Many businesses never reopen after a calamity. How BAE Systems survived catastrophic wildfires.

NIGHTMARE SCENARIO: WILDFIRE

October 22, 2007, 3 a.m.: Wind-whipped wildfires blaze toward Rancho Bernardo, California, 25 miles north of San Diego. Heavy smoke blankets the local corporate park, home to such giants as BAE Systems, a global defense and aerospace company. With many BAE ­employees already at work, the entire area comes under a mass-evacuation order.

WRONG IDEA: COMPLACENCY

IBM, surveying 1,200 CFOs and senior finance executives in 79 countries last October, found that 62 percent of companies with more than $5 billion in ­revenue encountered a major strategic, operational or geopolitical risk event in the last three years — and 42 percent of those enterprises were ill-prepared for it. This translates into lost business and eroded brand value: New products or services can be delayed or abandoned, and customers turn elsewhere.

“We came through safely largely because we began taking wildfires seriously after the 2003 blazes,” says Ed Langmaid, BAE Systems’ director of business continuity. IT-related business-continuity threats are typically the most lethal; in 2007, more than half of the CEOs surveyed in SteelEye Technology’s annual Business Continuity Index found that ­outages extending longer than 24 hours were potentially fatal to their organizations.

BRIGHT IDEA: GAME PLAN

BAE Systems belongs to the nine-member Rancho Bernardo Business Preparedness Consortium, founded in 1995 around idea-­sharing on OSHA and environmental issues. Now, when Langmaid meets quarterly with corporate neighbors like Sony and Hewlett-Packard, disaster planning and business continuity are high on the agenda. Here are Langmaid’s three major pillars for an effective continuity plan:

• “First, analyze all risks likely to have an impact on the business, from power outages and computer viruses to major natural events,” Langmaid says. Taking proactive steps such as succession planning, emergency-team selection and training and IT backup and recovery can prevent major headaches later on. System testing and practice runs are critical. Langmaid regularly stages drills ranging from desktop orientations to live ­evacuations.

The solution? “The message and motivation has to come from top management, who must be seen as fully committed to the program themselves,” he says.

• Disaster strikes — what now? In any emergency, the next step is to make sure em­ployees are safe, survey the damage, then evaluate readiness for a return to business — which includes documenting the lessons learned.

• Business recovery. Depending on damage or loss, this can encompass everything from reaching out to customers and suppliers to relocating the business to restoring critical IT services and software. “Disaster planning and exercises can be ­complicated, but in the long run, planning and preparation can keep things simple,” Langmaid says. 

Next article » I Know You

Previous article « 10 Questions for Pamela Liebman