Is a Shooting a Business Continuity Problem?

Yesterday's tragic shooting in a Portland, Oregon mall has once again brought workplace shootings into perspective. While as of this writing we do not yet know the identity of the shooter, his motives or background, what we do know is that these events are far too common.

And yet, many times, companies do not respond to these events adequately, which results in loss of business, and sometimes even bankruptcy. Malls are basically concentrated centers for small businesses retail shops, and while many would not characterize what happened in Oregon on par with a Hurricane Sandy, they each require a very similar response via a disaster plan.

Workforce

In yesterday's shooting, there were thankfully few victims, and none of whom worked at the shopping mall. However, there is a fairly significant chance there will be psychological casualties. A traumatic experience, especially one involving life and death can have short and long-term psychological effects, which can result in additional absenteeism, stress, and long-term anxieties and phobias.

A disaster plan will have enumerated a clear method for the Employee Assistance Program to link up with affected employees. It also will identify security vulnerabilities which otherwise might have been ignored, and how to fill temporary employment gaps, and will provide strategies for dealing with the families of employees who may be injured or killed.

Customers

My brother is the managing director of a business located in that Oregon mall. He was telling me today that law enforcement will finally allow him a chance to go into his office, nearly 24 hours after the event. His primary responsibility, he said, was to contact each of the clients on the list and reschedule their
appointments.

The challenge goes beyond simply rescheduling people, however. He will have to reassure people that the store is safe and secure, and is not stuck with a negative stigma stemming from the violence. One survivor from yesterday's events put it perfectly: "I moved to Portland to be safer."

No one thinks that going to see a Batman movie, going to math class, or shopping at the mall would result in a serious confrontation with the fragility of life. Therefore, when that illusion is broken, it is the responsibility of the business to attract people back to their brand or their location.


While it is unlikely that his or any of the other retail areas will go out of business as a result of this incident, there are many stores victimized by a shooter that do not survive. Stores and others have to be careful how they market and re brand themselves that is respectful to the victims, and assures that they will remain in business. Disaster plans are documents that provide step-by-step methodologies for doing this.


Leadership

When a crisis like this occurs, it is critical that senior management be kept involved in what is happening on the ground. During the 1997 North Hollywood Shootout, which occurred at a Bank of America, senior bank managers and leaders scrambled to contact law enforcement and their employees to get situational awareness.

Any disaster plan covers this scenario. It is called the Continuity of Operations Plan. If your business is affected, this plan helps tap into the company's resources and assistance so that they can be utilized in the most efficient manner possible. Companies that try to simply "wing it" invites miscommunication and bad assumptions at a time when the business needs to be its most efficient. Only a disaster plan provides this kind of protection.

Conclusion

The events yesterday at the Oregon mall are tragic and will certainly be remembered by the families of those affected for the rest of their lives. Those who sought to save lives and prevent further carnage should be applauded for their efforts.

As business owners and leaders, we should treat events like this as we would a Hurricane Sandy or a tsunami: with confidence and
efficiency detailed through a disaster plan. It is the surest way to Reverse Disaster. 

Hurricane Sandy: Now is NOT the Time to Experiment

"Wonder Weapons"

As I type these words, the winds from Hurricane Sandy are whipping through the trees just outside my window here in Maryland. At the same time, I have also noticed a rapid change in direction of people's attitude toward technology.


In a disaster, companies sometimes try to deploy a new technology to get themselves out of trouble. They don't realize the threat of the disaster, and so they hope a gadget or software platform will do the job for them.

It won't.

We would never deploy a new technology on the sales floor if we hadn't mastered it and tested it. Follow this same philosophy during a disaster. Basically, it is too late to start a Business Continuity Plan or Disaster Plan if you are in Hurricane Sandy's path, so just rely on what you know. 

We all procrastinate before disaster strikes (yes, even I do). But I never let a technology that promises to get me out of trouble be deployed before I know what I am getting into. I like to call these "Wonder Weapons" because they promise to solve problems in wonderous, amazing fashion.

They won't.

Rely on the technology that you have already mastered and deployed, especially during a storm like Sandy. It's tried and true, and won't let you down. Don't let the speed and direction of the wind blow you away from your core instincts as a small business owner.

Use what you know, and your business will be on track to Reverse Disaster.


Patrick Hardy

Is Hurricane Sandy "The Perfect Storm"?

Hurricane Sandy is making national headlines in the United States because of its proximity to the East Coast, and the possibility of a strong landfall. But that isn't the only reason it remains in the news.
Meterologists have identified a number of similar characteristics between Hurricane Sandy and The Halloween Nor'easter of 1991, known in popular parlance as "The Perfect Storm".

