Don’t be interrupted

It is 18 months since the Buncefield disaster yet the lessons of the importance of disaster recovery planning have still not been learned.

The insurance industry seems to be an isolated voice encouraging companies to recognise the importance of business continuity planning and disaster recovery.

David Williams, claims director at AXA, says that a majority of companies are not taking business continuity planning (BCP) seriously. He points to a ‘it won’t happen to me’ mentality, where some companies have done nothing about business continuity planning and have not allocated a long enough period to manage business interruptions.

The awareness is gradually improving but proper disaster recovery planning (DRP) is still not seen as a priority to many companies. Steve Agutter, claims manager at AIG, has seen companies with good business continuity planning in place even pre-Buncefield but sees many who do not.

Agutter says that although a catastrophe like Buncefield invariably brings the importance of BCP to the forefront for more businesses, it is generally the larger firms who are considering it.

He says: “Smaller companies are not yet at the same level. They are not as advanced when it comes to disaster planning so insurers and loss adjust-ers have to put in more effort to work with these clients often at the stage of a claim. We normally try to have discussions during the renewal period or when an acquisition is made, rather than at the major loss stage, if possible.

“With larger clients, we find that we are being approached to work through scenarios of what would happen in the event of a major loss and even write us into their BCP so roles and responsibilities are defined at the earliest stage.”

Forward planning

In the aftermath of Buncefield, AIG found that one of its clients Northgate Information Services, had excellent BCP. This enabled the insurer to get its client to relocated premises immediately after the explosion and saw a claims pay-out of £10m in 10 days, one of AIG’s biggest to date.

In the instance where a loss cannot be settled quickly and there is inadequate BCP, the company may still get some money from business interruption (BI) cover, but it may face losing its customer base through being unable to relocate.

Rather than wait for planning permission to come through in disaster zones like Buncefield and risk running out of BI cover, AXA has been offering another form of disaster recovery planning – paying cash that relates to the damage so that the client can use it to secure alternative premises. The affected property will remain in the hands of the insurer.

Some businesses have not been so lucky. Dacorum Borough Council recently announced, on the advice of the Health and Safety Executive (HSE), that a substantially damaged warehouse within the 190 metre consultation zone will not be allowed to reinstate its building.

Graham Winwright, head of planning and regulation at the council, says the HSE consultation document recommends that applications for buildings that house more than 100 people be refused planning permission. There are currently two other companies awaiting approval.

Andrew King of Marsh’s forensic accounting and claims services division says this raises the issue of whether they can claim the blighting of the site. “The worth of the sites are now diminished to a single storey car park status.”

There is no legal responsibility established to date. King says: “Someone should look into our general law of liability, which is mostly based on case law. With the Toulouse accident, which occurred in 2001, liability was established within the 12 months required under French law.

“With Buncefield, claims have only been made because of political pressure. Larger commercial clients have been paid through their insurance arrangements, but the BI indemnity period ended after 12 months – a lot of losses have been incurred since then and everyone’s waiting to claim from the party responsible.”

Corporate governance

Even in instances where DRP has been put in place, it proved to be simply an exercise to fulfil good corporate governance.

“Disaster recovery plans are invariably not tested with sufficient regularity. They are not immediately accessible or current. People often forget that such plans even exist

Steven Wallace, MYI

Steven Wallace, chief executive at loss adjuster MYI, says: “These plans are invariably not tested with sufficient regularity. They are not immediately accessible or current. People often forget that such plans even exist.”

Williams says ideally, these plans should be updated when there is a substantial change in what the company does – whether it takes on a different type of work or a new customer with particular demands.

“The best way to put DRP’s into operation is to be familiar with it, which means updating them annually.”

However, having DRP’s in place doesn’t necessarily guarantee a smooth ride through the crisis.

James Shrimpton a partner at law firm Davies Lavery, says that while having strategies in place won’t prevent a prosecution by the HSE, it would make the process of an investigation more controlled.

Shrimpton points out that 90%–95% of the time, lawyers are contacted after the event. “A lot of time companies react to a set of circumstances and at that point lawyers get called in to help advise throughout the investigation.

“With any disaster, you will find yourself under extreme scrutiny by the HSE and the police.”

Best practice dictates that one person within the organisation, usually the health and safety manager, be appointed to work with the HSE. This is as opposed to a director, who will be concerned with business recovery and the company’s image.

The health and safety manager should be working out what re-sources he will need to manage a large scale investigation, what role he will play and who will assist him.

Documents will have to be copied for the HSE. Records should be kept on which documents have been taken, who has been interviewed as a witness and where the HSE officers should be housed within the premises while investigations are ongoing.

Shrimpton says: “You wouldn’t want them in the middle of an open plan office – staff morale may be affected. From a practical point of view, by allotting the HSE a work area, they won’t be overlooking or overhearing private conversations senior management may be having.”

The recent flooding in the North proved to be another exercise in disaster recovery planning, or rather the lack of it.

Les Wright, Leeds partner at the Davies Group of loss adjusters, points out that the company is dealing with 10 times the normal volume of claims it would have, at this time of year, in light of the deluge of surface water.

Citing the example of a country house hotel in Yorkshire that was badly hit, with the ground floor under two feet of water, it was discovered that the client did not have any disaster recovery planning in place.

Wright says: “They did the reactive thing, which was to contact the insurance company which in turn contacted us.”

Because the hotel acted quickly, Davies was able to pull out all the stops to help return the business to full operation by the coming weekend, in time for two weddings.

“By Saturday we had the discovery recovery team and the fire brigade pumping water out of the hotel. We were able to get the appropriate disaster restoration specialists and building surveyors on the scene.”

Only time and more painful lessons will tell whether businesses will take disaster recovery more seriously. Just remember, it could happen to you.