Home > Member Services > Publications > Magazines & Journals > INTHEBLACK > Disaster planning: Dealing with disaster

Disaster planning: Dealing with disaster

Imagine what would happen one day if nobody could get to work.

Imagine if the electricity was out, which means the phones were down and the ATMs couldn't dispense cash. Imagine if this lasted for a week.

Although this scenario may seem almost as implausible as a 9/11-type terrorist attack on Australia, it is very much a reality.

It is exactly the scenario faced by hundreds of businesses in Innisfail (Queensland) during Hurricane Larry in March 2006.

It is the sort of threat faced by many thousands of other Australian businesses located on the coast; each year they are vulnerable to hurricanes and flooding. And it is the sort of threat faced during Australia's annual bushfire season.

These threats may seem remote to any business operating in a metropolitan centre. But freak weather conditions, burst water mains or power cuts can create similar problems.

Craig Fraser, partner in Mackay (Queensland) firm Brown & Bird, was motivated to write his own crisis preparedness plan after an incident affected the firm's financial planning group, Lonsdale Financial Services, in Melbourne.

'That building had a burst water main in February of this year and it shut down the building for a week,' he says. 'That meant that there was no power to the building and they couldn't operate their businesses.'

Lonsdale Financial Services moved its computer servers to another site, and within 48 hours had its national network working again.

According to Ross Campbell of crisis management specialists Ross Campbell and Associates, many businesses don't have crisis preparedness plans. Campbell estimates 55 to 60 per cent of companies have some sort of plan.

He says that often companies don't realise they need a plan until something terrible happens. 'I don't think most executives want to talk about crises,' Campbell says.

'They equate a crisis with bad management, and things like that don't happen on their watch. But it can sometimes be somebody else's management that takes you there – or terrorism, or an act of God.

'The first two steps to creating a plan are first to get commitment from top management and then to identify risks. 'The most critical risks in this country is something that hits the enterprise at once, very quickly,' he says.

'That could be a major failure of corporate governance, the collapse of a market, a major government inquiry – the Wheat Board is a very good example of that.

'He says many firms could face the knock-on effect of a client collapsing, such as the case of Arthur Andersen and Enron. Many firms have risk-management procedures in place to prevent such an event.

Bill Edge, a partner at PricewaterhouseCoopers, aims to try and minimise these risks. 'Contingency planning is generally around a complete disaster…whether it be a tsunami, the avian flu, a terrorist attack or something like that,' he says.

'To be frank, we have plans around those but they are not the plans that are most pressing to us.

'If you look at the Enron disasters and others, most of them and most of the concentration of the regulator, is about the financial statement audit product,' he says.

'We've instituted a system across all of our products, the aim being that they all go through the same rigorous methodology. In doing that we have prepared what we call 'a compliance framework'.

'Once crisis risks have been identified it is time to put a plan of action in place. Most companies would pull together a crisis-management manual, which details who is involved in managing a crisis, what the procedures are and, most importantly, all the relevant contact details of the people and organisations that may be involved.

Campbell says: 'The whole thing is based on checklists. Checklists are about speed and accuracy.' Typically, a plan should identify a team dedicated to managing a crisis, which will leave another team to actually manage the business during this time.

It should also identify the differing areas of expertise that are required to be brought in and handle a crisis. Many crises inevitably become news in the public arena, which means that public relations professionals should be on stand-by. But security consultants, lawyers and other experts may also be needed.

There is a big difference between managing a natural disaster where the government and local emergency services have well-established and tested plans, and managing an issue on the scale of the Beaconsfield Mine disaster, Enron, the HIH collapse or simply a burst water main.

The response to a bomb explosion will be very different to that for a takeover threat or a government investigation.

'All those scenarios are different, and they all need different response-capability tests so that when people start making decisions they are moving forward,' Campbell says. 'And let's face it: most crisis management people in corporations and government don't have the everyday experience of managing crises.

'The crisis team needs to be contactable at any time of the day or night. One of the most important aspects of a crisis manual is an up-to-date contact list detailing work, home, mobile and phone numbers for all relevant people.'

Campbell says: 'It's then a checklist that gives you the things you have to do immediately, and to a degree, who's going to do it. If there are only two people then they have to share the arena of activities, which gets back to the protection of people and assets, and the interaction with emergency services – if that's what's required.'

Gerard Bryne CPA works on crisis preparedness plans for the Department of Primary Industries and Fisheries in Queensland. Learning from the experience of Innisfail and the Canberra bushfires, he says that businesses need to realise that staff members may be affected and adds that it is important to have procedures in place for replacing key staff. 'If you are in Brisbane, Sydney or Melbourne arguably it is easier.

