Disaster recovery plans for charities

The last two years have taught us to expect the unexpected. No matter how much you analyse the risks facing your organisation there are likely to be events, throughout the life cycle of your charity, which can’t be predicted. However, you can still prepare your organisation to be ready to react to unforeseen situations by having a Disaster Recovery Plan.

The plan will set out the steps which would be taken if a serious incident occurred. This could be a fire, flood, cyber-attack, immediate loss of key funding stream or perhaps a pandemic. Every charity will have their own scenarios to model. The aim of the Disaster Recovery Plan is to provide a step by step action plan to allow the charity to resume normal operations after such an incident, in particular focusing on continuing to deliver services to the charity’s beneficiaries. The milestones to return from disaster to normal will be assigned to those with key responsibilities and the plan should be well rehearsed within the organisation so that if it needed to be put into operation this would be a smooth and calm process. The charity commission guidance CC26 provides details to help your charity develop a suitable plan.

Unfortunately, we know that cyber-crime is increasingly prevalent amongst the not-for-profit sector. Charities should ensure their IT infrastructure has protections in place to prevent a potential attack. However, should a disaster such as a Ransomware demand be successful, how would your organisation survive? What data do you hold, what data is vital to the charity and how quickly could it be retrieved? Practicing your recovery scenarios will put your organisation in the best possible place to react positively in the face of catastrophe.

When setting your Charity’s reserve policy, it would be useful to reference the Disaster Recovery Plan. The step by step actions may have financial consequences and therefore this is one of the many elements which will dictate the retained reserves required to ensure the financial resilience of the charity.

For those charities that have a plan in place, how useful was it during the pandemic? Existing plans need to be reviewed regularly and updated, incorporating what has been learnt over the last two years. Although you hope to never have to refer to your document it is important to have one in place that is current. A plan with named individuals who are no longer with the charity or addresses that don’t exist will not be much help.

We are able to help our clients establish or review their Disaster Recovery Plans. Please ask for support with this if it is a key policy you are missing within your organisation.