Courtesy of NOAA

Nor'easters are very similar in characteristic to Hurricanes. It usually describes a low-pressure area where the rotating center is off the East Coast, providing hurricane-force high winds, rain or snow, coastal erosion, and possibly even blizzard conditions.  


Is Hurricane Sandy "The Perfect Storm"?

The simple answer is: no one knows.

As of today (roughly 5 days out), there is no certainty that this storm will even make landfall. By Saturday and Sunday, we should have a pretty good idea what is next.

The National Weather Service put out a three page statement with a lot of jargon that you and I are unlikely to understand without an advanced degree in meterology. However, as a business owner, this is perhaps the only relevant passage [caps are in original]:

"IT IS LIKELY THAT SIGNIFICANT IMPACTS WILL BE FELT OVER PORTIONS OF THE U.S. EAST COAST THROUGH THE WEEKEND AND INTO EARLY NEXT WEEK."

So how do you prepare for "The Perfect Storm"?

Don't let the verbiage of it being a supposed "Perfect Storm" scare you into thinking this is the disaster to end all disasters.

Keep a few things in mind:

1. Only the National Weather Service can declare Hurricane and Tropical Storm Watches and Warnings. Here is where to find those:

http://www.nhc.noaa.gov/text/refresh/MIATCVAT3+shtml/251446.shtml

2. Storms change their track quickly. The computers and satellites are constantly updating it. This is the current picture:

http://www.nhc.noaa.gov/refresh/graphics_at3+shtml/115907.shtml?5-daynl#contents
 
3. Storms change their power rankings daily. It may be predicted to be a stronger or weaker storm based upon modifications in temperature or cloud drift.

As a business owner, don't wait to the last minute! Start gearing up your facility for Sandy. Even if she doesn't make landfall, you can chalk it up to a realistic exercise where you can test your disaster plan.




If you want day-by-day (and hour-by-hour) tips on what to do leading up to the storm, follow us on Twitter: www.twitter.com/hytropy

Patrick Hardy

The Most Dangerous Thing a Small Business Can Say “No” To

There is an 80% chance you will be struck by a disaster or a major interruption at some point during your company’s lifetime. That is a sobering reality, especially since statistics show that small businesses without a disaster plan are playing a dangerous game.

It doesn’t matter if it is a brick and mortar business or an online company with a single owner and no employees. If you are interrupted by a disaster, and are not back in business within a month, your chances of survival are less than 1 in 10.

Unfortunately, I see this a lot in the disaster business.  Small businesses who still think they can just wing it and get through a major disruption. Why would you do that when every single Fortune 500 company has a robust disaster program? Not a single one of those companies would wing it. The reason is because they recognize that a disaster program is the company’s chance to make money, and not lose valuable customer relationships. 



So do you still need a disaster plan? Yes you do, for one reason: you have the most to lose.

When Wal-Mart has a store closed for a couple of days, it loses ten to twenty thousand dollars. For them, that’s nothing. They can easily make that back in just a few days, especially since their marketing position is such that they have broad appeal almost anywhere they are situated, and they know it.

Want to know a secret? 

Wal-Mart probably has the best disaster and business continuity plan of any brick and mortar company in the world.

They don’t care if they can make lost money back. They want to be open to show their customers, the community, and their competitors that they mean business. Wal-Mart won’t give an inch away that it doesn’t have to, because they take disasters seriously. Companies without disaster plans that do survive needlessly spend a lot of money to do so. 

I spoke a couple years in a row at a state restaurant association in an area known for massive disasters. After one of my presentations, a guy came up to me and told me that he was recommending to the association that they no longer have disaster management educational sessions.

When I asked why, he said it was because his restaurant had been struck by a disaster twice and he had survived both times without a disaster plan. After asking a few more questions, he said had spent about $18,000 on each one to completely return to normal.

I absolutely couldn’t believe it. There is no rhyme or reason why a small business restaurant should spend nearly $40,000 to be continuous after a couple disasters. What he doesn’t realize (or refuses to) is those losses will eventually catch back up to him.

Do you have $40,000 to spend on a disaster response? Do you want to spend that on a disaster response? Or would you rather have that to renovate your store, or buy more advertising time or invest in your employees?

What he also doesn’t realize is a disaster can cost you more than just money spent on responding. There are a host of intangibles that can’t really be quantified by money, such as public relations, brand perception, loss of future customers, and even the loss of qualified employees. I knew companies that lost great managers to other businesses because they weren’t open in time, while their competitors were ready to take their valuable skills.

The original company couldn’t pay them during the 8 weeks they were closed, and the employees still had bills to pay and mouths to feed. That compounds the problem because now your competitors have an edge on you, and you now have to either: hire and train new employees or make significant sacrifice to get the ones you lost back.


