Staving off Disaster

DISASTER. Emergency. Crisis. Those words bring up familiar images: a tornado, a hurricane or (unfortunately, after 9/11) a possible terrorist attack. But what about a computer virus or, even more tragic, the death of a key employee? Most people recognize how serious such events can be, but do they figure in your agency's disaster-preparedness plan?

They should, according to a panel discussion at the annual ASCnet TENCon gathering, which was held in September in New Orleans. Among other things, the panel discussed what types of events should be considered disasters, and how to plan for and respond to a disaster.

Panelists included John Warn, vice president and treasurer of Rue Insurance in Trenton, N.J.; Robby Dunn, vice president and agency manager for Hotchkiss Insurance Agency in Houston, Texas; and Kevin Crow, IT manager for Kapnick Insurance/Harbor Benefit Services of Adrian, Mich. The moderator was Marjorie Perkins, of Applied Systems. Following is an edited version of some of their comments.

Marjorie Perkins: What is a disaster?
When we think of disasters, we often think of natural disasters or of the possibility of terrorist attacks, especially since 9/11. But when you create a disaster-preparedness plan, it might be helpful to think of it as an "unplanned event" plan. Many things could happen to your agency that you might not think of as disasters but that certainly could have disastrous results if you're not prepared to respond to them.

The "Blaster" worm that hit many computers a few months ago is a good example. This computer virus posed such a serious threat that Microsoft sent out notifications and "patches" to protect computers, and even our Department of Homeland Security issued notices about it. Yet many agencies don't include such an event in their disaster plans. They should.

The Hartford recently did a study of small businesses and their disaster planning processes. The study found that only 24% of surveyed businesses had a crisis management team, and only 44% had any type of plan to respond to a disaster. This is clearly an area in which our industry can improve.

Your agency should begin creating its plan by forming teams to study what could happen and how to respond. You may want to have more than one team, to focus on different possible events and responses. For the plan to succeed, agency ownership and top-level management must be committed to it. Those charged with creating the plan must do whatever it takes to secure that commitment.

John Warn: What to pack
Perhaps even more so than for most businesses, it's important for insurance agencies to resume operations as soon as possible after a disaster or other unplanned event. Here's a sobering statistic I recently came across: Out of every four businesses that close following a disaster, only three will reopen for business. If one of your clients were forced to close permanently after a disaster, no doubt you would feel for the client. You also would regret the loss of the client's business. By being prepared to reopen as rapidly as possible following a disaster, you'll be better able to help your clients weather the event too-and preserve them as a source of revenue.

Protecting electronic data and hardware is a high priority in many disaster-preparation plans. That's as it should be, but I suggest that your plan give equal weight to a "low-tech" consideration: protecting your agency's paper.

Make a list of the items you would need right away following a disaster. Your list should include items that exist only on paper, and make copies of all of them. Keep the copies offsite, and select a location far enough away from your office that the same event would not affect both places. If you keep extra copies of valuable documents onsite, at least keep them in a fireproof safe.

Consider making and storing off-site copies of the following types of documents:

• Records of accounts receivable and accounts payable.
• Payroll and tax information.
• Personnel files.
• Your own insurance policies.
• Leases, your agency's articles of incorporation and other legal documents.
• Phone numbers and other contact information for key clients, vendors and carriers. This may be especially important in a high-tech agency. Rather than memorize important phone numbers, many staff members program them into their phones. If the phones are destroyed, the numbers may disappear along with them. Also, don't forget phone numbers of contractors and companies that can provide restoration services to you and your clients after a disaster.
• Securities, stock certificates and other financial documents and records.

Robby Dunn: Employees are the agency
The welfare of your employees should be a prime consideration of your agency's plan. Realize that disasters, apart from natural ones, can strike your staff members, so be prepared to prevent them or mitigate their effects.

Workplace violence can be just as disastrous for your agency as a tornado. We recently addressed this exposure as part of our agency planning. We were moving into a new location, with an open, inviting reception area, for which we had signed a multimillion-dollar, long-term lease. But I recently had attended a seminar on workplace violence and had learned two sobering facts. The first was that 70% of all violence committed against women occurs at the workplace. This violence is not necessarily committed by fellow employees, but rather by others who know where the women work. Second, I learned that the first person to be hurt in such episodes of violence often is the company's receptionist.

I felt we had to take steps to keep our employees safe and secure. Therefore, we spent about $10,000 on a window that would keep walk-up traffic from entering the office. This was a small amount to pay, relative to the total cost of our lease. Every employee was issued a key card, and we established a rule that employees could not "piggyback"-that is, everyone with a key card had to open the door herself or himself. Of course, if our receptionist knew someone, she might "buzz" that person in. But if she did not, she would ask, "May I help you?" and ask them to wait for someone to come get them. We reinforced this procedure with a sign in our lobby advising visitors of it.

