Insurance carriers affected by the Superstorm Sandy are tryingto assess how to get their operations back online and runningnormally and once that is done they can look at how their disasterrecovery and business continuity plans played out in the face of adifficult challenge.

Meanwhile, the rest of the insurance world needs to pull outtheir own disaster recovery plans and determine what a 50-yearstorm might do to their operations. As Rob McIsaac, a principalwith Novarica points out, disaster recovery planning is criticaland exercising the plan is something insurers need to do on aroutine basis.

“The value is not that you planned for the right event,” saysMcIsaac. “What you want to do is free up your team so you have theintellectual capacity to focus on the things that are new anddifferent this time around and allow you to make on-the-flydecisions around what needs to be done to recover from a particularevent.”

McIsaac recalls working for an insurer based in lower Manhattanafter Hurricane Katrina devastated New Orleans. Manhattan and NewOrleans are similar in that they are susceptible to stormsurge.

“Not only did we go through what we learned from [Katrina], butthe step back was what would happen if a similar size storm cameinto New York Harbor instead of Lake Pontchartrain and how would wehave responded to that,” he says. “This learning happens with eachevent and if people take the time to plan appropriately it providesmore intellectual capital around what you need to be worried aboutand how you may respond to different circumstances.”

McIsaac knows insurers are never going to get their plansexactly right, but questions should remain top of mind—particularlyif all your resources are located in one place.

“You need to think about ways you can distribute access so youcan routinely operate—even with a skeleton crew—some of the corebusiness functionalities that are required to keep your customersand employees in the know and your distribution partners aware,” hesays.

Chad Hersh, a partner in Novarica, recalls working for aninsurer in Houston at a time when a tropical storm dumped threefeet of rain on the community.

“For some reason, in a city built on a marsh and in a buildingnext to a bayou, they put the data center in the basement,” hesays. “That didn't end well.”

Disaster recovery starts with the basics,according to Hersh. The good news is that in this day and age, noinsurer should ever lose their data to a storm. Restoringoperations, however, is another story. On the day after Sandy,Hersh went to the websites for some New Jersey p&c carriers. Hefound some had employee announcements on the site, such asreminders of essential-employee verification cards that wereissued to allow people to travel even though the roads areclosed.

“[The insurers] were looking to staff their claims center 24hours a day,” says Hersh. “That being said, you then notice theydon't take claims online or via a mobile app. Wouldn't that havebeen handy for them rather than trying to get a bunch of staff tothe office?”

The lesson Hersh hopes other insurers learn from Sandy is toautomate tasks that are critical to customers after a storm, whichhe believes is something that has been ignored in typicalplanning.

“You might want to think about ways to reduce your need forgetting employees back in the office,” he says.

McIsaac points out many business continuity plans anticipatethat in the heart of a disaster their employees will get on a busand travel potentially hundreds of miles from home to staff a callcenter or an operations center that is brought up in anticipationof a disaster.

“A lot of times that's just not practical because people aredealing with their own personal situations, so the realism of theseplans comes into stark contrast when you actually have to executethem,” he says.

McIsaac contends that in times of stress there is a potentialfor customers to rely on traditional technology such as telephones,even when there is no guarantee the infrastructure is going to stayup. During Katrina, he explains, most of the 800 circuits in thesoutheast routed through central offices that were located in NewOrleans.

“We needed to find ways that would allow people to get to us innon-traditional ways that we had not thought much about,” hesays.

Hersh explains the best advice for carriers looking at theaftermath of Sandy from a safe distance is to take a lesson.

“You look at a lot of the New Jersey insurers right now and youcan't get to their websites,” he says. “It's a little late to startthinking that your website is a pretty critical business tool. Alot of companies spend all their time and resources around whatthey view as mission-critical systems—the back end. They forgetthat the most visible thing to the customers is the system mostpeople don't view as critical—the customer/agency front end.”

McIsaac agrees: “If your front end systems are down, as far asyour customers are concerned you are closed. At the time they needyou the most you need to be available. Insurers need to thinkthrough hosting solutions, how systems are integrated, and how youare going to run the front end even if key pieces of the back endare down. Historically, human beings have been the touch points,but now people grab their smartphones or their browsers. They willmake decisions about whether or not you are a company they want tohave a relationship with based on whether you were there when theyneeded you.”