DRJ's Spring 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Winter Journal

Volume 31, Issue 4

Full Contents Now Available!

We in the emergency preparedness business are no different from other professionals, we tend to write articles for each other - to learn from past experiences, new techniques, and products. This article however has a different target; it aims at the conscience of the corporate policy and decision makers.

If these people don't care, we can only continue to do what we think is needed, hope for the best, and, of course, be fully prepared to shoulder the blame for organizational failure.

To all senior executives who have gone to extraordinary lengths to plan for and fund their own personal estate, what have you done lately - if ever - to make preparations to prevent the demise of your organization? Do you know whether your organization has a Corporate Contingency Planner, Emergency Preparedness Specialist, or anyone else -regardless of title- who is responsible for preparing the organization to face the unthinkable?

If you are lucky, buried somewhere in the bowels of the organization is just such an individual. And if found, this individual will probably rank among the most abused and misunderstood employees in the organization.

They know that with the title comes the burden of a mission- almost a Holy Quest - with most of the personal rewards, if any, coming from within.

They spend their time planning for events they hope and pray will not happen - supporting people who don't seem to care - and expecting to be held accountable for events and actions beyond their control.

It is they who know that your organization is subjected to many non-business related perils. And, it is they who are probably attempting to develop organizational contingency plans based on the most probable threat in order to identify the resources required to respond to and recover from an incident related to the threat - including many non-business threats to your organization. Do you even recognize the fact that there are non-business threats to your organization?

So, what are your threats? Basically, any event the consequences of which will deny your organization the use of its normal work area, causing a catastrophic loss of business operations.

These threats are generally classified into four broad categories: Accident - loss of power, transportation accident, chemical contamination, toxic fumes, etc.; Natural - floods, earthquakes, hurricanes, tornado, etc.; Internal - sabotage, theft, (ex)employee violence, etc.; and Armed Conflict - terrorism, civil unrest, armed conflict, etc. Currently, there are over 35 different types of threats that can cause catastrophic business disruption, and new and more heinous threats are on the horizon.

Furthermore, with the rise in terrorism, there is an increasing awareness that one of the goals of any terrorist is to prevent an organization from continuing to function - to cause it to stop whatever goods and services it was providing.

In fact, in Robert Jackson's recent Disaster Recovery Journal article, he states that '...terrorism has a probability of 1:2 [one occurrence in every two years] in the United States at this time.'

You need to realize that these threats are real and can strike at any time; and, the more an organization is concentrated in a single location or geographical area, the greater the risk that a single disastrous event could cause catastrophic business disruption or organizational decapitation. In its World Disasters Report 1995, the International Federation of Red Cross and Red Crescent Societies, state that in 1994 over 160 million people were affected by disasters not associated with wars - 'Disasters and disaster response are here to stay.'

Have you considered the logic behind the statement that 'chance favors the prepared mind'? In the arena of emergencies, success favors the prepared. Preparedness is not just an insurance policy, it is a disciplined process that allows an organization to make critical decisions and judgements during the relative peace and quiet of a normal office routine.

Without this preparedness, the same decisions and judgements have to be made during the chaos of a crisis. Thus, emergency preparedness activities undertaken by the organization are not only essential on their merits, they are critical to fulfilling the organization's obligations to its employees, the clients, and the stock holders.

To put the need for emergency preparedness planning into perspective, the National Archives and Records Administration (NARA) has stated that only 43% of businesses that suffer an incapacitating disaster ever resume operations. Of that 43%, only 29% of those are still in business two years later. Furthermore, the University of Minnesota has concluded that 93% of businesses that lost their data center for 10 days or more, filed for bankruptcy within one year. Of those businesses filing for bankruptcy, 50% filed immediately. This data should lend credence to the importance of corporate contingency planning. It should be a wake-up call for the board room!

More and more, emergency preparedness is becoming ingrained in the corporate culture of private industry. The genesis behind this movement is the realization that the ability to make a profit is directly linked to maintaining and increasing the client base.

Therefore, private industry is becoming increasingly willing to invest in preparedness to ensure that, if the company suffers a significant incident, there will be a disciplined recovery and restoration process to maintain client support. Without this capability, there will be an instant erosion of the client base.

