We Thought We Were Ready
For the most part, the region had been relatively quiet since three estimated 8.0 quakes rocked the area in 1811-1812. However, in the following “someday-it-will-happen” scenario, things are about to change.
At 9:10 on a Thursday morning in late October, a 7.3 earthquake occurred on the New Madrid Fault. The epicenter was identified as being 30 miles east of the Jonesboro, Ark. The quake was felt as far away as New York, where drapes swayed and windows rattled slightly. Cities within an 80-mile radius reported widespread and extensive damage, confirmed loss of life, and hundreds of injuries.
In one representative city to the southeast, all government agencies and departments in and around the civic center immediately activate their emergency response plan. They dial 911, evacuate facilities, assemble in the parking lot, administer first aid, and do a head count. Responses from the emergency authorities followed, but were sporadic due to their own department damage and responses requiring higher priorities.
Within a matter of minutes, the county declared a disaster. They activated their emergency operations plan and opened the county emergency operations center. From there, calls requesting staff assistance went out to the various county agencies/departments, Red Cross, state government, radio operators, and others. The operations center’s primary objective at that point was to coordinate the multi-jurisdictional responses to the disaster.
Back at the city’s civic center, some of buildings were severely damaged, and some will be red tagged and later demolished. Others can be occupied relatively soon, but the remaining ones must be repaired and it could easily take months. In slightly over a minute, most city and county agencies/departments found themselves without a place to sit, communications, information systems, files, work area, equipment, supplies, forms, contacts, and all the other resources they normally used on a daily basis to deliver program services.
In the adjacent parking lots, parks, and streets, clusters of agency/department staff are gathered. Without exception, all of them are trying to figure out what to do now and where to go.
They can’t use their emergency response plans because the plans stop after the response related tasks. None of the plans contained information on recovery or resumption of agency functions. Each city agency is now left on their own to start figuring out what needs to be done and how to do it. In other words, they’re starting a planning process instead of commencing to recover, as they should be doing. In many cases, this planning process is further hampered by the loss of staff. Later on, many agencies/departments will find that there was a substantial loss of data that can never be recovered.
In the meantime, citizens will soon be calling and arriving at various city and county agency/department locations seeking assistance. To exacerbate the situation, the demand for services will be coming at a time when they need them the most. However it will be at a time when they are least ready to deliver.
The agency/departments having the greatest demand placed on them will be: water, sanitation, police, fire, housing, permits, public works, social services, purchasing, and health care. They’ll soon be pushed to their limit. To further compound the situation, these agencies/departments must also start to recover and rebuild, and they may have to do it with no plans and a reduced staff.
In reality, statistics show that there is a greater than 60 percent chance that the agency/department will never fully recover, if at all. So in this scenario, why did this happen?
The bottom line is there was neither an awareness nor requirement for any type of plan beyond an emergency response and/or emergency operations plan. Had there been, a policy would have been developed that required each agency to have a comprehensive plan that addresses response, recovery, and resumption issues.
Think Of Your Public Organization As A Business, And Treat It Like One
Even though public entities are “not for profit” in nature, each one is, in fact, a business. Furthermore, each exhibits and shares most of the inherent characteristics found in any private or publicly traded service oriented company.
The genesis of a public entity is a reaction to a needed service to the public. Once your entity is established, one of the first steps is the development of your mission statement, or a business plan.
To finance your objectives you’ll need start-up capital, not from a bank, but through elected officials. From there, you’ll develop an organizational structure from line workers to management. HR is established to hire the staff that will deliver the service. The staff resides in a building that is owned or leased, and within that facility you have established work areas. Your staff performs certain tasks identified within their job description to deliver service to the public.
In return for the tasks performed, a payroll department exists to provide compensation to the employees. To support your business, internal and external services are required, along with special equipment, supplies, consumables, and forms. Purchasing negotiates the pricing, and the legal department addresses contractual issues.
The mailroom coordinates incoming and outgoing items. A/P and A/R process revenues and expenses, and you’re expected to run within a budget. You’re accountable, not to shareholders, but to your elected officials and to your constituency. You utilize internal and/or external information technology to support your line of business. Voice and data communication circuits connect you to the outside world. You must comply with certain laws and regulations, and you’re subject to both internal and external audits. Finally, you need to provide, just as in the private sector, consistent and continuous service, even after an emergency or disaster.
Expectations Of Continuous Service
In the private sector, the ability to rapidly recover from a disaster and resume business operations is critical to the survival of the business. In the public sector, that same availability of services requirement is no different. In fact, it is probably even more critical in order to ensure both continued and expanded services to the public at a time of greatest need. To accomplish this, a continuity plan (sometimes erroneously referred to as a disaster or business recovery plan) is absolutely essential and should not be an option.
Is An Emergency Plan Enough?