A good disaster program will make sure that you have a disaster plan that is tailored to your business, with training of your employees and periodic exercising of the program with realistic scenarios.

Your small business has the most to lose, so do what your Fortune 500 counterparts do: get a disaster program. It's not worth saying "No" to.



Patrick Hardy LL.M, CEM, ALEM, LEM-Pro

4 Signs Your Employees Aren't Ready for Disaster

During a disaster, you have a choice: either you can make money or lose money. There is no “breaking even” when a disaster strikes. But you have to have your disaster program ready, and employees are the critical element that makes or breaks a company’s response.
 

They are the ones who will get your processes back up, expand your client base, and get you back in business. But that means they have to be ready for the disaster. But how do you know if they are ready? Your employees aren’t going to tell you outright that they aren’t ready for a disaster.

Wondering if your workforce is prepared for a disaster?  There are 4 signs that you should look for that will help you answer this question:


Lack of Knowledge of Disaster Plan

This is an instant give away. When employees don’t have even a basic understanding of how the plan works, there is a 0% that the plan will function the way that it was designed. Disaster plans are technical documents that require constant training and employee readiness about them.

They should know how the company will communicate in a disaster, where the alternate site locations are, how to reestablish basic company functions, etc.  A couple years ago I was talking to a colleague once in the recreation industry, and she had no idea where the business would go in a disaster, even though the company had spent tens of thousands of dollars to set up an alternate location!


Indifference to the Disaster Program

In other words…no one cares. I can tell instantly when employees are indifferent to a disaster program: as soon as the disaster program is brought up in a meeting, people start to yawn, or open their smartphone, or show renewed excitement for that upcoming dental appointment.

When the leadership isn't actively engaging with employees, the disaster program is at risk of becoming obsolete. An adaquately trained workforce will keep an eye out for changes in the company that will affect disaster operations.

They also hold regular discussions with the employees in meetings specifically devoted to the disaster program. These are programs that will last in the long term.

Lack of Questions

When employees aren't asking questions about the plan that means they have never been engaged in the disaster program. No disaster program, regardless of its mechanisms and the expense that went into its creation, is perfect.

Employees that are ready for disaster ask questions about the program and the implications for themselves and their families.


Empty Exercises

Employees who are ready for a disaster understand how critical it is to participate in disaster exercises. I have seen companies that hold an exercise from 8AM to Noon, and half the employees don’t bother to show up because they think it’s an optional vacation day!

The leadership and the employees need to understand that exercises are critical to the disaster program, and that management means business. And they don’t have to be boring!

If management takes the time to create a fun exercise, everyone will want to participate.

 
If you are worried that your employees aren’t prepared, make sure you engage a disaster manager who can help develop a customized program unique to your workforce! This is the most effective way to Reverse Disaster.

Prepare for Technology Crashes

Yesterday, a hacker from the group Anonymous took credit for a coordinated cyber attack against Internet domain registrar and web hosting company Godaddy.com. The denial-of-service attack caused a complete company-wide outage for several hours, and was the largest in the company's history.

The result was chaos. Millions of small business websites were down, including shopping carts and e-mail accounts. 

Regardless of your position on Godaddy or Anonymous,  September 10th cyber attack should be a wake up call for your business to prepare for these types of major outages, or one of the casualties is going to be your business. Outside of non-state groups like Anonymous, there are a number of nations that are known to recruit and train hackers with state complicity or encouragement: North Korea, China, Russia, among others.

Godaddy is unlikely to lose its company because of the outage. However, as a small company, you probably do not have the substantial financial resources to ressurect lost business. And if you do have the money, why not spend it in a way that ensures you can take advantage of your competitors' lost business?


Website/Shopping Cart

Simply put: If your site is down for hours, your competition is going to be cheering! Even if it is for a short time, your reputation can be damaged, and potential clients will go elsewhere. However, if your competitors are not prepared and yours is, this is a chance for you to increase your business and gain ground on them! But you have to have the adaquate preparation first.

If you aren't ready for a cyber attack, you risk wasting a lot of money, particularly if you have an online advertising presence. You will still be paying for the clicks and online time, but you will get ZERO conversions. That is money thrown away. Even if you do turn the advertising off in time, you will be losing valuable face time with potential clients.


E-mail

Using a personal e-mail address to send professional correspondence looks amateur and rookie. Not only is the e-mail address going to be foreign to clients, vendors and others, it might be placed automatically in the spam folder by a message server. This is the case with Hotmail addresses, because the server will associate the word "hot" with pornographic material.

