Lawyers Journal will regularly run Mind Your Own Business, a column devoted to answering management questions that come up in day-to-day practice for solo and small-firm practitioners.
Law Practice Management Section Council Chair Denise Guérin is a solo practitioner in Cambridge concentrating on residential and commercial real estate transactions and all matters involving small businesses.
My partners and I have been thinking (and worrying) about the fact that we’ve never done anything systematic in the way of disaster planning, beyond the fact that we pay all the usual insurance premiums. Of course, we back up our computers regularly, but I’m sure there’s more we should be considering. Our firm has a total of 11 employees, so our resources are somewhat limited. Can you point us in the right direction?
You and your partners deserve a lot of credit for your willingness to tackle the difficult and unpleasant subject of disaster planning.
According to the latest statistics available from the U.S. Bureau of Labor, only 25 percent of all businesses engage in any type of disaster prevention or recovery planning. Not surprisingly, the bureau also reports that almost 70 percent of businesses that experience a major disaster are no longer in business within five years.
To get you started on the planning process, I recommend utilizing the classic risk management approach, as follows:
1. Determine the scope of your own, firm-specific disaster plan. This will be dependent upon the time and other resources you can devote to the planning process, as well as the firm’s level of risk-tolerance. Just as each firm has its own culture and personality, each firm also has a “group” level of risk-tolerance. As attorneys, our instinct may be to create an exhaustive risk plan, but we need to keep the scope within the reasonable limits of our resources.
2. Identify the risks. Have a few brainstorming sessions, and be sure to include all members of your staff. Ask for input from “subject matter experts” such as your accountant, your insurance agent and your IT consultant. Consider possible risks, from major disasters due to weather or security breaches, to the more mundane, such as burst pipes and power outages. Make a conscious effort to “think outside the box.”
3. Analyze the risks. Assign a rating on a one-to-10 scale for each risk’s probability and for each risk’s impact if it does occur. Probability times impact equals the risk score. Move the risks with the highest scores, as defined by your level of risk-tolerance, on to the next step.
4. Create a response plan that addresses each risk in one
(or more) of the following ways:
• By mitigating the probability
• By mitigating the impact
• By transferring the risk (through insurance)
• By avoiding it altogether (e.g., move out of a flood zone)
• By accepting the risk as one of your costs of doing business
5. Monitor, review and update your plan regularly and frequently.
Here are a few tips for your consideration:
• Identify your firm’s core business and build your plan around being able to maintain it under disaster-level circumstances. Remember that most of the actions in your disaster plan will require near-uninterrupted cash flow, long before insurance proceeds become available;
• In the same vein, keep some cash and a supply of firm checks off-site;
• Assign immediate post-disaster contact of clients and vendors to specific employees;
• Create a comprehensive office contact list for all staff;
• Inventory and photo-document your office and contents, including serial numbers, license numbers, vendor and customer service information, and maintain that information off-site;
• Encourage lawyers and key personnel to maintain Web-based e-mail accounts in the event of emergency, and be certain to include those on the contact list; and
• Visit the MBA Web site for information about the several member benefits and member services that can help you in your planning.
Good luck, and may this be one plan that never comes to fruition.