DRJ's Spring 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Spring Journal

Volume 32, Issue 1

Full Contents Now Available!

Charlie discusses how the UK power supply crisis could affect your organisation.

A couple of weeks ago one of the lead stories in the news was the fire at Didcot B Power Station, a gas power station in the South of England. The station, which within the last couple of days has just been brought back on line, now has the power output of about 350MW; roughly half its normal capacity of around 700MW. The issue of power supply to the UK has been in the news for the last couple of days. The spare power capacity within the UK a couple of years ago was 17%, has now been reduced to 5%, and this may lead to the possibility of loss of power or brownouts.

A brownout is an intentional or unintentional drop in voltage in an electrical power supply system intentional brownouts are used for load reduction in an emergency. They can have a number of different effects on electrical systems, which can vary from the lights dimming, to burnouts of electrical motors. Equally worrying is that it can affect digital circuits in unexpected ways, such as make an electric motor run backwards, or it can cause them to produce false readings.
The management of power supply within the UK has been a creeping crisis for many years. The governments have failed to invest in new power supply, lacking the political will power to build new power stations, which are usually controversial. Cracks in a number of nuclear power stations have put some stations out of action leaving the country with limited spare capacity. The further loss of generating capacity coupled with a very cold winter, leading to increase in demand, could cause brownouts to occur or areas to lose power.
So what should we as business continuity people be doing?


 1. Perhaps the first action is to ensure you have an up to date inventory of your existing standby generators and any generator contracts you have in place. Once you have identified where you have standby generators, look at when they were last run and how well they are maintained. It is also important to check when the calculation was made on the size of the generator to be purchased and is the generator meant to power the whole building or only parts of it. Often generators were purchased and several years later the power requirement for the building has increased making the generator inadequate to power the whole building. You need to check whether the generator has been tested “on load” powering the whole building with all the normal machinery up and working so you can make sure it can power the whole building. Often generators are tested to see if they will start and run but they are not actually tested “on load”.


2. Once you have made sure that your generator can power the whole building or at least the critical bit, it is worth checking back through your BIA to check the critical services are being hosted in the building, or does the building have a standby generator for historical reasons and no priority activities are being undertaken in the building. There may be an opportunity to move higher priority activities into the building to take advantage of the protection the generator gives.


3. Once you have established which of your sites have standby generators then you can look at the impact off loss of power or a brownout would have on your operations. This may lead to business cases needing to be written and funding granted for the installation of standby generators. The only caveat on generators, I once heard a statistic that up to 50% of standby generators don’t work when they are call to work in an emergency so make sure that yours is well maintained!


4. Earlier in the bulletin we talked about the possibility of having generators on call but hot having a permanent one on site. Trying to hire on the day of the incident may be difficult as, if the incident is widespread, then everyone may be trying to hire them and the number and types you require may not be available. If you think hired in generators are a solution then you may consider several issues; having them “pre-plumbed”, the power requirements of the building before the incident occurs so you know the size of generator and on the day of the incident all is required is the call to be invoked and for the generator to be plugged into a socket and then the building is connected to power.


One of our many roles as business continuity managers is to "horizon scan" and identifies new threats. Possible power issues have been highlighted on the news and it is our role to review the threat for our organisation and suggest appropriate mitigation measures.


The author
Charlie Maclean-Bristol, FBCI, FEPS, Director of Training, PlanB Consulting. PlanB Consulting is able to provide continuity planning risk assessments, advice and contingency plans for any organizationwww.planbconsulting.co.uk


Charlie Maclean-Bristol, FBCI, discusses whether the time has come for business continuity managers to make contingency plans for an Ebola pandemic.

Spain is now dealing with the first case of direct infection of Ebola in Western Europe; the first Ebola death has occurred in the United States; and the World Health Organization has warned that ‘ Ebola is now entrenched in the capital cities of all three worst-affected countries and is accelerating in almost all settings ’. So has the time come for business continuity managers to make contingency plans for a possible future Ebola pandemic? I think the answer to this question is, yes, we should be.