One of the other issues is the content of personal e-mails are not appropriate to the professional setting, and are rarely corrected in time. More than once I have seen disaster-striken companies who (inadvertently) send out a client e-mail with something like this in the signature line:



Jon "Bubba" Smith
"As always, EAT the MEAT, TOSS out the BONES"




Is that the impression you want to make with a new client? In business we talk a lot about first impressions, and a signature line with "eating meat" and "tossing out the bones" is not a way to foster a professional, long-term relationship under any metric. This is a reason we create a clear differentiation between professional and personal e-mail addresses. During a disaster, this line does not need to be blurred.

This also does not account for the fact that you will now have to forward all the e-mails from the personal box to the professional box, will have to delete the message in the personal box, make sure you have not violated your privacy or terms of service, and then hope that your clients aren't e-mailing your people on their personal address.

However, this can all be avoided with some simple preparation.


Reversing Disaster - Basic Tips


1. When your company is facing a disaster, your company should seek to look even MORE professional, not less. Every e-mail, every message, every client interaction should be given the highest professional feel possible.


2. Don't put all your technology eggs in one basket. If you use one vendor for all your IT needs, this is an invitation for trouble. Spread out your platforms (hosting, cart, e-mail etc.) between multiple vendors. This will ensure you have a resiliency for your business.


3. Purchase a disaster plan from a reputable source. Don't waste your time buying templates or getting disaster plans from some fly-by-night business you find online. Get their credentials, make sure they understand your long-term needs, and stick with them. They will keep your business resilient.

Commit to a little preparation, and your company can easily Reverse Disaster.


Patrick Hardy, LL.M., CEM, ALEM

Plan for Rain on Your Parade

Tropical Storm Isaac (which is not yet at hurricane strength at the time of this writing) has threatened to rain on the Republican parade at the National Convention in Tampa, Florida. The Convention organizers have already announced a shortened schedule, and a general interruption of the proceedings.
 While the Convention most likely won't be cancelled, for businesses that attend, host, sponsor, or organize conventions, expositions and large events, it's a good lesson. When your company commits valuable resources in time, effort and money into an event, ensure it also has an appropriate disaster and continuity plan. Many events around the US are interrupted or cancelled every year by natural or man-made disasters.

First, I would like to make a quick note on their relationship between event disaster plans, and comprehensive disaster plans for your business: they are not the same. The plan you have already codified for your business covers your employees, facilities and processes. Any large event should be considered a separate process from your company, and should be planned in juxtaposition to your current disaster program, whether you are an event attendee, or the event host/sponsor/organizer.

 

Event Attendee

 

Your business needs to consider its continuity in light of being an event attendee, as your loss can be significant. I knew a company that attended an annual conference in the midwest of the United States as an exhibitor. They brought large amounts of marketing materials, half their workforce, their largest truck, and samples of the product to be sold. As happens periodically, one year, a thunderstorm touched off a tornado that destroyed the truck, along with everything inside.

This became a serious problem. The company sold specialized metal beveling machines, which were purchased from one vendor overseas. That vendor was backlogged with orders, so it was over a month before the company could fulfill their existing orders, which meant those customers went to their competitors.

Furthermore, with half the workforce displaced, the company had a very difficult time rebounding. Insurance money did not cover overtime costs for their employees, and the loss of revenue stream was significant for a company like this in a niche market.

Event Sponsor/Host/Organizer

 

If you are the sponsor of the event, or host a recurring large gathering, your event preparedness should be a permanent addendum to your current plan. This is particularly true if your company is a non-profit or a trade association, because confidence in your ability to host the event is the critical factor in the draw for companies to attend. Questions your company should be asking include:

• What happens if your event has half the number of participants because of a disaster?
• What if they ask for refunds?
• What if they withdraw from the vendor exposition contract because of a storm, flood, earthquake or some other interruption?

 

And it isn’t just these natural risks that can affect your event. If your organization is tainted by a scandal, or some act of corruption, you can expect that your lead sponsors will pull out of your event.

Your disaster plan needs to have a contingency for your event so that it doesn’t sink your entire organization. Insurance may cover certain perils, but it will not cover loss of reputation, or the damage of future loss of revenue, or loss of potential clients.

 

Event Disaster Plan Considerations


Your event disaster plan needs to consider a number of elements. However, that plan should not be constructed in isolation. Your company’s overall disaster plan should be tied in closely to your event plan, discussing:

• Alternate Sites
• Crisis Communication
• Insurance (especially any covered and uncovered perils)
• Information Technology Contingencies
• Site Vendor Coordination

Your company should adopt a rule: if one is disaster plan is activated, the other should be activated.  This is because they will affect one another as you shift resources, personnel and money to one or the other as you reverse the disaster.

There is one other consideration for any event disaster plan. If your event takes place outside the jurisdiction of where your company is physically located, that means you will need to establish new relationships with the local government, first responders, etc.

