Longstanding Sungard Availability Services customer Augentius, one of the largest independent private equity and real estate fund administrators in the world, found itself caught up in the 2017 London Bridge atrocity in which three terrorists killed eight people and injured 48.
The combined vehicle ramming and stabbing attack took place directly outside Augentius’ London office, resulting in its evacuation and closure to allow the police to collect forensic evidence. Faced with denial of access to its premises, Augentius activated its disaster recovery (DR) and business continuity (BC) plans.
The incident occurred late on a Saturday night, which allowed the firm to monitor the situation on Sunday and plan its response before the new business week began. By late Sunday afternoon it became apparent that access to its office on Monday morning was unlikely. Augentius’ London DR team met via conference call and plans were put in place on the basis that the building would continue to be unavailable for the next 24 hours. This included invoking Sungard AS’ Docklands Workplace Recovery Centre and preparation of IT systems to allow staff to work from home. Finally, all staff were notified of the situation and advised not to travel into the London office until further notice.
The DR team met again via conference call at 0700 hours on Monday 5 June, having monitored the situation since 0600 hours with the premises manager. When it was confirmed that access to the London office was still not possible, Augentius implemented its DR plan. Staff were updated at 0730 hours as promised, confirming that the office was closed and that they should not travel in to London, and then clients emailed at 0830. From 0900 onwards, these emails were supplemented by personal calls from Augentius’ client service teams.
When the business day began some 60% of Augentius’ client service staff were either remotely logged into the company’s systems from home or working from the Sungard AS DR site with over 95% being fully operational by 1000 hours. In line with good practice, Augentius tests its IT systems annually, has put in place an emergency notification system and contracts a number of Workplace Recovery positions for key employees at one of Sungard AS’ workplace recovery centres.
The smooth arrangements ensured all client deliverables were achieved during the course of the day.
David Bailey, Marketing & Communications Director for Augentius, who led the firm’s response admits, “Terror attacks weren’t front of mind when we developed our business continuity plans. After all, most disruptions are caused by plumbers or builders drilling through cables.”
He explains, “Shocking as the event was, this was probably the simplest BC problem we could have. We were essentially just locked out of our premises – all our communications and other systems were fully operational and we had plenty of time to think about our response. As the attack took place at the weekend, fortunately none of our staff were endangered or witnessed upsetting scenes so we weren’t having to deal with people who were injured or worse.
“Having said that, coming back to work on Tuesday morning was pretty horrendous – it was blowing a gale, London Bridge was still partially closed and the whole area was mobbed with TV cameras and reporters. It was a surreal environment and some staff did struggle with that and went home early that day. Everyone has access to counselling via our health insurance plan and we encouraged teams to chat among themselves, brought in cake and fruit and were generally aware of the stresses that existed.”
According to Dr Sandra Bell, Head of Resilience Consulting (Europe) for Sungard Availability Services, Augentius’ successful response to the crisis was due to its “resilient corporate culture characterised by employees who know what is expected of them and a management team that can think on its feet and make business decisions without panicking.”
She notes, “The Augentius team had excellent situational awareness and associated PR and communications, which meant everyone knew what was going on and they were able to remain fully in control.”
Nonetheless, David Bailey believes lessons can always be learned and the firm has since refined its BC plans as a result.
Lessons learned
1 Due to holidays and other personal events, it was difficult to get in touch with some DR team members over the weekend. As a result, alternative lines of communication have been put in place.
2 Augentius was initially unable to ascertain whether any of its employees had been caught up in the attack as staff were not specifically instructed to acknowledge the emergency message to confirm they were safe. Message wording will now be changed and the emergency communication system tested quarterly by different groups of staff to encourage familiarity with the system.
3 The firm’s email alert system worked but it became apparent that call lists were out of date and did not include temporary and contract staff. This has now been rectified.
4 The company was unable to reroute all of its telephone numbers, roughly 100, quickly so as a short-term fix, it transferred the office reception number to a mobile phone, enabling calls to be answered and handled. However, it is now evaluating software to redirect its direct dial numbers in the event of a future emergency.
5 The incident drove home the importance of reviewing BC plans every 12 months to ensure they are still fit for purpose. For example, Augentius has grown from a business of seven people to over 600 since it drew up its continuity plans and its BC team has grown accordingly. Today, the company has BC teams in each of its eight international offices, each of which handles local incidents while a global BC team will handle any wide area events. Its plans have been updated regularly to reflect this.
Even before the terror attacks, David Bailey had never doubted the value of having business continuity provision. “It’s a fact of business life – you never know what’s coming down the track. The fact that our plans have been put to the test and proved effective is important. Many of our clients are regulated businesses so they need to have the comfort that not only do we have contingency measures in place but that they will work when called on.”