I am not suggesting that you immediately go out to the supermarket and buy lots of tinned food and water, barricade the house, be prepared to operate on battery power and bottled gas and then lie low. 

What I am suggesting is that we should be quietly thinking about how a possible Ebola pandemic might affect our organization; thinking through what an Ebola plan might look like; and monitoring the situation to ensure that you are ready to react if the situation escalates further.

So what at this stage should business continuity managers be doing?

1. One of the first tasks we should be doing as business continuity people is looking at what our possible exposure to Ebola is. What is our staff exposure to the disease, do we have staff travelling in areas, which have had cases of Ebola? As the disease spreads further, which most commentators are saying that it will do, then cases of Ebola may arise in a variety of places. We may have to react quickly if our staff are in the same area or they may be stranded by a country travel ban. 

2. What is our supply chain exposure to the disease and does it involve West Africa? Again, like staff travelling, as the disease spreads and turns up in expected areas then it may affect our supply chain. 

3. If the disease was to take hold in our country how would it affect our organization and would it create more work for us or less? If we work in an organization that would be responding to a pandemic (for example healthcare services) or are a supplier to such an organization, then it is likely our workload will increase. If our organization supplies essential services or part of the country’s ‘critical infrastructure’ such as power, food, water, etc. then we will be under a lot of pressure from government to keep working. Whilst if our organization does not supply something critical then we can perhaps temporarily close down our organization without a major impact beyond our own employees. Any contingency planning should reflect how it affects the individual organization!

4. Once we understand our exposure, then we should be engaging with senior managers in our organization and discussing our organization’s exposure and what action we should be taking at the moment. It we have no exposure then perhaps we should be agreeing to continue to monitor the situation. We may want to agree at this stage what sort of events might trigger further action. If we have a larger exposure then perhaps we should start some contingency planning and engaging with those parts of the business or people who may be at risk.

5. I think at this stage it is very important that we are not seen to panic or to overreact, as this might undermine any other contingency planning for other events; may undermine the credibility of the individuals involved in contingency planning; and may undermine any further escalation within the organization if this is required. Especially if there is a risk to our organization, some measured communication to staff informing them of appropriate risk reduction measures to take, any travel bans and what to do if they think they have been in contact with someone with the disease may help reassure them that you are thinking about the risk and taking appropriate action.

6. It may be appropriate for your organization to carry out some contingency planning to cover scenarios such as loss of a key supplier; if a staff member becomes infected; or if parts of your organization were quarantined. This may involve dusting off influenza pandemic plans and other contingency plans and seeing how appropriate they are in response to Ebola and amending the plans accordingly. I suspect if there was a full pandemic, government would in the main very much dictate the response and precautions to be taken by businesses and individuals.

7. I think, in the end, if we do nothing else we should monitor the situation on a day by day basis; so that we can react quickly if Ebola might, or is likely to, have an impact on our organization. 

The author
Charlie Maclean-Bristol, FBCI, FEPS, Director of Training, PlanB Consulting. PlanB Consulting is able to provide continuity planning risk assessments, advice and contingency plans for any organization that has an exposure to Ebola risk. www.planbconsulting.co.uk

This week Charlie discusses how the Ebola crisis is creeping up on all of us. 
The situation in West Africa, with the ongoing spread of Ebola, bears all the classic symptoms of a ‘creeping’ or ‘rising tide’ crisis.

In Tolly’s Handbook of Disaster and Emergency Management Principles and Practice (edited by Lakha & Moore, 2004) a rising tide crisis is described as a: “Problem which creeps up gradually, such as occurs in the case of organised crime, corruption, a developing infectious disease epidemic or a steady stream of refugees into a country. There is no clear starting point for the crisis and the point at which it becomes a crisis may only be clear in retrospect.”

At present the disease is out of control in Sierra Leone, Liberia and Guinea. The latest news from the BBC says that in Sierra Leone there are five new cases of Ebola every hour and that a total of 765 new cases were reported in the West African state in the last week alone.