These are not tertiary or unimportant relationships!

If there is a disaster at your event, and you have not consult the authorities, you are asking for trouble. Jurisdictions do not take kindly to event planners that ignore them because they will take the heat from the media and the public for any problems that arise. I remember when I was an EMT for an event at a large convention center some years ago. There were just two of us, with one ambulance, and a second backup crew. As the event progressed, we became overwhelmed and couldn’t handle the flow of participants coming out of the facility needing assistance.

The reason? Many of those at the event had checked out of cancer wards and hospices to receive some type of religious healing. When that did not work, we EMTs were stuck trying to get these people back home. The City was very unhappy that the organizers had not informed us of the demographic attending, which drew away resources from other 911 calls and emergency medical responsibilities.

Conclusion

Your company may have a terrific disaster plan, but if it is not also including those events you attend, sponsor, host, or organize, you are inviting a greater potential for business interruption. Make sure your business continuity company is planning accordingly. This is the only way to Reverse Disaster.

Patrick Hardy, CEM, ALEM, LL.M.

How does FEMA fit in?

I have no regrets saying that as an undergraduate I was a strongly-leaning libertarian. And I was vocal, too. As a political scientist, I had a lot of opportunities to inject myself into our Socratic Dialogues and make my opinions known about the postal service, social programs and NATO. I don’t know how my professors and colleagues put up with me, but they all showed remarkable restraint in not taking the bait (most of the time).

What makes that all the more ironic is that this year I officially became a federal bureaucrat. I accepted a rotation as the first business owner as the Private Sector Representative to the Federal Emergency Management Agency (FEMA). That role was originally set up by the Private Sector Division of FEMA to establish constructive relationships between the government and private industry in a disaster.

I accepted the rotation because I felt as though FEMA has a role to play in how companies respond to a disaster. This is the first part of an occasional series on FEMA and how they can assist you and your business in Reversing Disaster.

1. Money

This is the one people love to talk about, because the concept of “free money” is such a temptation, but it is also the one most subject to mismanagement and abuse. Remember the debit card-debacle in New Orleans? That was not an aberration. FEMA misallocates millions of dollars every year, and creates perverse incentives for people to do unsafe and reckless things. 

However, as a business owner, FEMA assistance can go a long way to help your employees and their families, so you can get back into business faster. FEMA offers a lot of different types of assistance for them which can supplement income, and provide temporary housing assistance.

2. Information


In my personal experience, this is something that FEMA does well…assuming you can find it. While I feel like FEMA information is mostly helpful, they have had a lot of trouble in the past with dissemination. Very rarely does FEMA provide a single-bottom line and communicate it well. This is the reason why the national press quickly catches on that the national office representatives and the field personnel are not singing from the same sheet of music.

For business, though, FEMA can provide information on mitigation measures, response activities, and provide safety information for you and your employees. They liaise with all the local and state agencies and responders, so you can minimize the risks to your employees and clients. They can also act as a conduit, in the sense that they can usually help you find the information you need on road closures, assistance updates, sheltering activities, etc. 


3. Crisis Counseling


Counseling after a disaster is not a new iteration. The Red Cross and other agencies were doing some kind of spiritual or psychological counseling for victims of disasters and wars since the First World War. FEMA now provides crisis counseling alongside these agencies, as they are able to mobilize mental health professionals quickly and efficiently to a disaster area.

In your company, your people are your most important asset. If you are a single-person business, the most important asset is you. And, of course, you need to be in a rational, steady-state of mind if you hope to keep your business continuous. You should know your limits and those of your employees so that they are not placed with undue stress

FEMA and other disaster counseling can help. The counseling is free, and could go a long way for your employees who are concerned about their family and friends. For example, disasters are very distressing events for children under almost any circumstances. Parents, guardians and other relatives can also be placed under additional stress from a disaster, and the counseling can provide a relief for them.

Conclusion


What is critical to remember is that FEMA cannot be all things to all people. Don’t expect it to be your Mommy or Daddy after a disaster strikes. They can only do so much.  By recognizing their strengths, and their limitations, you will find that FEMA does have a place in your disaster response. Utilize some of these resources available as they can be of great benefit to you and to your employees as you Reverse Disaster.

Patrick Hardy

Threat #2 (National Planning Scenarios) – Major Hurricane

June 1, 2012 was the inaugural day of the 2012 Hurricane Season. With that, I felt as though it would be appropriate to create an entry for a Major Hurricane. For many people living on the East Coast of the US, the Gulf of Mexico, hurricanes are a way of life. Luckily, however, for many other people in the US and abroad, the threat of a hurricane of any type is so remote as to be virtually impossible. 

