Roadmap and flexibility
As security professionals, we spend much of our time trying to understand risks and threats and how to mitigate them. Catastrophic events of recent years have reminded us that natural disasters must not be left out of the equation of risk and, more importantly, worst case scenarios do happen. Natural disaster crises can take many forms, and organizations should approach these situations thoughtfully and sensitively in terms of their decision-making, information sourcing, and concern for the health of their people, neighbors, and communities.
As we approach hurricane season, organizations can utilize the following information to understand how to prepare, respond to and, ultimately, effectively recover from a natural disaster.
Readiness
Have a plan. The aviation industry has a fitting saying: “Plan the flight and fly the plan.” Having a plan seems intuitive for most security professionals, but we see that organizations are often ill-prepared from the start due to a lack of planning. Having a crisis management plan allows organizations to consider a wide range of potential crises, devise a strategy to respond appropriately and proportionately, and ultimately recover as quickly as possible with the least amount of operational downtime. It is important to align these plans with existing crisis management and business continuity structures already in place.
Control Risks has assisted many clients through past hurricane seasons and it was clear that most organizations (both big and small) either did not have a plan or had an outline of a plan somewhere collecting dust. Many of these organizations had not spent much time thinking about how to manage a natural disaster crisis even though some of their key operations were in remote islands that were prone to tropical storms. Needless to say, these organizations spent more money and time in trying to manage the crisis and restart their operations than the organizations that had a plan to deal with such a scenario.
Commit to the cause. Understand that resources (financial or otherwise) need to be committed to this effort. Natural disaster readiness, response and recovery are costly endeavors. The costs of developing a plan and associated training, hiring external consultancies or security providers, or transferring some of the risk to an insurance company, are all examples of financial considerations that organizations might face when looking to mitigate risk from natural disaster.
The cost of not being prepared is exponentially much higher. Operational downtime, reduced productivity due to an affected workforce, potential loss of life, subsequent litigation on the grounds that the organizations should have been better prepared, and a damaged corporate reputation are just a few examples.
Proactively engage with third parties. A crisis is not the time to attempt to establish relationships with government entities, service providers or organizations experiencing similar challenges. When a crisis hits, governments will focus on critical infrastructure and public safety first. Providers of support services, including evacuations, security and medical support, will prioritize requests for support based on existing client relationships and contractual obligations. Failure to proactively engage third parties can leave an organization without these avenues of support.
Organizations should seek to understand the capabilities that various third parties have to respond and assist during a crisis. This will save precious time that might otherwise be wasted by trying to navigate the influx of substandard third-party providers that overpromise services, only to fail to deliver and leave organizations without support. It may also allow for time to secure preferential pricing and navigate any contractual challenges without pressure from a looming or active natural disaster affecting decision-making.
Response
Work the plan but remain flexible. A few days after hurricane Irma hit several islands in the Caribbean in early September 2017, and just as recovery efforts were starting to get underway, the threat (and subsequent disaster) of hurricane Maria caused most organizations to hit the pause button and revaluate. Nobody had projected two back-to-back category 5 hurricanes. So how do organizations plan for this?
The “plan the flight and fly the plan” adage is typically accompanied by the caveat that a pilot should not irrationally adhere to a flight plan if circumstances necessitate change. These principles applied to this scenario. The original plans were adjusted to deal with the current situation.
It is almost impossible to forecast every single scenario that a crisis, natural or manmade, may throw at organizations. More than likely, an actual crisis will play out differently in real life than from any plans that may have been written. So why have a plan if we are likely to adjust on the fly? The plan provides a structure that has been developed, reviewed, and approved in calmer times when the organization was not experiencing crisis. If developed thoughtfully, this structure should provide for flexibility.
Be timely in your response. During natural disasters, a timely response can be the difference between limited down time or extended operational shutdown, being able to secure third party assistance or not and in the worst case, life or death. In these moments, time is in short supply and organizations need to make decisions quickly and implement them accordingly. For instance, after hurricane Irma we were approached by a client for support. Once the options for support were presented, the client explained that they were going to evaluate the situation and present options for support to the board of directors that was meeting the following Tuesday. This was on a Thursday. We quickly explained that this timeline was not something that we recommended and explained to them the need for quick decision making. In the end, they conferred that night and approved the support.
