on the part of a lawyer to prepare for disasters could lead to violations of ethics rules or even expose the lawyer to civil liability for his or her inability to protect a client’s property and interests.” He notes that to guarantee that client information is protected, law firm management must proactively incorporate business continuity considerations into the overall design of its law firm’s business model to mitigate the risk of service disruptions.

If you want to stay competitive and satisfy your clients, you may need to take the extra steps when it comes to your BCP. According to Scourby, some clients are now requiring that law firms become certified in business continuity standards like ISO 22301 (business continuity management standards), ISO 27001 (information security management standards) or ISO 27032 (cybersecurity management standards).

WORTH THE EFFORT

Though it may take some time, money, effort and strategizing to put together your BCP, in the end, it can save your law firm from a loss in revenue and productivity, and ensure that it will continue to be successful for years to come.

“Any event that disrupts the normal flow of business can cause a decrease in revenue and can even cost a law firm its clients if the situation is not handled properly and promptly,” says Adams. “Law firms that commit the finances and resources necessary to implement a business continuity/disaster recovery plan will be in a better position to meet their strategic, ethical and legal obligations to clients.”

Kathryn Scourby will discuss business continuity plans in detail at our Annual Conference & Expo in National Harbor, May 3–6. In her session, “A Law Firm’s Competitive Edge: Writing Effective Business Continuity Plans,” Scourby will send attendees home with a template that they can bring back to their office to customize for their firms.

Get a preview of this session on our recent podcast with Scourby by listening at alanet.org/podcasts.