By Stan Sauerwein
It doesn't have to be a catastrophic disaster. For Karen Rutherford, the world of business continuity is full of "who would have thought" moments and chances for brokers to give meaningful business guidance to clients - for a fee.
Small crises can often cascade and put a commercial client's business in peril. An innocuous-looking e-mail that disguises a computer virus is one example. A fatal heart attack that puts a company in chaos because the principal died without a succession plan is another.
Rutherford's company, The CrisisTool Group, has identified 400 of those sorts of threats. As Reliance Insurance Agencies Ltd. has discovered, those threats are more than reasons to sell business interruption insurance.
In 2004, Jim Bell, a former IBABC president and owner of the Vancouver agency, initiated a new value-added service to his customers. He provides Rutherford's software to his commercial clients and offers help to organize their disaster recovery plan.
Bell can't say his book of business has grown because of this effort, but it has improved retention. "It makes us feel that we're really helping them manage their risks and exposures," he says.
"If we, as brokers, are not just there to place insurance for somebody, if we're actually there to help them manage their risks and exposures, then it follows that we would want to have tools that would help them."
"Especially on your business interruption insurance, it either confirms or suggests that you may want to change how you view funding a total loss. It's a building block to having a sound risk management program in your company to have a disaster recovery plan."
Just what does a good disaster recovery plan involve?
Bell says a lot of time and plenty of diligence, but it's an effort worth every hour invested. Reliance completed their own plan before talking about the process with clients. It took the firm months of work, but resulted in a succession plan for the agency and an IT backup strategy Bell calls his "failsafe" in the event of a major disaster.
The CrisisTool began in Calgary several years ago as a concept by Rutherford, who is a former insurance broker, and her partner Gerry Meyer. Her software, now in it's seventh version, has been licensed around the world by Zurich Insurance and is now considered the best practices standard for crisis management planning in both North America and Europe.
The software covers nine major areas of concern in a business with detailed instructions and forms that guide a user through the creation of a thoughtful recovery strategy. It also includes a robust test and audit module for the plan.
Rutherford says unless a plan is properly tested it's of no value. "People were doing table top exercises and those were just a huge mistake because nothing turns out as you plan on a table top. People make assumptions they shouldn't make."
So, as well as the planning tool, Rutherford devised 45 tests. "It picks an category of the company to test in each of nine critical areas (HR, IT, logistics, security, privacy etc). The tests, built so they can be done in about two hours, describe one of 400 events that might happen. "Users can consistently be testing individual elements of their plan without having to interrupt work and spend a lot of money."
Rutherford offers The CrisisTool on a single user basis or as a special product offer that brokers like Ball can use to help build a value-added client service - or a new profit line. Twenty brokers in North America are doing just that. She claims one broker in B.C. achieved a 500% ROI on his licensing investment within the first six months of operation by providing his clients with guidance through the process for a modest fee.
She feels brokers are prime candidates for the planning software themselves because of their data intensive operations. She says even with backup tapes, after a disaster such as a fire ruins an IT department, it can take weeks for a broker to resume business.
Brokerages have become more sophisticated. Many have local area networks, Internet connections, and they've used a local IT firm (many times only a one man show) to configure their computer systems. Agencies often use more than one type of software. They have a broker management program as well as additional accounting software.
"When the only thing you ran on your computer was your broker management system, if you had a backup tape all you had to do was go out and buy five computers. But today its an entirely different configuration," she says. After a disaster occurs, "they think they have their tapes and they are good to go but then they look around and realize they haven't got a clue" about how it all comes together,r because the IT side of their business was built in pieces over time.
She says one of the fastest growing companies in the business continuity industry, called MessageOne, offers a unique new development in IT backup. It provides software that can run full time on a computer systems and constantly synchronize today's data and today's licenses for programs against an archived backup record. It can avoid the problem described above and could be a part of a broker's business recovery strategy.
Bell has learned commercial clients often become sidetracked when they begin theplanning process simply because of the sheer size and amount of work involved. To encourage them, he suggests clients break the task into small pieces.
"We believe the two biggest things you have to prepare for are making sure your IT has a solid backup plan and getting your internal and external communications in order," he says.
Even that limited planning is tremendously helpful in a disaster, he feels.
There are many disaster recovery programs available on the market and some are even free, but brokers should examine them carefully before making a client recommendation. Ensure the plan is comprehensive and updated regularly.
Here is a short list of activities brokers can consider for their own business recovery planning. They can also provide a brief advisory guideline for customers.
Map out core activities: Identify areas where there are dependencies. Consider alternative ways in which operations may be carried out in the event of disruption.
Identify roles and responsibilities: Determine key people within your organization and their roles in the event of a disruption. Who contacts other members of staff and customers in the event of a fire for example? Who is responsible for maintaining the 'back up' of computer files off the premises?
List key internal and external contacts: Include customers and suppliers as well as staff. Ideally, keep a copy of this list in a secure off-site location.
Brainstorm: What possible scenarios might occur? Consider how you might respond, or the measures you would put in place to minimize impact and maintain operations.
Back up critical computer files or programs: Make copies of important files and regularly update these copies. Be prudent. Keep an extra copy in a secure off-site location.
Identify an alternative temporary location: If prevented access to your premises for any prolonged period, have alternative arrangements made in advance of disaster.
Learn from your experiences: Track the frequency, impact and how you managed to overcome disruptions. Make sure procedures are revised and updated as a result of the experience gained.
Rutherford's last piece of advice is not to wait. She says her firm was recently negotiating with a broker in Texas for licensing of The CrisisTool. "They were half way through the deal and his whole building burned to the ground."
Who would have thought?
Workshops/Readings