Similarly, other parts of the organizations that may become involved in the process should employ the same sense of urgency and may need encouragement from senior leadership or the crisis management team. This could include procurement teams and their associated processes that might be asked to acquire goods and/or services. The speediness of their work must be either modified or accelerated to accommodate the situation.
Expect crises within a crisis. It should be expected that responding to a natural disaster-related crisis will be challenging. These events are typically complex situations that contain many smaller crises. The consequences of the main event will create conditions that, depending on how they are handled, may create another potential crisis. This could include scarcity of basic necessities (food, water, medicine, etc.), increase in water-borne illnesses, a deteriorating security situation and damaged reputation or low morale amongst the workforce.
Organizations must be able to anticipate new crises developing and address them right away before they become a larger problem. Otherwise, one of the small crises could become a larger problem than even the inciting event. Every mishandled potential crisis further separates an organization from its recovery goal, which further affects the organization’s bottom line.
Communicate, communicate, communicate. Communication is the cornerstone of any proper response to a crisis. An organization can take all the necessary steps to prepare and a crisis management team can respond rapidly—but if there is no effective communication between the necessary stakeholders, failure is likely to be the result. Organizations need to properly communicate with business partners, the media, and any relevant stakeholders and, above all, with the affected employees and family members.
After hurricane Irma, one organization attempted to restart their operations but chose to keep their employees in the dark about their long-term plans to stay in the island. As the client put it, it was not important information that needed to be shared. When all the employees were finally called to the client site for a meeting, only about 10% of the workforce showed up. It was later understood that the rest of the employees had assumed that the client was going to close the site.
Once the crisis hits, maintain an open line of communication with your employees. Explain the situation to them, your plan to respond and your expected timetable. Even if the timetable is not exactly clear, explain that as well—be candid and truthful. Maintaining engagement with your employees demonstrates a duty of care and helps with morale. This outreach will pay major dividends in the future. Remember that communication should be reciprocal. An open line of communication allows you to have a better understanding of your employees’ needs and thus deliver better results.
Recovery
Timely expectations. There will be a point in time after the initial crisis when the response effort is complete, and the recovery begins. It’s crucial for organizations to realize that this is a medium- to long-term process.
Recovery efforts should be prioritized based on the business continuity plan but should include first re-establishing basic functions such as IT, facilities, security, and other fundamental office operations, followed by other business operations. Keep in mind that the issuance of occupancy certificates will likely be delayed and therefore operations may need to be shifted into a different area. Organizations should also expect delays with any procurement process. Shipping delays should be expected even as roadways reopen. Additionally, it may take longer than usual to replace equipment, given the spike in demand. Recognize that responding to a natural disaster is about progression, tackling new problems every day and working on an accumulation of small victories.
Focus on employees and their families. The overall well-being of their employees and their families is a critical part of an organization’s recovery. Natural disasters can bring devastating loss to affected communities. Business leaders must be considerate of their employees’ circumstances and offer help if they are able to do so. Even though an employee might be physically ready to come back to work, his or her personal circumstances, or that of immediate family members, may present additional challenges.
Consider providing financial assistance to allow employees to focus on work without being concerned with their own personal finances. This might include temporary housing, distribution of basic supplies, free childcare, or paid leave. Otherwise, organizations run the risk of having “present absenteeism” where personnel go to work but are not productive.
In conclusion
The natural disasters of recent years have reminded us that crisis management and business continuity plans are unlikely to cover every single contingency, so rigid adherence to restrictive plans could cause its own set of problems. Plans must remain flexible and goal-oriented. Organizations must know what they are looking to accomplish and have a reasonable timeline.
Looking forward to challenges that companies may face, it’s important to reassess whether response plans are flexible enough to assist during manmade and natural disasters and the risks associated with them. Setting the stage for a swift and appropriate response will be paramount to ensure the smoothest possible return to regular operations.