Companies should be better prepared to deal with losses.

• Author: Book, Elizabeth G.

So-called "business continuity plans" have become a primary concern for private firms and government organizations since the sudden destruction of the World Trade Center, experts said.

Even though contingency preparation is not a new concept in the business world, the collapse of the Twin Towers has prompted companies to reevaluate their planning.

A case in point is New York-based Marsh Risk Consulting, which has been in the business of advising companies on loss analysis and developing continuity plans for the past 150 years. But Marsh had never tested its own internal continuity plan prior to September 11, when it had to be exercised.

About 1,700 of the company's employees worked in offices between the 90th and 100th floors in Tower 1 of the World Trade Center.

One contingency plan that Marsh had never considered was how to continue operating in the event that the entire staff were incapacitated or eliminated.

"Marsh lost about 300 people that day, and we never thought of that," said Scott Lochman, a senior vice president at Marsh. "We got an opportunity, unfortunately, to exercise our own business continuity plan, and we learned a lot of lessons," he said during an industry conference in Arlington, Va.

Lochman said it is important to consider that you can have the best information technology infrastructure, the best back-up systems in the world, and you can recover in four hours. [But if] you don't have anyone to operate the systems, you cannot continue."

An important consideration is how to transport employees to an alternate location to continue operations if necessary. "You can have 27 laptops set up at an alternate location," but they're worthless if the employees can't get to them, he said. Lochman also recommended that lists of employee contact phone numbers and continuity plans be stored in places other than the office, "in case the office isn't there when you get back."

Lochman explained that consequence management involves more than just disaster recovery. "You can have a disaster last five minutes at your organization, and you can recover from it within five minutes. Business continuity is a natural progression. If something happens, whatever is done needs to flow from the senior chain of command. If it doesn't, you will have a lot of people scurrying around, thinking they know what needs to be done."

There are four types of continuity to consider, Lochman said. They include financial, strategic, operational and hazard-related...