The problem is compounded by the fact that there are only 327 hospital beds in the country. The disease has killed 3,338 people so far. The situation is made even worse by the fact that 10% of Ebola deaths have been health professionals. Those trying to prevent the spread of the disease are being killed by it.

When the present outbreak was first known about there was little interest in Europe and the Americas. Although the disease has a high mortality rate, and there is little known about it, previous outbreaks have always been kept under control quite quickly. 

This outbreak has been the worst to date and Western countries only started paying attention when the crisis started to affect them. Britain had William Pooley, the nurse who contracted Ebola in Sierra Leone but has since made a full recovery. While for the USA there were two missionaries who were brought back home for treatment and a man who returned from Liberia with the disease and is presently in a Texan hospital. The outbreak now features regularly in the news.

The USA has deployed troops to Liberia to set up field hospitals and healthcare facilities. Earlier this month, Britain said it would build facilities for 700 new beds in Sierra Leone but the first of these will not be ready for weeks, and the rest may take months. According to experts, one and a half million people could be infected by January if the disease is not halted.

I think for us, as business continuity people, a creeping crisis is one of the most dangerous types of events. It slowly builds and you suddenly find yourself in the middle of a major incident when you should have recognised it earlier. Not recognising the crisis early on may compound the effect on the organisation and lead to increased negative coverage. This is especially true when the crisis involves death or injury to customers or members of the public.

So what should you do to prevent this happening?

1.    Understand your organisation’s possible vulnerabilities and make sure that any incident involving them is analysed to see if it might turn into a major incident or crisis.

2.    Have mechanisms in place that look for common incidents across the organisation, especially if you are a large organisation operating at multiple sites or across many different countries. By encouraging all parts of the organisation to report issues and by analysing them centrally, you can identify patterns before your customers or the media do.

3.    Think ‘worst case scenario’ and ‘what if something else happened at the same time?’ If we understand these then we can monitor the event and if they seem to be heading in the wrong direction then we can prompt the organisation to take early action and prevent the incident becoming a crisis.

4.    There needs to be someone within the organisation who is responsible for identifying potential creeping crises, who can flag up potential events. This may be allocated to you or may rest elsewhere within the organisation.

With this monitoring and horizon scanning in place hopefully we can identify incidents before they become a crisis and have a major impact on our organisation.


Charlie is one of the Directors of PlanB Consulting. PlanB Consulting is a boutique consultancy specialising in providing business continuity, disaster recovery, ISO22301 and crisis management consultancy to clients in the UK and beyond.

The Dallas hospital treating the Ebola patient has just announced that the patient died.

The Liberian public health and airport security personnel in Liberia did their jobs, and checked outgoing passengers at three distinct checkpoints.  But airport personnel can do little when patients lie or the patient didn't know that what was thought to be malaria was actually Ebola.

We've patted ourselves on the back in this country for the sophistication of our medical capabilities, yet as I listened to the story today of the patient being sent away from the hospital in Dallas when his isolation and treatment might have meant that he would have lived, I thought once again of Dr. Atul Gawande's book, The Checklist Manifesto
This type of error is called one of ineptitude, as opposed to one of ignorance, presumably.  We don't know if this was an Ebola-specific checklist; one prepared by the hospital itself; or one from the Center for Disease Controls.  A quick read of Gawande's book might be very helpful, especially if the checklist has more than 5-7 items on it, without what Gawande calls "pause points."  His book is full of stories of how pilots, builders of skyscrapers and surgical teams perform extremely complicated feats, and how using checklists that involve every member of the team makes a difference.  His work in this respect for the World Health Organization has made a large impact:  deaths after surgeries have been reduced significantly by the implementation of several simple procedures that are part of the checklist.
I would also recommend the book to the new acting director of the Secret Service and to the panel that is currently being constituted to review the disturbing procedural/process failures over the last several years for the organization charged with guarding the president.  It may be that those procedures or processes have become shopworn.  Certainly it must be the case that, unless on a form of high alert (the United Nations responsibility, for example) agents' situational awareness is at an all time low.  Whether this is a factor related to the move from Treasury to the Department of Homeland Security or not is difficult to estimate, but will undoubtedly be reviewed by the panel.
The tipping point I mentioned last week seems more vivid as weeks go by.  Yet there was one piece of good news this morning:  that it appears Nigeria, the most populous and also most well-off African country in terms of infrastructure and medical personnel, has contained Ebola.  We just can't move quickly enough to get more personnel, hospitals, emergency operations centers and supplies deployed in the remaining countries. 

