Archive for Emergency Response

Office of Disaster Assistance

Here is one more number to include in your Business Continuity, Emergency Response and Disaster Recovery directory: (202) 205-6734.  This is the number for the Office of Disaster Assistance under the US Small Business Association (SBA).  And, despite being administered by the SBA it is available for “businesses of all sizes” according to the Mission Statement included on its website.

If you are not aware of this organization and the things they can do, I urge you to go visit their website.  Check out the page of Current Disaster Declarations to review the events that they provide assistance for.  You might also find some ideas where they could add value to your program by going to their Emergency Preparedness and Disaster Assistance page.

I know many organizations have well developed plans to mitigate losses from disasters; many of you have insurance policies which include loss of business clauses; and, many larger companies have self-insurance reserves to cover losses that may stem from a disaster – but, there still might be circumstances where the Office of Disaster Assistance could be of value.  Anyway, what does it hurt to check them out?

After all, it’s just one more number to add to your directory of resources that could provide assistance; you don’t have to commit to calling it if you don’t need them.

Atmospheric River 1000 (ARk)

Really, it’s not like I just sit around thinking up the next disaster that might occur; or that I spend all day searching the Internet for catastrophic events to scare the stuffing out of people.  But, given what I do for a living, they just kind of have a way of finding me.

About a year ago, someone told me about the potential of a huge rain storm on the West Coast of the United States known as an ARk Storm.  Apparently there is this weather pattern known as an Atmospheric River (the “AR”) that has a catastrophic occurrence about every 1000 years or so (thus the “k”) that scientists are studying and suggesting could occur again.  The last ARk Storm to hit the West Coast happened in the late 1800s, (so, in my book that means we have another 900 years to wait) but meteorologists are just starting to understand the potential impacts another ARk Storm could carry.

Up here in the Pacific Northwest we are very used to the Pineapple Express weather pattern, which, I now understand, is an example of an Atmospheric River – just not the build your Ark kind of event the ARk Storm is supposed to be.

Certainly, throughout the US we have had our share of floods, mudslides and other heavy rain events that have resulted in Emergency Response, Crisis Management and Business Continuity plans being engaged.  Who cares what neat, scientific name we give the events that caused them?  But, I did find some interesting articles about this ARk Storm potential that I thought you might want to check out, including a story that suggests its just a bunch of Internet hype.

And no, I am not suggesting we now need an ARk Storm Response Plan!  I just like to share potential risk information with people who might want to know.  You know, to scare the stuffing out of you!

Tabletop Exercises: Are These Enough?

At Safe Harbor Consulting we specialize in creating and facilitating Tabletop Exercises.  In fact, most of our projects and a large percentage of our revenue is earned from performing this service.  We, therefore, understand, appreciate and tout the benefits and values of conducting these exercises and realize the efficiencies and effectiveness of using this non-invasive testing technique.

I do get concerned however, that organizations depend too much on the tabletop exercise as their one and only business continuity, disaster recovery, crisis management testing tool.

Tabletop exercises are great for educating management, employees and others on the strategies and solutions in place.  Tabletop exercises are terrific for ensuring the documentation supporting these programs are complete, accurate and easy to understand.  Tabletop exercises are tremendous for promoting communications and cross-checks between various departments and groups that have different yet coordinated roles in a comprehensive resiliency and recovery organization.

But …

Tabletop exercises do not physically prove the validity, effectiveness and timeliness of most of the physical infrastructure and logistics in place to engage and support a real-life implementation of the solutions in place.

Talking through how you would engage call trees or notification and escalation protocol should not take the place of actually performing call tree and notification tests.

Ensuring people know where to go and how to conduct business in alternate site locations (even those that use in-house, displacement strategies) should not stop you from physically exercising this strategy every now and then.

Reviewing lists of phone numbers of people and agencies to call at time of a crisis, should not prevent you from physically dialing those numbers to verify they reach the intended party and that party understands what is/would be required of them at time of crisis.

Tabletop exercises are indeed, relatively inexpensive ways to educate people, heighten awareness of programs, procedures and protocol.  Tabletop exercises can be conducted with little disruption to the production work environment and little risk of impacting productivity.  And, conducted properly, tabletop exercises can absolutely discover plenty of opportunities to improve your programs and implemented solutions.  I just wish to caution folks that these exercises should not stop you from attempting mock events that more closely simulate a real life response to a potential business interruption event.

I am not saying, “Do not do tabletop exercises”, or even, “Do fewer tabletop exercises”; I am just suggesting that you should strive to include physical tests in your overall exercising process, when possible, to better prepare your company for the eventual business interruption event.