And, with such an erosion, there is a corresponding decrease in profits - without profits, the company will fail. Have you recognized that contingency planning can give your organization a competitive edge?

Prudent executives and their senior managers, throughout every level of an organization, have a critical need to know - in fact, must know in precise terms - what their emergency response and recovery capability is, what it should be, and where the critical points of failure are.

They must further recognize that emergency operations are dynamic. Things change. Periodic reviews and revalidation are required to ensure operational efficiency, and there is a need to take advantage of changing requirements and new technology.

Without the reevaluation, old solutions are applied to new problems. Blindly perpetuating the what if not only prevents progress, it causes regression and can lead to failure. Only with current emergency preparedness knowledge, can managers make informed decisions concerning the prudent distribution of scarce resources.
If asked, your emergency preparedness employee will tell you that organizations that have contingency plans have a greater chance of success than those that do not. However, even those businesses that have plans and are able to recover and reopen often times are not fully prepared to deal with such issues as damage control, back-up system and alternate site failure, and leadership assumption if senior managers are among the causalities. During an emergency is not the time to start to determine what to do.

A sound and functional business contingency plan allows a severely burdened organization, be it private or governmental in nature, to focus on maintaining essential functions.

You need to appreciate the fact that contingency planning is not about letting others prepare for and respond to an organization's emergency; rather it represents, in the truest sense, an organization's assurance that it has the uninterruptible ability to continue to meet its essential commitments no matter what the circumstance.

Furthermore, it is about the organization being committed to a reliable, consistent, and dependable emergency preparedness process that will allow uninterrupted support to its employees, clients, and, ultimately, the stock holders.

If your organization is not headed by managers conversant in the value of emergency preparedness, and your organizational emergency preparedness capability is only marginal at best, then you should also recognize that the current level of preparedness is not the fault of any one individual or organizational element.

Rather, it is the cumulative results of senior management believing that 'it can't happen here' and that resources required to mitigate the consequences of the threat are wasted resources that could better be re-distributed to 'for profit' programs.

What is missing in this logic is an awareness that all is not what it seems, and your organization is vulnerable to a variety of threats - and without a functioning business, there will be no profits.

Yes, your organization's primary concern is making a profit, and in this pursuit it cannot fail. To prevent failure, however, there must be a consistent level of concern and awareness regarding maintaining the ability to provide goods and services regardless of circumstance.

Even in many organizations that have a disciplined emergency process, the level of management concern does not remain constant, but rather fluctuates widely: moderate following a local disaster; high during and following a major regional catastrophic event; and probably the highest following tragedies like the World Trade Center and Oklahoma City bombings. Following each high, however, there is undoubtedly a corresponding lessening of interest.

Hopefully, you will never have to stand in your parking lot and view a smoldering crater where your office used to be. Or, to stand there looking at a perfectly good building denied you for a considerable length of time due to a HAZMAT incident. Perhaps the information above will be useful in motivating you to develop an emergency preparedness policy that will lead to firm guidance and support of corporate contingency planner.

Furthermore, if given sufficient tools and support, your emergency preparedness personnel will ensure that your organization can be successful in maintaining a capability to perform its essential functions regardless of circumstance. In an emergency, success is defined not as eventually resuming organizational functions, or somehow 'muddling through', but rather as having a seamless ability to resume those functions within hours of an incident.

And, in being successful, the organization announces to all involved with the organization that this organization is prepared to continue to provide the expected goods and services. This 'seamless capability' will prevent anything, or anyone, from shutting down the organization - either in part or altogether.

Throughout this article there has been a basic assumption that your organization was privileged to have dedicated and professional emergency preparedness employees - men and women truly committed to ensuring that your organization can survive and function should it suffer a Hurricane Andrew, Northridge earthquake, Oklahoma City, or Chicago flood type incident.

And, if they do exist, they most likely are doing this with little in the way of resources, guidance, or management support. If they do exist, find and help them help you. If you do not have any such employee(s) - do you care, have you cared enough?

Bill Hussong is a consultant with SRA in Arlington, VA.