Introduction

Experience should teach us one thing, if nothing else, and that is to expect the unexpected. Events do not always turn out as you planned and there are a thousand and one things that can go wrong, and, as Murphy’s Law states “Anything that can go wrong, will go wrong”.

As the provider of a legal service, your clients should be able to expect that you will be available when you are needed. They are entitled to rely upon the fact that your practice will be up and running effectively no matter what; that if you have a deadline to meet, a transaction to complete or a court hearing to attend, that you will be there to attend to their interests.

That is where Business Continuity Planning comes into play – having in place a Business Continuity Plan (BCP) providing a process whereby, if the unthinkable happens, you can still function effectively as a provider of legal services.

In this, the first of two articles dealing with Business Continuity Planning, we look at the business reasons behind putting in place a BCP and the benefits which can be derived from doing so, and in the second article we will look at the steps which you will need to take to implement such a plan.

What is Business Continuity Planning?

The Business Continuity Institute defines business continuity planning as ?? a holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities? (see the BCI Dictionary of Business Continuity Management Terms – www.thebci.org/glossary.pdf).

Put more simply, business continuity planning is about planning for the unexpected and taking all steps possible to minimise the impact of unexpected events upon your practice and mitigate the losses which you incur. In the words, again, of the BCI ” The strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level. “

In other words, therefore, it is a planning before something goes wrong what will happen if and when it does go wrong and taking steps taking steps to put in place alternatives and backups.

Why have a Business Continuity Plan?

The first and most obvious answer to this question must be because it would not be sensible not to have one. Things go wrong – so plan what to do when they do.

We are not just talking about major incidents such as volcanoes, earthquakes, Tsunamis or terrorist attacks – although obviously these can happen. Often we are planning for far more mundane events such as flooding, burst pipes, fire, systems failures, vandalism or even just bad weather. In other words, the kinds of things that happen to someone almost every day of every year. That someone could well be you.

If, as a result of things going wrong, your business suffers, or you are unable to deal with the requirements of clients, then not only are you going to lose money, you could even find yourself at the wrong end of an expensive claim for loss arising from your inability to perform. The excuse that you couldn’t because events outside of your control had prevented you from doing so is not going really going to have much effect.

There are of course other, equally compelling reasons.

Solicitors’ Code of Conduct

If you are a solicitor then Chapter 7, Outcome O (7.3) requires that “you identify, monitor and manage risks to compliance with all the Principles, rules and outcomes and other requirements of the Handbook, if applicable to you, and take steps to address issues identified;” whilst Indicative Behaviours IB(7.3) and IB(7.4) within that chapter provide:

• IB(7.3) – identifying and monitoring financial, operational and business continuity risks including complaints, credit risks and exposure, claims under legislation relating to matters such as data protection, IT failures and abuses, and damage to offices;
• IB(7.4) – making arrangements for the continuation of your firm in the event of absences and emergencies, for example holiday or sick leave, with the minimum interruption to clients’ business.

Civil Contingencies Act

You may even find that you have to agree to include business continuity provisions in agreements which you enter into for the provision of legal services – especially if you are planning to do work for large organisations or in the public sector. For example, the Civil Contingencies Act 2004 places a legal obligation upon health authorities, emergency services and local authorities to assess the risk of emergencies and take steps to plan for business contingency management – which includes ensuring that suppliers have suitable processes as well.

Companies Act

If your business is a limited company, then the s 174(1) of the Companies Act 2006 requires that “A director of a company must exercise reasonable care, skill and diligence” which includes ensuring business continuity and which could leave directors who fail to make plans liable to other directors and shareholders.

Data Protection

There is even a data protection need. Principle 7 of Part I of Schedule 1 of the Data Protection Act 1998 provides “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

Moreover, whether the rules require it or not, if you do not have plans in place for dealing with interruption, then you might actually find that the costs of coping with an interruption, combined with the potential for loss of business, could be sufficient to cause the business to close – especially for many businesses who are running in a relatively unprofitable way as it is.

An article in the Disaster Recovery Journal by Nelson Bean stated:

“Even when the damaged business regains its pre-catastrophe volume, generally there will be a significantly reduced profit. In a worst case scenario, after a catastrophe there will be a net loss where that same volume during the pre-catastrophe period would have resulted in a reasonable profit. This is due to the combined effect of the hidden losses which accounting systems are generally not set up to track. Consequently, the business person is often unaware of the problems which are causing cash flow difficulty.

“….. statistics … show that 43% of businesses closed by a catastrophe never reopen. Twenty-eight percent of those that do reopen, experience financial failure within three to five years. Those that never reopen simply do not have the financial resources to weather the period of time they are closed due to the catastrophe.”

What are the benefits of a Business Continuity Plan?

Many solicitors, especially those in smaller firms who are already struggling with the amount and complexity of the rules and regulations which they need to cope with, may question whether there is any benefit to be derived from a BCP. Indeed many may see it as simply another piece of paper to confuse and slow them down. To take this view would be very short-sighted. Indeed, it is the smaller businesses who will usually find it hardest to recover from the kind of event that the BCP can address.

There are undoubted business benefits from having a BCP and from implementing business continuity management within a firm. These include:

• the security of knowing that when something goes wrong everyone in the firm knows, or can easily find out, what to do to minimise the effects;
• compliance with regulatory requirements – the rules say you need one so why run the risk of being penalised for not having one;
• positive marketing of contingency capabilities – make it clear to those for whom you are working that you have thought about their needs sufficiently to ensure that all contingencies are catered for;
• competitive advantage – if you don’t have one and your competitors do then you may lose out in a tender process or existing clients may chose to move their work to a firm with a robust BCP;
• insurance – an effective BCP could help demonstrate to insurers that you are a good risk for PII because you manage proactively you business risks. The ability for a business to recover and mitigate its losses could make the difference between a high premium and a low one or even insurance or no insurance.

Disaster Recovery v Business Continuity

There is confusion between these two terms and, whilst they are certainly both part of the same process, they are not necessarily one and the same thing.

A business continuity plan is about all aspects of the business – from staff not being able to get to work because of bad weather to flood, fire and major incidents. A disaster recovery plan is merely part of that overall process and deals with, for example, what would happen if all of the computers ceased to function, how would the information which they hold be backed up and what steps would be taken to achieve that. Thus, business continuity goes beyond disaster recovery by dealing with each and every aspect of the firm’s operations that could be impacted by a situation, including, but not limited to, staff, public services and utilities such as gas and electricity, data backup, transportation, food, health and safety, death of a partner or fee-earner and so forth.

Indeed, if we look again at the definitions from the Business Continuity Institute , they state that disaster recovery is “The strategies and plans for recovering and restoring the organizations technological infra-structure and capabilities after a serious interruption.” They even add to this an editor’s note stating “Disaster recovery is now normally only used in reference to an organization?s IT and telecommunications recovery”.

Contact the Lawyers Defence Group

If you require further information about business continuity planning, or help with implementing a BCP within your practice then the Lawyers Defence Group can assist you.

For further information, or to contact the Lawyers Defence Group about business continuity planning:

• phone on 0333 888 4070
• email on help@lawyersdefencegroup.org.uk
• request a callback using the form in the right hand menu and someone will call you back
• write to Lawyers Defence Group at one of the addresses on our contacts page