These, “other kinds of exercises” are hard to coordinate, take up time of many employees in the organization, can be disruptive to the production environment and, can be rather expensive to conduct – but, the further validation they provide and the heightened level of preparedness they instill can be worth the investment, every now and then.

Just don’t let yourself become too complacent with the tabletop exercise.  Try to get permission to do more, if you can.  Outside agencies, like fire departments, local emergency management agencies, and the such, usually love to assist and play a role in these exercises – I urge you to reach out to them and see how they might help you raise your exercise bar.

Safe Harbor Consulting would absolutely love to continue to perform a bunch of tabletop exercises – but, we would be even happier if we could assist you with a more life-like simulated exercise to really test your business continuity, disaster recovery and/or crisis management posture.

Lessons Learned

The 10 Year Anniversary of 9/11 has come and gone.  Some tears were shed.  Some memories were shared.  Some hugs were given.  And, some heartache relived.

I wrote an article for Continuity Insights magazine on Lessons Learned from this event and whether or not they are still applicable today.  It is now posted to their web site for all to see.

I also participated on a panel discussion on the topic for the American Bar Association.

Both of these events were somewhat cathartic for me as I still have some healing to do from this event.  I cannot imagine how those who lost loved ones (beyond the few acquaintances that I knew) must feel.  Again, my family was one of the lucky ones – my wife, who would have been in the middle of it all, took that day off for a doctor’s appointment and I did not have any business scheduled downtown that day.  My children will tell you about the fears they had for hours while away at college waiting to hear about our well being.

I do hope that the lessons learned from that tragic day, business continuity related and otherwise, remain with us always as well as the memories of those who were lost.

My thanks go out to all the agencies, organizations and others who did a fantastic job in remembering that day and paying tribute to the heroes – many of whom we will never know.

The Next Disaster

So is your “Falling Satellite Hits Building” plan up to date?

Although I do not think this is a serious threat and do not suggest anyone become too alarmed by this story, I am somewhat amused with the quote:

“Since the beginning of the Space Age in the late-1950s, there have been no confirmed reports of an injury resulting from re-entering space objects. Nor is there a record of significant property damage resulting from a satellite re-entry.”

For many disasters that occur throughout history, prior to the event, you could probably safely say there was no record of that particular event occurring.  For example: Were there any records of significant damage resulting from a tsunami compromising a nuclear power facility?  Were there any records of significant damage resulting from terrorist attacks into high rise buildings with hijacked airplanes?  I could add a few more, but think you get the point.

Now, I am in no way suggesting that this threat has the potential to equal either of those two events – or, to even cause any damage at all – I am just saying, we cannot always rely on history to indicate what the next crisis might be.

Please, do not confuse me with Chicken Little here, running around yelling, “The sky is falling, the sky is falling” – I really am not an alarmist, despite the occupation I have chosen – I am merely pointing out the lack of assurance I get hearing someone say, “Well, this has never happened before so why should we worry about it”.

Do not activate your Command Centers monitoring “the satellite threat”.  Do not put business areas or your recovery site vendors on alert.  I am merely suggesting, do not expect your next disaster to necessarily have a historic precedent.

Now go out there and have a great day – just look up every now and then.

Disasters, Disasters, Disasters

One of the challenges that Business Continuity and Disaster Recovery Planners have had to face over the years is in dealing with a largely apathetic business community.  Many of the management personnel we try hard to work with just do not buy into the belief that a disaster is likely to occur – or, at least – not during their time in the position, so why invest time and resources to plan for an unlikely event?

In this day and age, that is dangerous thinking.

I have written a few blogs over the past month about real events that have recently impacted the business community – the threats are real; the impacts are meaningful.  Safe Harbor Consulting alone has received numerous calls from companies that have been impacted by these events – even if just impacted by having to prepare for potential losses – realizing the need to update, expand and improve their emergency response and business continuity plans and posture.

It used to be that I would search for disaster related stories on the internet to try to validate the work we do, but now all you have to do is look at the top news stories for the day.

Today, for example, some of the top news stories on Yahoo include:

A Google news search, in addition to similar headlines, includes:

And these are just the top news stories for a typical day.  Each of these events have the potential of causing some sort of business interruption or impacting the workforce in some way for companies in the vicinity of the event.

These stories range from the scary (earthquake) to the sublime (satellite falling to earth), but they all have crisis management, emergency response and potential business continuity concerns.

We can no longer pretend that the threats are not out there.  And, we as professional planners can no longer use the excuse that management just does not appreciate the need for planning – it is our job to make them understand the need for planning!  So, let’s get out there and do our jobs.