I grew up in Orange County, California, where I am not sure I knew how to spell hurricane until I was 18. The conditions for a hurricane have to be just right: the temperature of the ocean, the wind, the humidity, the currents and the type of ocean topography all play a role. And, let me just say: on all fronts, California just doesn't have it.

My grandparents (rest their souls) lived on the islands of Hawaii, where the climate is humid and is perfect for hurricanes. But even there, storms of that type are relatively rare. However, when I graduated college, I soon found myself in Baton Rouge, Louisiana as a novice emergency manager, and discovered an entirely new type of disaster.

If you had the opportunity to view any of the coverage of Hurricane Katrina, Andrew, or any of the other major hurricanes that has struck in the last couple decades, you probably have a taste for their destructive potential.  However, like any major disaster, I tell people that they don’t fully comprehend an event unless they are actually there, experiencing it firsthand.

My third week living in Louisiana, the state was hit with a Category 1 hurricane. What I noticed about it was the completely anti-climactic nature of it. I was expecting complete devastation, flooded streets, and FEMA debit cards. What we got was…nothing. A little rain, a little wind, and that’s it. The lights were on, internet was working, and I went to work as normal.

Hurricanes severity is measured by the Saffir-Simpson Scale. The scale measures 1-5, with 1 being the lowest end and ascending in severity to a 5. Typically, a “Major Hurricane” is defined as a 3 or higher.

A couple summers ago, I was training a group of engineers about hurricanes in the Panhandle of Florida. One of the participants approached me later and said, “You know, I don’t even stop mowing my lawn unless it’s a 3 or higher.” To the rest of us, that may seem a bit cavalier, but that is the typical mindset for residents of Florida.

The reason for that is pretty simple: Florida gets them a lot.

Hurricanes typically give a long lead-time before landfall. We can now track storms all the way from their genesis out in Africa (where they begin to form off the coast) to their dissipation point. Sometimes the storms don’t make landfall at all. For example, the 2010 Hurricane Season was one of the least active, while 2005 one of the most active.

While the Gulf of Mexico is known as the hotbed for hurricanes, they can easily strike the East Coast. In fact, until Hurricane Katrina, one of the worst known hurricane landfalls struck New York City in the 1930’s. It almost single-handedly ground that city to a halt, and caused immense chaos. This was about 50 years before FEMA, but was an event that spearheaded the movement in the US for a more organized government response to disasters.

As a business owner, your employees need to have a family disaster plan. Hurricanes are incredibly disruptive events for your business.  Make sure your operations are reinforced with the following:

Emergency Response Plan

Make sure your plan covers a major emergency, and has contingencies for evacuations and communications. Remember, phone lines may be out, cell phone towers may be knocked down, and things may be difficult. Redundant communication methods are the key.

Business Continuity Plan

Make sure your BCP contains the operational contingency plans. Your facilities may be damaged, and I can 100% guarantee that you will be disrupted.

Training

Of course, your employees need to be trained on communications and hazards. But they also need to know your company's policies. They need to know what you expect from them when disaster strikes.

Exercises

If you live in a hurricane area, you should be running at least one exercise per year (preferably in the March/April area). The exercise should be for a major hurricane, should include flooding, and incorporate local responders. In your area, your local emergency management agency will hold an annual exercise. Work closely with them.

Certification 

Like clockwork, every March or so, I start to see advertisements for disaster planners who are selling disaster programs. Do NOT invest in any disaster plan that does not have a Certified Emergency Manager and Certified Business Continuity Professional. Otherwise, you roll the dice with quality.

Conclusion

Remember, that very disruptive events like a Major Hurricane can be the crucible test for your business. It has the potential to disperse your employees, erode the infrastructure, create confusion, and prevent you from reopening quickly. Make sure your disaster program is ready for it. This is the only way to Reverse Disaster.

Patrick Hardy

Why does a business need a disaster plan?

Two weeks ago I was mixing with a crowd of chamber of commerce members, and I started talking to a guy who ran a local barber shop. I told him what I did, and he told me that he didn’t need disaster planning services, because he had insurance.

"So why does a business need one?" he asked. Oh boy.

There are a lot of reasons, of which just a few are below. What he doesn’t realize is that insurance just isn’t enough.  Don’t believe me? Just ask the businesses of New Orleans what they think. Insurance is a wonderful tool that can assist in controlling or financing risk, but it isn’t something to supplant a good disaster plan.


Recovering Operations

If your operations are interrupted as a result of a disaster, it is critical that you get those back on track as soon as possible. Simply stated, if your critical processes aren’t recovered, there is no way you can go back to making money, and without a disaster plan, there is no way for you to get back into business. Companies have tried for years to avoid disaster planning, and there is just no way around it.

