Staff are the first line of defence

However, banks may not be doing enough. John Sharp, chief executive of the Business Continuity Institute in the UK, whose members include Deutsche Bank, Morgan Stanley, Merrill Lynch, Citigroup, JP Morgan Chase, ABN Amro and Goldman Sachs, says some organisations have failed to appreciate that it is no good backing up computer systems if they do not have the people to run them.

Sharp says: "The greatest disruption to any organisation will come from its people. Companies need to prepare their people, their processes, their premises and their providers, in that order."

Nick Simms, managing director of Cornwood Consulting, a business continuity specialist that works with banks, says: "We are disappointed in the work that is being done in the City of London. Even after September 11, 2001, few banks are focusing on what needs to be done to let people know what to do if there is a disaster."

Preparation means thinking of everything, from escape routes to smooth decision-making and the physical needs of staff, such as food, as well as contacting relatives and providing counselling.

Many financial services staff would be expected to work at back-up trading floors and other disaster recovery centres up to an hour's journey from their present offices.

Sharp recalls how one organisation placed canisters of water in the lifts during a fire service strike in the UK this year; if a lift stopped and rescue took some time, staff would at least not dehydrate.

Since September 11, business continuity has become a more urgent issue. In August, the World Markets Research Centre, an intelligence firm, identified the UK as one of the countries most vulnerable to terrorist attack. It singled out the Houses of Parliament and Whitehall as particular targets. However, financial services firms are also seen as being at risk.

John Smith, head of group security at Prudential, the insurance and fund management group, says: "There is little point in protecting Whitehall if the City of London is devastated."

Smith says the main threat from terrorists is explosives. Prudential has reviewed the risk of chemical and radiological attacks, but like most other businesses believes it is small. If such an attack is launched, a few basic measures can limit air movement.

Smith says: "Close windows, turn off the air-conditioning, stop people from using lifts and switch off computers and printers, which contain fans. Also, do not leave the building until told to do so by the emergency services and then only go in the direction they indicate."

Roger Davies, a former British military counter-intelligence officer who has advised businesses around Canary Wharf, agrees that the threat of chemical attack is exaggerated. He says conventional weapons are more likely to be used although attacks could be very different from the IRA bombings, such as the Baltic Exchange blast in London in 1992, because warnings might not be given.

Nevertheless, there are ways of mitigating the danger. "Businesses may consider moving desks away from windows and having people facing away from glass," says Davies. He also advises that staff should gather in an area providing structural security in the event of a bomb. This is usually an internal corridor with no external windows or walls.

Sally Leivesley, managing director of New Risk Associates, the crisis management consultancy, says that whereas in the past only senior executives and crisis management teams were briefed on any terrorist threat, the whole workforce now needs to think not only about escape routes but suspicious vehicles and activities too.

To help prepare for an evacuation, Leivesley has run exercises on trading floors. She says team supervisors are taught to be firm in encouraging people to leave: "The potential to incur large losses means traders can be reluctant to leave their terminals."

Even with preparation, there is no guarantee that people will behave as instructed. Simms of Cornwood Consulting points to the San Francisco earthquake in 1989, when many senior managers rushed home to check on their families, leaving junior staff in charge.

Similarly, since September 11, disaster planners caution that people are unlikely to stay in buildings, whether they are safest there or not.

Security considerations make investment banks reluctant to discuss disaster planning, either with the press or their staff. Some fear it would cause panic.

Simms says: "It is a fine line between preparing for a realistic threat and frightening people unnecessarily."

Experts agree some banks are better prepared than others. Soon after September 11, JP Morgan, for example, offered staff emergency packs containing gas masks, light sticks and water purifying tablets.

Sharp says good preparation of its staff allowed Deutsche Bank to have its US recovery site up and running two and a half hours after the September 11 attacks, compared to seven days for one rival.

"All the arrangements for accommodation and feeding were already in place. They already had the hotels reserved and the catering company there. People knew where the site was, because they had practised in advance."