I almost hate to see what tomorrow’s headlines will bring!

The Emergency Notification and Escalation Process

I think that one of the biggest challenges in the Emergency Response process is devising efficient and effective escalation and notification protocol.  Who gets called and when?  What are the triggers to escalate?  Who is being called into action vs. who needs to simply be informed?  This is particularly challenging when the event is one that starts out small and grows into something larger.

The response to Hurricane Katrina is a prime example of an event where this process got confused and mismanaged.  Certain agencies were waiting to be called into the response process while those in need expected them to engage automatically.  The “engagement trigger”, if you will, was not defined and understood.  The responder thought the trigger was a request by the local authorities, the local authorities expected the trigger was implied by the extent of the crisis.  One waited for the phone call, while the others sat waiting for help.

I think it is important that engagement triggers be defined for all entities that could have a response action.  Are there automatic triggers, where a response team will conditionally engage given certain parameters?  Or, are there teams who will always be called into action by others?  These must be defined, communicated, known and rehearsed.  Back to the Katrina disaster – most agencies knew what to do – they just did not start doing it at the right time due to the confusion on when or how to engage.

With regards to the notification process, I often see confusion in programs between a notification that calls you into action vs. a notification to be informed or put on stand-by.  Many organizations use a multi-tiered notification process utilizing, Alerts, Declarations and an Alls Clear notification system.

An alert, prepares responders for the potential to engage should the situation escalate.  A declaration is a call to action.  Some events will bypass the alert stage and immediately result in a declaration.  Not all alerts will result in a subsequent declaration.  But, all alerts and declarations must be followed by an eventual Alls Clear. 

I have also worked with many organizations that did not have a protocol for issuing an Alls Clear communications.  I think it is important to notify all team members and all parties included in the response process, whether actively engaged or not, that the situation has ended and they can return to normal operations.

And then there is the challenge of notifying those who must engage (a call to action) and simply those who want to know.  I highly encourage limiting that “want to know” group to a select few.  Most of these folks can be kept informed after-the-fact with post event summaries.  Most of your emergency notification calls should be a call to action (or an alert to those who may be called to action).  Too often I have seen Command Centers and the emergency response process get bogged down by curiosity calls and fringe management interfering with those who have a job to do.

I recently worked with an organization that had a large number of non-responders who insisted they had a “need to know” about certain incidents.  This was remedied when there was an on-the-job injury at 3:00 am resulting in a phone call to all these individuals.  Suddenly, it became less important to include them in the notification tree and they settled for being on the post incident report distribution list.

There are many applications and services that facilitate the notification and alert process, but, the ease of use of these systems should not result in you simply adding folks to the notification list if it is not understood what their response responsibilities are.

Identify your triggers.  Make sure if you have automatic triggers that everyone understands when and where they apply.  And, include these triggers in your response drills and exercises.

Calamityville

Having spent some time visiting my brother and his family this past weekend, we finally got to talking about how our individual specialties have real synergistic potential to help advance and improve our own fields of expertise.  My brother, Dr. John Flach, is the Professor and Chair of Psychology at Wright State University in Dayton, Ohio.  John (I don’t have to call him, Dr. Flach) specializes in Human Factors Engineering and has been spending a lot of time studying human factors at time of crisis.

John put me on to this Calamityville project at Wright State which sounds rather interesting.  I get all goose-bumpy thinking about how this could be applied to a number of emergency response practices and organizations.  Interesting stuff I thought you might like to check out.

We then spent a few hours watching a near-disaster take place as my alma mater, the Ohio State University, nearly lost a football game to the University of Toledo – but, that is another story for a different kind of blog.

Check out the Calamityville website and let me know what you think.  Does this sound like something that will work and have potential to give us greater insight in crisis response techniques and practices?  Your comments are welcomed – just don’t tell me you are a Michigan fan!

Is 2011 Becoming the Year of the Disaster?

What is going on with the weather this year?  My wife and I moved out to the Pacific Northwest over three years ago, for reasons I will not bore you with, and are sitting up here without a worry in the world, while the rest of the country has been bombarded with weather and geological related incidents one right after another.

This year has truly been an epic year in terms of these events in the United States.  Certainly, each and every year brings its own challenges, but this year seems to be one right after the other.

We kicked off this year with the Groundhog Day Blizzard that crippled much of the nation from New Mexico and Northern Texas to New England and Eastern Canada.  Who knew at that time that this was just the beginning?