This week Charlie discusses the Scottish referendum results.


I have written about Scottish independence before, but thought I would revisit the topic now that the referendum has been and gone.


After a long and hard fought campaign, Scottish voters backed remaining in the union by 2,001,926 votes to 1,617,989.


The result has prompted a lot of questions about what direction the country should take, with many suggesting that all UK countries should be given more powers.


As well as questions there are of course lessons to be learned, particularly in terms of the management of the referendum, which are relevant to us as business continuity people:


1. The most obvious observation is that there was a major failure of risk management by David Cameron and his advisors. As he thought the pro-independence supporters were going to lose the vote (the opinion polls were roughly 70% 'No' and 30% 'Yes' at the time) he decided not to put ‘Devo Max’ on the ballot paper. This was probably the preferred option for the majority of people. He thought the vote would not shift much, the ‘No’ vote would win comfortably and he didn’t then need to give Scotland more powers. After he originally agreed to the wording of the question, the support for independence grew and as the vote drew closer it looked increasingly likely that independence would happen. It seemed like this possibility was not taken into account when the question was being agreed and the basis for the election was negotiated. If you take a risk and the odds seem to be stacked in your favour you have to consider what you are going to do if the odds seem to shift against you.


2. Two weeks before the poll, with the ‘Yes' campaign looking increasingly strong, it seemed that there was no contingency plan in place. Momentum is very important in politics and it seemed to be firmly behind the ‘Yes’ vote. This caused the three party leaders to seemly panic and abandon Prime Minister's question time in order to hot foot it to Scotland and passionately argue for the Union.  They pledged they would give extra powers to Scotland and said they would lay out a timetable for implementing the granting of these powers. To most people this seemed a panic measure and as though they had suddenly woke up to the fact that they might lose. Horizon scanning, as we should all be doing, and some local knowledge, might have told them that the passion for this debate was stirring in Scotland. The ‘Yes’ campaign had a very successful grassroots campaign which was turning many voters’ heads. Contingency plans and identifying the danger early on would have prevented the visit by the three leaders as being seen as a panic measure.


3. After an incident it is often said that organisations are never the same again. Pressures and the impact of the events have a lasting impact on the people who are involved. In Scotland this is most definitely the case. A whole section of people have been energised by the debate and want to pursue their goals of social justice and independence further. I was hearing on the radio that many people are in mourning as they genuinely felt that there was going to be a vote for independence, even if that was not what the opinion polls were telling them. The debate and the vote have changed Scotland. How this will manifest itself and the legacy of the referendum will become clear in the next few years. The important lesson for us is to learn that after an incident your organisation is likely to change and the change may be fundamental.


4. Lastly there is a very important lesson for incident communications from the event. During an incident people hear what they want to hear.  Anything which reinforces their point of view is listened to and they don’t hear the logically-reasoned counter argument. It seemed to me that certain sections of the ‘Yes’ campaign would only listen to facts which supported their own argument and blocked out any that disagreed with them. When all three parties said Scotland couldn’t continue to use the pound, their reaction was not to propose an alternative currency but to claim those saying this were bluffing. When a number of senior members of the EU said that Scotland would not automatically become part of the EU they again claimed that this was not true and quoted another source which said they would automatically become members. We need to recognise that people may think they are victims in an incident and blame your organisation. However much you say it is not your fault, they have set in their mind it was your organisation which caused it and they will not listen to any communications from you. Just because you put out a firm rebuttal with lots of reason why it is not your fault there is no guarantee that the ‘victims’ are listening. You may have to redouble your communications or use different methods and channels to reach them. You may just have to recognise that in the end they will always believe what they want to believe and that any communications may never change their mind!


We will see how the situation pans out over the next few months.