Disaster can strike in a matter of seconds. On February 12, a fire turned the Windsor building, one of Madrid’s most famous skyscrapers, into ashes. At the very center of the capital’s financial district, the Windsor was home to the Deloitte consulting group and three departments of the Garrigues law office. Hundreds of documents, confidential memos and critical data files were reduced to ashes. This information was crucial for companies that were using these firms to prepare their annual reports. The origins of the fire remain unknown. Clearly, it would have been a catastrophe if the companies had not counted on contingency plans and back-up centers that allowed them to resume operations fairly easily, in a matter of hours.
Managers at Deloitte and Garrigues knew nothing beyond the dimensions of the fire, which could not be extinguished until Sunday morning. However, they began to put their recovery plans into effect right away. Although it was Sunday, they scheduled a flurry of meetings where crucial decisions were made. Their only objective was to get people back to work by Saturday. The Deloitte crisis team, which counted on 1,200 employees at the Windsor building, rapidly informed people that all their data had been stored in a back-up data center. That was crucial because Deloitte has been the largest auditor in Spain ever since it took over business from the old Andersen group. Deloitte manages two-thirds of the selective Ibex-35, and 40% of the overall market. At this time of the year, it was heavily involved in preparing annual reports.
Those Garrigues departments affected by the fire — processing; industrial property; intellectual property and information technologies — decided on Sunday morning to relocate their 133 employees in an IBM back-up center near the Barajas airport. Big Blue is Garrigues’ provider of emergency services, and the law firm had contracted for a back-up center that now allowed it to rapidly re-start its operations.
Contingency Plans
“The first thing you do when you build a skyscraper is analyze and evaluate risks,” explains Luis Solís, area director for operations management at the Instituto de Empresa business school. “You try to identify possible risks and what can cause them.” A report by IBM shows that fires are the most likely reason for a disruption of activities; they are the cause in 17.5% of all cases. Acts of terrorism and sabotage (including computer viruses) cause an additional 17.5% of disruptions. Other common sources of headaches for organizations include atmospheric disturbances (14%), earthquakes (10.5%), power outages (9.5%), software errors (8.8%), floods (7%), and hardware errors (5.3%).
“Some simple construction work can ruin all the systems in a company by accidentally breaking a wire,” notes Enrique Rollán, director of information technology outsourcing at EDS. Telefónica became a victim of this kind of error two years ago when a machine accidentally broke a wire, preventing it from providing telecom services. “These companies cannot allow themselves to stop providing services. They need alternative centers that guarantee they can continue operations in case of failure,” adds Rollán.
Solís stresses that every company must analyze its exposure to various kinds of risks and how serious the impact will be if a disaster strikes. “Companies must evaluate the probability of an event; high, medium or low, and then, how serious the impact will be — high, medium, or low. That way, they can find out if they face risks of low probability and high impact (such as an earthquake) or risks of high probability but low impact (such as a cable cut by construction work).”
The attacks on New York’s Twin Towers on September 11, 2001, demonstrated that we can never entirely discount any possible risk. Before 9-11, the notion of two planes crashing into the Twin Towers seemed too far-fetched, even for fiction. But it happened. Low probability, great impact.
Being Prepared
Within minutes after the first plane crashed into the North Tower, managers at a few of the 430 companies directly affected were calling their service suppliers to prepare locations where they could restart their business activities. “That day, we relocated 4,000 employees from many companies, such as American Express, in an alternative center in a New York suburb,” recalls Rollán. Amex and Lehman Brothers were two of the earliest companies to start functioning from centers in New Jersey, because they had prepared for any disaster by drawing up contingency plans.
“Basically, this kind of plan defines how you are going to behave in the event of a disaster,” explains Solís. “The most important part is to eliminate all improvisation that can result from not foreseeing a situation.” In his opinion, panic is the worst enemy in any emergency. Nevertheless, that kind of emotional response is very human. “Very often, panic makes you take a very rapid response that is probably not the most appropriate one.”