We had to handle this matter with sensitivity. Many of our clients are contractors who employ immigrant workers, and we didn't want to be accused of stereotyping or of not granting immediate access to someone on the basis of a "profile." Still, we decided we would rather take the chance of offending someone unintentionally than expose our employees to unacceptable risks. We determined that if someone objected to our policy, our receptionist would contact a manager, who would speak to the person about our need to ensure a secure work environment.

We described our policies and rationale to our employees and stressed our desire to protect them and provide a comfortable work environment. I received many e-mail messages thanking us, including two from employees who had witnessed incidents of workplace violence while working for other firms. One had seen an ex-husband come into the office and murder his former wife, and the other had witnessed a workplace shooting. Both employees felt greater peace of mind knowing we were taking steps to prevent such tragedies.

Your plan also should anticipate less dramatic possibilities. We had a key employee who lost her mother, uncle and grandmother all in about three weeks' time. The emotional stress was hard for her to bear. We put her in touch with an appropriate source of counseling and gave her some time off. We were able to help her find counseling through our group health plan, which includes an employee assistance plan (EAP).

If your agency has a group health plan, you probably have EAP resources, and they can be valuable in such situations. They can direct you to the right type of doctor or to a counselor. If you think an employee is feeling suicidal, they can arrange a face-to-face meeting with a psychiatrist within 24 hours. They can provide other services too. We use our EAP for a monthly "lunch and learn" series, which the EAP provides at no extra cost. We have had lunchtime education sessions dealing with breast cancer awareness and with a stop-smoking campaign.

Some agencies may believe it is desirable to train all employees to recognize signs that someone might need help. This is a noble idea, but be careful. When someone needs or is receiving counseling, this is a confidential matter, and you are open to lawsuits if other people find out about it.

Kevin Crow: IT concerns
Losing clients because of an inept response to a disaster is a disaster in itself. Our customers send us premiums because we promise that if they have a loss, we'll be there to help them right away. If we're not able to recover from a disaster ourselves and start helping them quickly enough, they may go elsewhere for insurance after the disaster is over. Of all the businesses that may have trouble resuming business after a disaster, we're the ones who have no excuse-we're in the risk management business, after all, so we should know enough to be prepared.

To be up and running after a disaster, your plan must provide for five basic needs:

1. ) A place to do business. You may not be able to get to your office because it has been destroyed or because authorities won't grant you access. Make provisions ahead of time for an alternate location. I know some agencies that have signed contracts with schools or hotels that will give them space in the event of a disaster. Don't plan on an alternate space that is too close to your current location-it might be inaccessible too.
2. ) Power. Again, if power is out at your place, it's probably out nearby. So when you're looking for an alternate location, think about how you could obtain temporary power at that location (e.g., via a gas generator). Alternatively, learn enough about the local power grid to select a site that you can be reasonably sure won't be affected by a power outage at your current location.
3. ) Computer hardware. If your computers are destroyed or otherwise rendered inaccessible, do you think you'll be able to just call up Dell or some other vendor and get 20 machines delivered in the morning? There may be hundreds or thousands of people in the same boat that you're in, and thus you may not be able to get that order filled for quite some time. As a rather novel solution to this problem, I propose the following: When you upgrade to a new set of computers, think about keeping a supply of the old machines in an offsite location, rather than selling, donating or discarding them. We store our old machines, wrapped in plastic bags with a silica pack in each one to protect the computers from moisture, at an off-premises site. If you need your old machines in the future, they might seem outmoded and slow-but you still may be glad to have them.
4. ) Software. Make copies of your software programs on CD-ROM and store them offsite. Your old computers (or any new ones you buy) will be no good to you if your software is buried beneath a pile of rubble. If your agency is not using the latest versions of your software, you don't want to spend time learning them in a disaster. That's when you need to be helping clients instead. So if you are using programs like Windows NT 4.0 or Windows 98, which no longer are widely available, store copies of them offsite.
5. ) Data. You probably run a backup tape or duplicate your data in some other manner. But what do you do if you lose the drive those tapes are played on? The life cycle of tape drives is down to about five months. A tape is no good if you can't use it, so find a compatible backup drive and keep it in a safe offsite location.

The five points above also apply, in a general way, to your telephone service. Again, your agency will need a place to operate, power, hardware (a phone system and lines), software (most phone systems have a software component these days) and data (the configuration information for your phone system).

From an IT perspective, agency principals have more to worry about than dramatic events that result in the total loss of the agency. For example, a few years ago in an agency owned by a good friend, a popular branch manager died in the shower one morning. The 25 employees working under him were so distraught that the agency decided to close the branch for a few days. The agency principal then said to the IT person: "We need to redirect the phone traffic and set things up to run the branch business from here. Can you do that?" So tragedies like this one also can become IT emergencies.