Disaster Planning Moves toward Center Stage after Terrorist Attacks

Article excerpt

The terrorist attacks on the World Trade Center and the Pentagon did more in a single day to boost the profile of contingency planning than did years of exhortations from regulators and disaster-recovery professionals.

Financial institutions for the most part performed admirably in getting their operations back up in the wake of the attacks.

But crucial lessons were learned.

Institutions with operations at or near the disaster site are now taking stock of how they can improve their preparedness, while those in other parts of the nation are absorbing the reality that contingency planning has become a front-and-center concern.

"Everyone to some extent is looking at this issue," said Ted DeZabala, a partner in Deloitte & Touche's enterprise risk services group.

The attacks showed financial institutions that they should be doing more to prepare for any type of disaster. Even the most basic assumptions - for example, a plan that calls for staff to fly to a backup facility - have now been challenged.

An important new need that emerged is to disperse operational sites over larger geographic areas. Companies also discovered that their own ability to recover is tightly connected with the ability of their numerous suppliers and partners to get back into business. And they found that information held on personal computers and local area networks must be given the same disaster- recovery consideration as major data centers.

A recent real estate transaction between Lehman Brothers and Morgan Stanley illustrates the new nature of business-recovery planning. Within a month of the Sept. 11 attacks, Morgan Stanley had arranged to sell a one-million-square-foot office tower to Lehman Brothers. Like many institutions, Lehman was caught short of space when its offices in the World Financial Center, adjacent to the former World Trade Center, were closed.

But the transaction also served a valuable purpose for Morgan Stanley. The 32-story building that it sold is only a block away from Morgan's Times Square headquarters. If the investment bank were to keep both buildings, its trading and backup facilities would be concentrated in two buildings that are dependent on the same transportation and power infrastructures.

Now, Morgan Stanley "will be better positioned from a business continuity standpoint," Philip J. Purcell, its chairman and chief executive officer, said in a statement when the deal was announced.

Mr. DeZabala said most of Deloitte & Touche's large clients did well in terms of recovering their operations, but a lack of geographic diversity was problematic for some. Companies that did not recover so well erred in having too many business units relying on the same backup facility, or in having a backup site too close to the epicenter, he said.

"Nobody had anticipated a disaster of this magnitude," Mr. DeZabala said.

J.P. Morgan Chase & Co. managed to avoid serious operational glitches, even though it has four office buildings in downtown Manhattan. Processing for treasury services, one of MorganChase's largest businesses, is done in Brooklyn, with redundant centers as far away as Tampa and Dallas.

"We were in a fortunate position," said Linda M. McLaughlin-Moore, senior vice president of treasury services and global clearing at J.P. Morgan Chase. Having backup sites in faraway locations makes recovery easier from a staffing, telecommunications, and equipment perspective, she said.

Even though data processing went smoothly at MorganChase, Ms. McLaughlin- Moore is brimming with ideas about how contingencies surrounding one of the company's most vital functions - moving money - can be improved.

The tenuous nature of the links that connect MorganChase to its clients, its vendors, and its competitors became apparent in the aftermath of the disaster.

A number of MorganChase's clients had not tested their contingency sites in a long time and had not accounted for upgrades that were made to software packages, according to Ms. …