Though many documents carry the title “emergency plan,” more often than not, they are limited in scope. It’s the objectives and details contained within these plans that often differ. Therefore, if your department’s objective is to be able to respond, recover and resume operations, this type of plan may fall short of your expectations.
To determine if your plan maps to your objectives at time of need, locate your Emergency Response Plan and read the document. What you will most likely find is a plan that addresses one of the two foregoing possibilities, or maybe both:
Possibility 1 – An emergency plan that details a set of procedures on how to immediately respond to an emergency situation at your normal work location. It is an OSHA requirement if you have 10 or more individuals at your work location. It commonly includes: emergency instructions, 911, attending to the injured, evacuation routes, floor wardens, search zones, assembly points, utility turnoffs, emergency numbers, etc.
Note: This type of information is generally included in any continuity plan.
– or you may discover –
Possibility 2 – An emergency operations plan that details the actions a government entity will take to coordinate and provide emergency response type services to the public, immediately following a disaster. Often these plans coordinate multi-jurisdictional responses and are usually coordinated out of an emergency command or operations center. Functions are often grouped (teams) into five general categories: management/command, operations, planning/intelligence, logistics and finance/administration.
Note: This type of plan is intended to address response type issues and is mutually exclusive of a continuity plan.
Before we go any further, it should be noted that both types of plans may be necessary.
Furthermore, each one is designed to address specific emergency response efforts immediately following a local or regional disaster. These plans identify the responses, tasks required, sequence, resource requirements, and the step-by-step instructions necessary to complete each operation. By design, all identified tasks are intended to address: mitigation, life, safety, and health issues.
If you discover that your organization has only these response-orientated types of plans, and there is nothing else included, then you probably do not have a comprehensive plan. For in truth, an emergency plan is only a small, yet very important part of a complete disaster recovery program. Therefore, if your true objective is one of having a complete response, recovery, and resumption plan, then you will need to expand your strategy.
Continuity Plans
A continuity plan provides your public organization with the necessary information to not only respond to the emergency/disaster, but also to recover and resume operations of the critical services your public entity provides. It’s a type of plan that both the public and private sector should consider a necessity. It follows a best practices methodology that utilizes a multiple recovery team structure that addresses all elements of your organization.
By following this process, each recovery team has a predefined set of responsibilities that are grouped within five specific stages:
Response – Initial response to the event: life, safety, first aid, evacuation, 911, containment, etc.
Recovery – Restoring all, or part of, your work environment in preparation of resuming business.
Resumption – Restarting and resuming your business activities and functions.
Reconstruction – Rebuilding your damaged facility or finding a replacement location.
Relocation – Moving your business back to a permanent location.
Once you’ve identified the recovery team structure you will be using, team leaders will need to be assigned. Each of the team leaders will start the development of their team plan by identifying all tasks that must be performed. The tasks that have been identified will then be sequenced in the priority which they will need to be performed. For each task, detailed instructions will need to be provided on how to perform it. Finally, your continuity plan will be comprehensive enough that it can be followed with or without key staff members.
Critical Team Plans
As previously mentioned, a continuity plan is made up of multiple recovery teams. Let’s take a look at what some typical team plans may be:
Emergency Response Team – Emergency instructions, 911, attending to the injured, evacuation routes, floor wardens, search zones, assembly points, utility turnoffs, emergency numbers, etc.
Crisis Management Team – Establishes policy and handles the overall management of the recovery and resumption efforts.
Administrative Team – Addresses logistics type of functions such as personnel, lodging, food, travel, etc.
Damage Assessment & Reconstruction Team – Operations type of function that assesses the damage, recommends recovery efforts, and coordinates the reconstruction efforts.
Information Systems & Data Communications Team – Addresses the recovery and resumption of IT and network functions.
Support Functions Team – Addresses other support functions such as: accounting, purchasing, payroll, etc.
Public Services Team – A team plan for each core business or public service your organization delivers.
Where Should You Start
Predicated on your department’s requirements, the strategy you develop, and the objectives you’ve set, you need to:
• Review your existing “recovery plans,” to determine what type of plan you currently have
• If you find a “response only” type of plan, build a case for developing a continuity plan
• Present and obtain director or department management commitment to developing a continuity plan
• Perform a risk assessment and businesses impact analysis
• Reach concurrence within your department as to what your recovery objectives and strategy must be
• Identify the recovery teams you will be using and select team leaders
• Select the recovery software you will use for plan development
• Develop each team plan to meet your recovery objectives
• Rotate critical information offsite
• Identify a recovery location
• Test your plan
• Don’t be satisfied until you reach the goals you have laid down
Remember, an emergency response plan that addresses only response related issues will get you to the parking lot, not back in business.
Norm Koehler, CBCP, CRP has extensive experience developing continuity plans in both government and private sectors. His 30-year career in IT has ranged from tech support to a director level position in continuity planning. In 1997 he founded BRProactive, Inc., (www.brproactive.com) a company that provides comprehensive software templates for expediting your recovery plan development.