Shortly after this huge snowstorm, which contributed to the next crisis, the flooding began.  We have had historic levels of flooding on the Mississippi River, Missouri River and others. 

Then, the tornadoes started to occur.  The 2011 tornado season was one of the worst on record seemingly making the news every night with a new city being devastated.  According to this Wikipedia article, there have been 1,764 tornadoes in the US in 2011 – that’s a lot of tornadoes and a lot of damage!

Then, while the weather takes a little break, we get a nice little earthquake on the East Coast.  Nothing real significant (easy to say, sitting here in Gig Harbor, WA) but just a little something to rattle the cages of those who didn’t expect an earthquake to be rattling their cages.

And, that “little break” the weather took didn’t last long, as right on the heels of the earthquake, Hurricane Irene decided to give the East Coast a visit.  It turns out she was not as bad as some prognosticators predicted, but she was pretty bad nonetheless.

So, what’s next?  Oh, how about a few little Texas fires – and by little, I mean Texas-style little, which is pretty huge to the rest of us.  A little more flooding in the Northeast, perhaps – check.

I am currently working with an East Coast company to help them plan for an Emergency Response exercise.  We are quickly reaching the conclusion that they do not have to exercise given the number of real life implementations they have had and are even now currently experiencing with more floods in New Jersey.  Enough already!

Safe Harbor Consulting opened our doors as a new business continuity, disaster recovery, and crisis management consulting firm earlier this year.  Some folks have accused us of causing these disasters as a way of promoting the need for our services.  I assure you, our connections with the man above are not that good.

And I have only talked about incidents impacting the US!  Imagine how long this blog would be if I started listing worldwide events.  I am almost afraid to ask, “What could be next?”  The answer is likely to be in a future blog.

Be safe, folks.

Emergency Preparedness for Airlines

For the past 3+ years I have had the opportunity and privilege to work for a US airlines, responsible for their Business Continuity and Emergency Preparedness programs.

Emergency Preparedness for airlines is a completely different animal than what most of us are used to.  An airline’s Emergency Preparedness program is focused on one particular event – an airplane accident.  Rules, regulations and guidelines issued by the National Transportation Safety Board (NTSB) and the Aviation Disaster Family Assistance Act of 1996 stipulate exactly what is expected from airlines in their response to an accident resulting in the deaths of some or all of their passengers.

Airlines are required to immediately lock down all records and documentation that has anything to do with the aircraft(s) and personnel who operate and/or maintain the aircraft(s); immediately perform drug testing on all surviving individuals who may have operated or maintained the aircraft(s); make available a team of experts on the operation and maintenance of the aircraft(s) involved to assist the NTSB in its investigation of the cause of the accident; and, most importantly, provide immediate care and assistance to the families of the passengers and crew aboard the aircraft(s).

These requirements make it essential that airlines can quickly notify and mobilize a large number of employees (depending on the size of the aircraft(s) involved in the incident) to the accident site (or as close to the site as possible), for employees involved in the investigation; near the accident site, for families to gather, a little distanced from the actual site; at the originating and destination airports, where family members may already be or may originally gather; and, perhaps, at upline and downline airports for passengers that had connecting flights.

The operating airline must provide resources and accommodations for a number of governmental and other support organizations (NTSB, American Red Cross, FEMA and others) to set up operations near the crash site; provide accommodations and transportation for all families who wish to travel to the nearby site location, as well as to provide compassionate assistance to families who decide to remain in their home locations.

There are other requirements regarding the dissemination and security of information released to agencies, families, the media and the general public; investigation logistics; legal matters and other concerns.

The airline must also concern themselves with the fact that now that they have a large number of their employees dedicated to the accident response for days, weeks and in some cases, months, they still have an airline to safely operate with a now depleted workforce who is likely stressed and emotionally impacted by the event.

Without getting into the gory details about how all of this works and the challenges the airlines face, suffice it to say, this requires a lot of planning, education and testing of the process and procedures.  Those employees who volunteer to assist in providing family care must be trained and participate in annual refresher courses.  Those employees targeted to manage the response process in the airline’s Corporate Command Center and at the accident site, must be trained and participate in annual exercises.  Station management and staff, any of whom might be called on to set up Family Assistance Centers at their airport must be trained and tested in their responsibilities.  All, a huge undertaking.  And all what makes Emergency Preparedness a different animal at airlines.

Whereas most airlines have a relatively well developed and rehearsed Emergency Preparedness program for this specific incident, I found that they do not have very well developed or rehearsed programs for any other kind of incident that may impact their ability to operate the airlines.  Emergency Preparedness for them has become very myopic.  But, that is fodder for another blog on another day.