Disaster recovery. With 9-11 and Hurricane Katrina now part of our national psyche, it's a term that makes most of us instantly uncomfortable.
But, increasingly, disaster recovery planning is getting its due. There's even corporatespeak for it: DR.
"Education and awareness are higher than they've ever been. It's getting a lot of buzz," notes Ben Thornton, disaster recovery and business continuity planning director for Optimus Solutions, an information technology solutions provider in Norcross, Ga.
"You're seeing a lot more people dealing with it. But are we doing a great job? I don't think we are yet, although financial institutions because of government regulations are doing a better job than most industries. But they can do an even better job," he adds. "And they need to. Because it's not a question of if you have a disaster, it's when."
The key to disaster recovery, according to experts, is communication. Cell phones, buddy branches, calling trees, emergency 800 numbers, alternate recovery centers — everything loops back to keeping the communication lines open.
As David Schirm, vice president of business continuity planning for Raymond James & Associates, puts it: "What 9-11 crystallized for us is just how dependent everyone in this industry is, not only on each other, but on critical infrastructure: telecom and power. The absolute truth is that communication is by far the most important element of being able to recover."
In a recent nine-page "Notice to Members," the National Association of Securities Dealers released a series of recommendations based on lessons learned during the back-to-back hurricanes, Katrina and Rita in 2005.
Schirm got it right. The vast majority of NASD's "guidance" to financial services firms deals with staying in touch — advisors with their home offices, their colleagues and their clients. One interesting heads-up: Across the board, firms surveyed noted that text messaging proved surprisingly reliable as compared to the use of cell phones or land lines. In some cases, text messaging was the only reliable way to communicate with colleagues for a period of weeks. [See sidebar.]
Jimmac Lofton was a branch manager for Raymond James & Associates in Boca Raton, Fla., when Hurricane Wilma pummeled his building in 2005. He and his colleagues set up shop in a buddy branch for 12 days in what turned out to be a pretty seamless operation. "I'm pretty proud of the fact that we had the capacity to get back online and not let our problem become our clients' problems," he says. "All you need is a decent Internet connection." What Lofton learned is that he could have done an even better job had his home been equipped differently.
"Had I been better equipped at my own home, I would have been in business just hours after the storm. I've got it all now — electric generators, wireless Internet," says Lofton. "I'll be ready for it next time."
Challenges, Solutions
In today's 24/7/365 world, technology is often the problem — and the solution to swift disaster recovery. That's why most firms have one or more alternate data centers that can kick in if the corporate home office is compromised. But recovery is also about the simple things — like a contact list.
More than 18 months after Hurricane Katrina struck, LPL advisor Shelby McIntosh says business still isn't back to normal in his office in suburban New Orleans. He has recommended that all of his colleagues get a master list of emergency contact numbers from each client, and that advisors provide the same. "We were months making contact with people. Everybody was so upside down," he says. "It was a nightmare trying to find everybody. People were everywhere, just not here."
Disaster recovery planning isn't new to the highly regulated financial services industry but it has taken on a new life since 9-11. When treated as a "best practice," it's also being continually tested.
Commonwealth Financial Network, for instance, will likely institutionalize this year a procedure that calls for corporate employees — folks on the advisor tech help desk, in new accounts, cashiering and trading, as examples — to work periodically from home.
"We want to make sure systems are up to snuff, that there is connectivity and flow," says Darren Tedesco, the firm's director of business systems and strategic development. "If an event happens, our home office employees will be prepared to accommodate."
The business continuity team at Wachovia Securities, meanwhile, plans sometime soon to test its recovery plan — unannounced. The drill will include the firm's technology capabilities, facilities and partners.
"The business is always changing; so is the environment," notes Barbara Bower, Wachovia Securities' business continuity manager. "Technology changes, the world changes. That's why a recovery strategy is like a living document. You're always trying to update it. As businesses change, their recovery strategy has to change, too."
Planning For Disaster
Disaster, of course, is a relative term that can cover a lot of territory — everything from a computer system crash to a power outage caused by ice storms.
In terms of planning, experts recommend taking inventory of your critical processes, then identifying potential hazards. "Once you define the hazards, you list the things that could happen and what you would do," says disaster recovery consultant Andre Sharp, who heads Sharp Information in Hermosa Beach, Calif. "The idea is not to be prepared for every eventuality. The idea is to be prepared for most of them. Once you have a plan in place, you are prepared for just about everything. Without a plan, you're going to be lost."
Thornton describes "disaster" as: any circumstance in which my business can't perform its critical business function within an acceptable period of time. When consulting with clients, he begins the disaster recovery conversation with a single question: What is most critical to you? Next, he asks: What constitutes an "acceptable" period of time?