Think about it in terms of your business: Would you start thinking how to develop your product after you got your first order for one? Of course not, that would be crazy. So why would you do that in a disaster?

Consider this as well: If you lose customers to the disaster, do you think they will come back to you?

Loss of income insurance only goes so far, and the covered perils aren’t always the ones your company is likely to face. In one of the Gulf Coast disaster areas where I worked a couple years ago, there was a beach wedding photography studio with 5-7 full-time employees.

When the disaster struck, the beaches were complexly quarantined and isolated. The studio executives had no idea what to do, but they tried to make alternate arrangements for the bookings they already had. Unfortunately, that was too late. About a year later, I found out the company had gone out of business and faced an equity loss of almost half a million dollars.


Protecting Employees


If you have employees (or are a single-person business) you owe it to them to have a plan in place. Many, if not all, your employees are relying on you to continue to be in business so that they can continue to make money. During a disaster, a family will be stretched financially and will require that income. If they don’t get it, there is a domino effect of losses from business to person.

Ironically, the problem could be the exact opposite, where employers are expecting employees to come in without communicating that to their workforce. A few years ago, I worked with a graphic design company that nearly found itself in legal jeopardy after they fired two employees because they didn’t show up to work after a disaster.

The employees were living in a rural area where cell service was almost nonexistent as a result of disrupted communication towers. The company was so infuriated that they didn’t come to work that they sent nasty termination e-mails. Within a week, though, the employees were threatening litigation, and the company relented. It was soon after that I got a call from them inquiring about a disaster plan.


Protecting Property

It is well-known that the majority of the damage during Hurricane Katrina occurred after the hurricane had left New Orleans. It was the flood waters and the resulting deluge that caused the majority of the property damage. This is why a good disaster plan can keep you out of trouble. A plan that determines evacuation of employees and property, and adequately budgets for resource protection and supplies has the best chance to mitigate damage after a disaster.

When I was growing up in Orange County, we were told to get sand-bags and prepare for possible flooding during El Niño, which is a weather system that periodically strikes California. I remember as a child wondering why people needed sand bags when we had the beach not 50 yards away! As an adult, I would ask why people didn’t buy the bags beforehand, and have an executed plan for filling them, and placing them in the most vulnerable areas of their property.


Conclusion


Remember, disaster planning is not just something you do after disaster strikes. Whether you are a barber, a wedding photographer or a graphic design company, your operations, employees, and customers are relying on you. Remember, if you aren’t there to fill orders and provide services, there will be another company with a disaster plan that will be ready to steal your clients, all because they had a better method to Reverse Disaster.

The Indictment of Disaster Plan Templates

I was speaking to a group of museum owners in the Northeast a couple years ago, and, after the presentation was over, a group of them asked me about a disaster plan template they had purchased.  I have very strong feelings about this subject, so I said, “Get rid of it. It’s worthless. It’s worse than worthless; it’s detrimental to your program.”

They were a bit shocked with how forthright I was; however, I wanted to be blunt, because univerally, my professional experience has demonstrated that:  


Templates are ineffective disaster plans. Period.

I still see this a lot with companies that are trying to save a few bucks, because they are cheap, fill-in-the-blank disaster planning solutions. But, unequivocally, these provide a false sense of security, because experience has shown in disaster after disaster that these do not work, for a myriad of reasons.


Templates Don’t Account for Changes

This may not seem like a big deal, but in practice, it is one of the largest drawbacks of a template. Depending on the size and complexity of your business, there are dozens (sometimes hundreds) of variables that can change in a short period of time.

Employees, clients, new building contracts, homeland security policies and even a new fleet of company vehicles can have a massive impact on your planning calculus. Circumstances, policies, procedures and strategy can also change with critical vendors or even the government.  Your plan must take account for these changes, because they can have a huge operational impact when faced with a disaster.


Templates Don’t Account for Evolving Threats


Every plan has to have, as a foundation; certain set of threats it uses as a guide for responding and recovering. However, it does not account for unique community factors that will either make that disaster more devastating, or more likely to occur.

For example, communities in the US can either have underground or over-ground electricity wires. The ground soil could also be permeable, semi-permeable, non-permeable, and could have the composition of a dozen different compounds that would have a massive impact on the likelihood of, and extent of disasters occurring, including: flash flooding, erosion, wildfires, ground collapses, engineering disasters, or tornados.



Templates Don’t Account for Training


When I worked for a coffee chain as a young man, I was asked to train the staff on the disaster plan, since they noticed I had a propensity for speaking and an interest in disasters. So I trained the staff, and told each one individually that at some point they needed to read up on the evacuation routes embedded in the plan so they knew the best route to get home.

