A number of fires in office buildings have recently been reported on, resulting in businesses evacuating their staff to safety. In particular, the fire in the Bank of Lisbon building in the Johannesburg central business district must serve as a wake-up call for organisations in both the public and private sectors, says Willem Olivier, GM: Africa at ContinuitySA. Specifically, organisations need to consider their ability to mount an emergency response to similar disaster, and then how quickly they would be able to recover.

"When a disaster like this happens, it's natural to focus on its causes and the emergency response by the authorities but, for businesses, the real issue is how well and how quickly they will be able to recover," he says. "The organisation's resilience is intimately linked to how sound its business continuity plans are and whether it has a suitable work-area recovery facility in place. It's just not acceptable if it takes the business two or three months to recover. One also has to consider the impact of the recovery time on the total supply chain - many organisations might be affected."

An organisation's ability to recover quickly and effectively is vital. According to the Federal Emergency Management Agency (FEMA) in the USA, 40 percent of businesses never reopen after a disaster, and of those, only 29 percent are still operating after two years.

"Organisations should be using this tragedy to prompt them to ask three critical questions," Mr Olivier says. "Only once they can answer them satisfactorily will they be able to enjoy some peace of mind."

Do we have a proper crisis management response plan and process in place? When any disaster happens, the first priority is to safeguard one's people and information. This emergency response is only the beginning though - the organisation must have a proper process and team in place to handle communication with stakeholders, including the media, and initiate the recovery process. Most crisis management plans are extremely lengthy, and are likely to be left behind in the office anyway. Crisis management plans must provide members of the crisis team with the essential process flow that they must follow in the heat of a crisis, and enable them to switch from emergency to crisis management mode. Many crisis management teams miss this crucial shift between emergency and crisis management execution.

Do we have a work-area recovery facility if we need it? In the face of a major disaster such as the abovementioned fire, it is essential to have a fully functional and tested alternate workplace ready to receive at least the critical staff. Too many organisations focus on the costs of such a facility but the real costs of not having one really come into focus when it is needed. Obtaining suitable office space and equipment only once a disaster has happened is both time-consuming and extremely expensive.

Mr Olivier says that a key consideration is whether to insource or outsource the recovery facilities. He cautions that insourcing has many pitfalls, not the least of which are the difficulty of establishing the hidden costs, such as management and procurement costs, and the need for ongoing capex. By contrast, outsourcing is totally transparent, is an easily budgeted monthly operating expense, and includes access to expert help.

"There are many ways of reducing the cost of developing a recovery solution once a proper business impact analysis has been completed. For example, seats in the recovery facility can be syndicated between organisations, or dedicated to just that one organisation, as can space in the recovery data centre - the savings from carefully planned syndication can be massive," he says. "But, in the final analysis, the cost has to be seen in light of the value of the business itself."

Are we sure our crisis and business continuity management plans actually work? Regular testing under crisis-simulation conditions is absolutely vital. A crisis is no time to find out that you don't have enough seats at the recovery site, or worst of all that there aren't any, or that the crisis management team does not know how to cope with the temporary absence of one its members. Some companies may also have a high reliance on paper-based processes, such as claim forms for a medical aid, that require special processing technology. All of these eventualities need to be included in the testing of one's recovery solution.

Mr Olivier cites the example of a government office that was unable to access its building for two months last year owing to a sewage leak. Thanks to rigorous planning and testing, 200 staff members were able to successfully relocate within a day to their recovery facility and their vital work was continued uninterrupted.

"Disasters often result in tragic consequences and questions are raised as to why it happened. As proactive as an organisation may be to avoid disasters, sometimes incidents outside of the control of an organisation affects its ability to function in the future," he concludes. "Proper business continuity planning and testing is the only way to ensure a disaster isn't permanent."