You May Be Ready, Are Your Employees?

I am sure you’ve heard that September is Preparedness Month. If you are engaged in your company’s business continuity planning effort then you know the story. Be it storms, quakes, floods or man made incidents your viability coming out the other side of the experience depends in large part on the quality of your planning beforehand. That said it really is like the old saying, “the battle plan is good until the first shot is fired…” Still, proper preparation provides a foundation that provides resources and allows you to adapt intelligently.


An important but sometimes overlooked item in contingency planning is the personal preparation of employees. Think about these two numbers:

• 93% of your employees and unprepared. They have taken no steps to provide and care for themselves in the event of a major disaster or event. For example, they do not have alternate communication plans or designated rally points for their family.

• 75% of company business continuity plans do not support employee resiliency. We assume (and your Business Continuity Plan probably does as well) that employees will be on site, unconcerned with anything but work, fully functional and motivated.

If it were only so, but it’s not. Here is a basic list of things planning and exercises should anticipate.

• During weather and quake events especially you should assume that not all employees will be able to get to the office. Some because they have to take care of the home front, some because they physically can’t get there.

• Those who are “at the office” will be under stress and may react differently than expected. Some may be emotionally or mentally paralyzed by events. Others will automatically go into “fix it” mode while yet others are focused on taking care of co-workers. Some might be traumatized by their inability to contact, secure and comfort their loved ones.

Here is the point of this discussion: Organizational and personal preparedness are linked. Understanding this it is important to next decide what your organization will do about it. Among the obvious are encouraging all employees to audit their personal preparedness, including providing suggested templates, and to develop their personal continuity plans.


You’ve put a lot of effort and resource into preparing your corporate business continuity plan, and it depends on employee availability and participation. Helping employees prepare themselves is the right thing to do.

Learn the Right Business Continuity Lessons the Right Way

Someone once told me that practice does not make perfect as is so often claimed, and they were correct.  Perfect practice makes perfect.  I was reminded of this recently when conducting a table top exercise to test our ability to respond to an emergency event.  In disaster response and business continuity planning it is always important that you practice the details correctly.


When faced with unusual circumstances humans quickly conduct a database search in their brain, looking for similar experiences to use as a reference point.  They then act as they did then or as they observed.  That is why training correctly is so important.  What you do in training is what you will do when the real thing happens.  For example, if your assignment is to record information and you have specific logs for that purpose then use them when training.  Do not use blank sheets of paper or a handy whiteboard.  Practice using the tools you've been given and set that mark indelibly in your brain.


There is another way to practice of course.  That is to experience an actual event without preparation beforehand.  Not the preferred way of learning in my book.  


In his new book Business Continuity Management Michael Blythe addresses questions we should all be asking ourselves in the BCP arena.

• Did pre-crisis assessments identify risks and prioritize them appropriately?
• Did mitigation efforts offset the damage?
• Were managers well equipped?
• Did they implement contingency plans?
• What post-incident risks were not anticipated?
• How should strategies be modified in light of this experience?
• What tactics, training and policies need to be revised?

Personally, I would rather learn the answers the easy way, by anticipating and practicing correctly, identifying gaps and re-mediating them before being faced with a real situation.

Lessons Learned from the Great Southern California Shakeout

Many of you heard about the November 13, 2008 earthquake drill in Southern California. Five and half million of you participated in some way, including individuals, schools, emergency command and control organizations, and corporations.

This exercise resulted from a grass roots effort based on the research of Dr. Lucy Jones of USGS and Cal Tech. The purpose of the exercise and a personal passion of Dr. Jones is to develop a culture of preparedness. The exercise and its publicity accomplished a beginning, but there is much to be done, and learned.

The exercise included not only the drill of an earthquake response, but also used super computers to model results at a level of detail not possible before. As a result, we learned things we did not know before.

· This 7.8 magnitude quake was 5,000 times stronger than the 1994 Northridge earthquake.

· Economic damage was estimated at $213 Billion USD.

· Fires resulting from ruptured gas and power lines accounted for half of the damage.

· Some buildings previously thought safe in a large quake are now known not to be safe.

· The Tejon Pass rupture severed power transmission, gas, water, rail, and roadways, effectively isolating the region from outside relief.

· Water (not just drinking water) will not be available in some areas for up to six months after the quake.