I intentionally omitted the evacuation route in the training so that I could conduct a little experiment. On that same page, I put a $10 bill and said “if you are reading your evacuation route, you can take this $10”. After 6 months, I retrieved the money; presumably, not a single person had read it.  Templates provide zero accountability on this factor.

Templates Don’t Account for Regulatory Requirements


If you run a business in an industry with a regulatory requirement for a disaster plan (or a derivative such as an EAP, ERP, BCP, IT/DR), a template will not only be operationally defunct, but they can also put you in legal jeopardy.  This is particularly true if you actually experience a disaster which results in injuries or property damage.

State and Federal regulatory agencies have held hundreds of facilities accountable for inadequate disaster plans with fines and criminal sanctions. Civil actions would not be far behind, which could keep you in courts for years.

We call these templates “checkbox” disaster plans, because they are used to meet the bare minimum requirements under a regulation or statute. In some cases, facilities purchase a template, but don't even bother filling in the blanks! You can imagine how effective that plan is when disaster strikes.

Conclusion


Perhaps inevitably, my words came back around to haunt me. About a week after my museum presentation, I got a phone call from the planner who had created the template, who was more than a little annoyed at my comments. You can guess the outcome of that conversation.

While I can respect that companies are trying to save a few dollars, don't waste your company's money with a useless disaster plan. They provide a false sense of security, and ignore the realities of a robust disaster program, which requires training, a good exercise program and evaluation measure.

Don’t be fooled; a template is simply not the way to Reverse Disaster.

Threat #1 (National Planning Scenarios) – Improvised Nuclear Device

An Improvised Nuclear Device (IND) can describe either: a nuclear device that has been modified from an existing weapon, or can be one that is constructed from parts of devices.

It is important to differentiate them from Radiological Dispersion Devices (RDD) (otherwise known as “dirty bombs”) because, in the latter case, the purpose is to disperse radiological particles using a conventional explosive like dynamite or TNT. In that case, there isn’t a nuclear reaction. An RDD will create an explosion like any other.

Courtesy: Department of Homeland Security

An IND, by contrast, creates a nuclear explosion like those at Hiroshima and Nagasaki (mushroom cloud), because it is a radiological chain reaction and will be vastly different from an explosion from TNT. The detonation of an IND is a major catastrophe of an almost apocalyptic scope. The explosion of an IND in a major city would raze dozens, or (depending on the yield) hundreds of square blocks.


Plan

Like any other explosion, an IND will cause casualties, damage buildings, and disrupt utilities and essential services. However, as you put together your plan with your disaster manager, you should keep a few unique things in mind:

• If an IND is detonated near your facility, work will cease indefinitely. The number of casualties and the pace of destruction will be such that economic activity will grind to a halt until order is restored;
• If an IND is detonated in the US but not near your facility, work will essentially cease for a few days as fear and panic sets in awaiting the government response.
• The risk is not just from the explosion itself, but also from the nuclear fallout that results from the detonation;
• Do not rush your employees back to work, and consider that friends and family may be affected. 
• Roads may be closed, and other commercial activities involving transportation will almost certainly be halted.
• Government functions, public sector activities, and contractual obligations (both buying and selling) will be suspended.
   
• Employees may have severe psychological trauma, trouble concentrating, or experience phobias. Be prepared to activate the EAP.
  

Train


I recognize that training your staff on how to respond to a nuclear weapon explosion will probably result in a few smiles and side-jokes. When we train our clients, we do our best to make the training relevant, but not too “doom and gloom”.

Courtesy: United States Army

If you decide to do your own training, make sure you be very careful of the wording you use, and don’t make it too company-centric. If you have medical staff, they all need to be trained on the medical effects of a nuclear reaction detonation, including (but not limited to):

• Primary, Secondary, Tertiary, and Quaternary Injuries as applied to a nuclear explosion
• Blast Wave and Overpressure;
• Radiation Exposure and Contamination;
• Delayed effects of acute radiation exposure;
• Specific organ effects depending on where a given isotope is incorporated;
• Carcinogenesis;
• Psychological effects.

Conclusion

Thankfully, this is a threat that has a remote chance of occurring. Unlike what the movies portray, a nuclear weapon is a highly sophisticated machine that requires incredibly specialized skills and equipment to design and build.

Furthermore, even if a group were able to get the blueprint for one, they would have to acquire the radiological materials, properly harness them (without getting killed from radiation poisoning), and procure all the other machinery necessary to properly administer and maintain the weapon before the radiological materials broke down into their half-lives. 

However, an IND event should remain a planning scenario for your business, because, if that terrible day does come, it may be the only way you can effectively Reverse Disaster.

Patrick Hardy

phardy@hytropy.com

Twitter: @hytropy

Facebook: Hytropy