But if you are struck by something like the bushfires in Canberra your staff may be the victims. They may have lost homes or property, or whatever. What are you going to do for that period for staffing?'

Campbell believes in a crisis people should come first. 'It's a people issue first and foremost,' he says. 'And those who protect their technology first or their future first before they consider how people might be affected are making a big mistake.

'During a crisis many look to the internet for information. During the Virginia Tech massacre, the college's site collapsed because there were so many hits by those seeking to find out what was going on.

'If somebody's having a problem, they will go straight to the website to see if they can get information,' Campbell says. Similarly, mobile phone lines may become jammed, as commuters discover when they are trapped on delayed trains.

Generally crises are unexpected. The threat may not even come from a company's list of identified risks. And although it's not possible to predict everything, a change-ready mindset is key. 'I just don't think people are prepared either intellectually or emotionally to face it,' says Campbell of most disasters.

'Probably 60 per cent of people have plans, but I'd suggest that less than half of people are rehearsing. It's all very well going to a cupboard and pulling out a document and then trying to find what page the first checklist is on.'

A firm plans for the worst

'We've got a very long list of things that might go wrong and we are now trying to pre-empt them and say what would we do,' says Craig Fraser from Brown & Bird, which has 25 staff in Mackay and five in Brisbane.

'We think that our top risk would be [a] cyclone. Our second-top risk would be flooding, as we have a river through the centre of our town and we have more than half our staff on the other side of it. Our third risk would be fire.

'Really, if we had a fire the resources of the town would carry us. If one of the other two happened there would not be sufficient resources in the town to cover us. We have to have plan B.

'Our best contingency we have come up with so far is that we would fly a couple of key people to Brisbane where we have a small office. We believe we could be up and running remotely within about 48 to 72 hours.

'We do realise that those key people may have problems of their own and it may not be practical. In my own case I live near to a beach. My property will probably be one of the first casualties.'

Lessons from Larry

One of the major lessons learnt from Cyclone Larry was that businesses need to think about securing their records, says Gerard Byrne CPA from Queensland's Department of Primary Industries and Fisheries.

'What we found with [Cyclone] Larry is that people lost the computer, lost the power, lost their paper trail, lost their electronic trail. It is very hard to reconstruct records.

'We had that problem with accounting firms being out of action for some time. You need to know what your critical records are, where are they stored, where are the backups and how quickly can you recapture the information?' Byrne says in a disaster's aftermath insurance companies and the government will ask for records in order to assess relief.

One of the problems with Cyclone Larry was that accountants' clients all wanted their records reconstructed at the same time. 'If you are a small business and you have your records in place,' Byrne says, 'you can more quickly and easily get access to government assistance.'

The other problems faced by businesses during crises is the lack of services. The phone lines go down, there's no internet, and mobile phone batteries can't be recharged. 'If you have a large cyclone or a large storm you [may] lose power,' Byrne says. 'How does that impact on your business?'

Countries most hit by natural disasters – 2006

Source: International Strategy for Disaster Reduction

Natural disasters by number of deaths – 2006

Source: International Strategy for Disaster Reduction

Crisis management checklist

• identify the major risks your business may face
• have an up-to-date list of all staff contact details
• define crisis-mangement team and 24-hour contact details
• define alternates in case of holidays or if team members are out of contact
• establish a list of important telephone numbers: government agencies, police, PR and advertising agencies, security consultants, lawyers and so on
• establish a team that will run the business while the crisis is being handled
• establish an emergency response room that has computers, fax, web access and telephone lines
• identify how you will communicate during a crisis and will handle a massive rush of phone calls and internet hits
• remember: inadequate systems may crash
• make plans for most likely scenarios
• run a crisis-management simulation
• keep the plan up-to-date

Further reading

• 'Catastrophic disaster planning and recovery', Les R. Nettleton, CPA Technology Advisor, November 2006
• 'Disaster recovery planning: how do you measure up?' Liz Gold, Accounting Today, April 16 to May 6, 2007
• 'Picking up the pieces', Stuart Kahan, Accounting Today, CPA Wealth Provider, April 2006
• 'Weather any storm', Anita Dennis, Journal of Accountancy, December 2006

All available from the CPA Library:

• phone: + 61 1300 73 73 73
• email: cpalibrary@cpaaustralia.com.au
• search for and request items from the Library section of the website

Reference: July 2007, volume 77:06, p. 30-31

Page last updated: Thursday, 28 June 2007