· 22 million people in 8 counties were directly affected, including 1,800 deaths and over 50,000 injuries

· Many people died or were injured when they ran out of buildings during the quake instead of dropping, covering, and holding in place

Let me caution here that it would be easy to dismiss these numbers and what they project as worst case outcomes in a worst case scenario. That is not the case. The quake that was exercised is not the worst case. Locating the epicenter in a remote area mitigated against the kinds of losses that would result from a similar quake centered in a suburban area. The magnitude of the quake is large, but historically speaking a quake of this magnitude in this region is 150 years overdue.

When we ran our own drill where I work we learned a few things as well.

· No one knew how to use the satellite phone, and we were surprised to learn that it can only be used while stationary in a large open field.

· We needed more runners on hand to pass information to our teams throughout the facility.

· A key activity is recording all forms of information as it comes in, and logging action items, assignments, and decisions.

Those are just a few, there were many more. And, we had a few light moments as well (imagine your entire executive management team crawling underneath tables as aftershocks hit).

Among the biggest values of participating in the exercise is that we have to a small extent removed the fear of the unknown. Continued exercising will normalize the stress and reactions required to successfully survive such an incident. It will increase our confidence and lead to additional planning and corrective action. All good things.

The greatest danger we face is not the “Big One.” The greatest danger is complacency. Be informed and be prepared. Your quality of life and that of your loved ones will be determined by the quality of your preparation now.

www.shakeout.org

http://www.earthquakecountry.info/

http://earthquake.usgs.gov/eqcenter/recenteqsus/Maps/US10/27.37.-120.-110_eqs.php

http://www.scec.org/news/00news/feature001109jones.html

http://www.scec.org/

Best Practice – Business Continuity Planning

Like many firms we have recently been focused on tuning up our Disaster Response / Business Continuity Plan (BCP). We are now better organized, trained and provisioned to deal with disruption, regardless of the cause. While not perfect we are far better off than we were just a few short months ago.

Incidents that might disrupt business operations come in all forms and sizes. Long term power outages, natural disasters, workplace violence, extreme weather, terrorist actions, pandemics, concerted cyber attacks and a host of others have the potential to cause disruption and economic harm and displacement.

Naturally there is no “one size fits all” plan to protect against the ill effects of any of these. Corporate goals, culture and client demands are just some of the factors that influence and contribute to a good BCP. When developing a BCP it is best that it be done as a collaborative effort with all business units working as a team. Plans that are developed independently by separate business units will tend to have gaps, overlaps, poor coordination, different assumptions, and even different languages.

Once the cross functional team has been formed they need to be given particulars about planning assumptions and expectations, and it is best if they have a reporting relationship direct to the C-Suite. This helps moderate organizational rivalries. Executive sponsorship and oversight is therefore critical. CEO’s and CFO’s must establish parameters they can both support (such as cost of plan development, provisioning, and training) and be intimately familiar with the resulting plan so they can lead the corporation in an emergency.

Remember, even the best planning is useless if the plan is not well communicated, understood, and followed. The best way to ingrain the plan into the culture is to exercise it. In fact, exercises can be used to inform plan development. Tabletop exercises are especially valuable because they bring the full leadership team together for the purpose of experiencing the dynamics of an event. First exercises may be little more than a walk through of the plan outline. Later exercises should introduce conditions that stress plan assumptions, incident command team leadership, and the decision making system. This has the significant advantage of exposing gaps and incorrect assumptions in the plan, and in “normalizing” emotions, stress and speed of action.

One issue that every organization must deal with is how to equip staff. Using the assumption that the normal office space is uninhabitable or unreachable, alternate plans must be in place to accommodate staff. How this is done will vary greatly depending upon the type of business, product, and employee demographics. Recently I heard of one company which has established a model that I think could work well for many. Basically, each staff member is evaluated on the basis of a number of criteria, including home location, job function, etc. They are then assigned a category number. The organization has a plan to provide office space during a major event using this category system. For example, Category 1 staff are provided fully functional office space in an alternate location. Category 2 staff are provided a fully equipped home office, and Category 3 staff are provided mobile technology only. Obviously, this model does not work for all, but it can work for many. Companies that utilize Alternative Workplace strategies will be able to leverage their strategies as a BCP asset.

Regardless of what the “right” BCP model is for your organization, what is most critical is that it be current, exercised, and that there is a corporate commitment to keeping it that way. Let’s face it, this is one of those things we all hope we never need. That is no reason not to do the work to have it in place and ready if needed. You certainly don’t want to be heard muttering “I shoulda have” on this one.