Law firms have done an admirable job developing continuity plans over the past year, but as client needs and technology continue to evolve, these plans may need updating
Law firms and their business clients have been forced to develop continuity plans over the past year — and have achieved noteworthy success with them. However, law firms, businesses, and the technology they use are constantly evolving. How should law firms and other organizations go about ensuring that their continuity plans remain fully supportive, both now and in the future?
When the COVID-19 pandemic forced law firms and corporate law departments to quickly change their way of conducting business, many of these organizations leveraged existing business continuity plans and were able to quickly resume operations after successfully pivoting to alternate worksite location arrangements and greater employee telework. However, other organizations faltered when they found that their business continuity plans had not kept pace with the changes in their organization or were focused on responding to past situations and did not squarely match their current needs.
What differentiated these two outcomes, and are their guidelines to keep business continuity plans effective — and stay effective — regardless of the specific reasons under which the plans are deployed?
Technology is only part of the solution
Most business continuity plans today place a heavy emphasis on technology to support alternate work locations, flexible communication channels, and continued access to workplace resources. However, law firms should accept that technology, by itself, is only one of several necessary components of an effective business continuity solution.
First, before any technology can be used, workers at all levels must know that it exists and is available to them as part of an organization’s business continuity plan. Merely including a brochure in an armload of new employee orientation materials is insufficient; a better employee orientation should specifically call out the existence of a plan and go over its basics. Even better, a self-guided video or tutorial — in conjunction with written documentation — will better drive home how the plan works and who to contact in case of questions.
This basic foundational step pays real dividends. Not only does it help prepare users for more detailed training, but it also helps prevent users from constructing their own self-help measures, such as e-mailing draft or key documents to personal e-mail accounts, that might detract from the overall plan or, worse, conflict with corporate security practices.
Second, effective and practical user training is critical to ensuring that continuity measures can be successfully deployed. While initial orientation is valuable, actual training should stress not only how to access the business continuity technology tools, but also how these tools fit into existing business workflow. Training will be even more effective when it includes practicing key tasks within the continuity solution, including reaching out for assistance if a user encounters issues. This is especially important if the business continuity solution will look different from a specific tool that it replaces, like the interface of the Microsoft Outlook Web Access vs. the interface of Microsoft Outlook 365.
Don’t just test, stress-test
In addition to training staff on business continuity plans, it is important for organizations to regularly test their plans to ensure that plans can be activated smoothly. Law firms do not necessarily have to repeatedly run the identical tests; in fact, one way to keep employees engaged with the testing is to announce different scenarios or test different aspects of the plan in rotation. For example, one test could focus on establishing alternate communications when e-mail or phone service is not available; other tests could focus on accessing legal research resources and existing work product. Keeping users interested in testing increases their retention of this information, as well as increases overall confidence that these solutions will be effective if the need arises.
When assessing the technology in a business continuity plan, it is extremely important to test the technology in real-world conditions, particularly the projected increased workload on the tools themselves. Testing a remote access solution with 10 users when a typical load would be 100 users does not provide the essential data needed to be confident that the solution will work when it is needed. Many law firms discovered this in the early days of the COVID-19 pandemic; remote access solutions that were fine for supporting up to 10% of a law firm’s employees bogged down or completely failed when 90% of the law firm staff tried to use the solution at the same time.
Further, stress testing should occur after every major change to the business continuity plan, such as a significant technology adoption or update. Testing should also take place at least twice a year, if not more often, to ensure that new employees have practical experience with the tools and workflow associated with the continuity plan.
Every plan needs a backup plan — and a replacement plan
Most law firms and corporate law departments have invested in some form of technology that permits staff remote access to electronically stored files and resources via VPN, virtual desktop, or other technology. These solutions are key components of business continuity plans, and for good reason: when implemented well, they can permit lawyers and staff to perform much of their existing work, regardless of location. However, these solutions also depend on interconnections between multiple software tools, and upgrades in one of these may disrupt how the overall system runs. In addition, these solutions require a functional internet connection; users unable to connect may lose all access to their ongoing work — and the tools to recreate it.
A well-rounded plan should always include multiple avenues for staff, especially key employees, to remotely connect to law firm resources. For example, should some staff be issued cellular modems (MiFi units) in case their home network loses power or internet connectivity? Does the law firm’s remote solution support alternative ways to sign into a remote session even if Personal Identification Verification cards are lost or unavailable? Offering multiple paths to connectivity increases the likelihood that one or more of these solutions will work for the highest number of people.
A good business continuity plan will also offer guidance on how employees can stay productive even without the internet. This could include a requirement that employees always bring their corporate laptop computer home with them or be authorized to perform official business using personal equipment. Other plans have included streamlined ways for an employee’s last 20 edited documents to be cached on local storage or made available to for copying to removable USB storage (preferably encrypted and password-controlled). Good plans will also include multiple ways for employees to contact one another via phone, e-mail, virtual platforms, messaging services, and other communication channels. Again, the more possibilities, the more likely that the business continuity plan will be effective in a broad range of circumstances.
Finally, a strong business continuity plan will recognize that it must continue to improve and incorporate modern technology into its design. Law firm management should recognize that business continuity technology is not static and requires ongoing maintenance, research, and funding as both the organization and its technology needs change over time. However, even as technology changes or becomes obsolete, the business analysis that determines which legal resources are most critical and the priority in which resources should be made available to staff will likely change much more slowly.
Conclusion
It is easy to overlook business continuity planning until it is suddenly needed. However, as the legal community demonstrated with its pandemic response, effective plans can replicate tremendous functionality and perhaps even drive long-term change.