The attacks of 9-11 demonstrated the capacity of many U.S. companies to respond even to the greatest disaster. But Solís believes this mindset is not so well established outside Anglo-Saxon culture. He recognizes, however, that the impact of the Twin Towers has raised awareness among managers responsible for disaster planning. Between 2002 and 2003, there was a 13% increase in disaster simulation trials. Since 9-11, they have grown by 33%.
According to Juan García Gay, a risk-management consultant at the Marsh consultancy, “Spanish companies are barely concerned about these subjects. What is worse, they are not prepared to face these kinds of risks. Clearly, having a business continuity plan is no guarantee that we are able to anticipate a specific event, but we can deal with and manage it successfully.”
Both Deloitte and Garrigues, the two firms most affected by the Windsor fire, say they used their contingency plans and did not lose any data. Garrigues, which occupied the seventh and eighth floor of the tower, also had its data center there. “Our last back-up had been made on December 16,” says a company spokesperson. However, the company has lost little or no data. “Our professionals always make a security copy. In addition, almost all of them work with a lap-top computer that they take with them,” he adds.
Antonio Garrigues Walker, president of the law office, recognized on February 16 that the firm had copies of almost all the material destroyed in the fire. He added that he was confident they could recover some data from the computers that were in Windsor. He said those machines “are alive.”
PrimaryCenter, AlternativeCenter
The goal of disaster centers is to guarantee that, if an unexpected event destroys a company’s data systems, the company can get up and running right away. Service providers offer two kinds of centers. “The first is a data center where they keep all the information,” explains Rollán. “The second, or alternative center, has back-up copies of all the data.”
These buildings are constructed with the highest level of security. They are located in areas where there is a low probability of natural disaster. Ordinarily, these sites are outside the central business center to avoid attracting attention from terrorists. “Normally, the second center is located in a different province from the first one,” adds Rollán. Depending on the contract with the service provider, the information is either copied automatically or is stored in discs that can later be brought to the disaster center for storage.
These kinds of buildings have the most advanced technology, including equipment and services from a range of vendors. Companies can also contract to relocate their personnel to the remote location, if necessary, as in the case of September 11 and, more recently, Windsor Tower. According to Rollán, the normal practice is to move between 10% and 20% of the staff for a period of one to three months.
According to Solís, “Generally speaking, banks and financial service companies are the most advanced at doing this. Their back-up systems may even be located in other countries because they depend so much on data.” According to IBM, banks and the financial service firms are affected in 26% of all disasters; more than any other sector. Risks are highest there because those sorts of firms cannot afford to shut down services. Other major victims are government agencies (19.1% of all cases), and communications firms (8.2%).
Double Victims
Whenever a disaster strikes, there are other victims beyond those companies that are directly affected. The entire business community nearby also suffers. The fall of the Twin Towers affected several buildings around the World Trade Center. In Madrid, three nearby office buildings (Bronce, Orense II and Orense IV), as well as the Cortes Inglés de Castellana [department store], were shut down after the fire. No one knows how long it will take for them to reopen. In addition, shops, restaurants, kiosks and all sorts of services near the Windsor have been forced to close temporarily.
According to Copyme, Spain’s general confederation of small and medium-size companies, every business within a radius of 500 meters is going to be affected by the Windsor fire for some six months. Some of those businesses will have to be shut down for good, and others will have to cut their staff. In addition, a barrage of lawsuits has already begun, and that will have a direct and negative impact on insurers. Both El Corte Inglés and Windsor had signed insurance policies with Allianz that, predictably, will force the insurance company to face a bombardment of claims.
Asón Inmobiliaria de Arriendos, the real estate firm that owns the Windsor building, has also filed a criminal indictment while awaiting clarification about what started the fire and who was responsible. For the time being, no one knows how the disaster began. However, the number of victims — not all of whom were prepared — continues to grow.
