Tag Archive for emergency response

Today’s Disaster – Wild Animals on the Loose!

Okay, here’s a new one – a city in lockdown mode because there are wild animals on the loose roaming the city streets!

I can’t help but chuckle imagining the broadcast message that one would send out to their employees telling them the office is closed due to a city lockdown caused by wild animals.

I really have no more to say about this one, other than I just had to share this story with you.  I will have to challenge myself a little harder to come up with a legitimate blog post – but, you can read the story and adjust your plans accordingly for this risk.

Risk Free, Satisfaction Guaranteed Program Review

Safe Harbor Consulting (SHC), a management consulting firm specializing in business continuity, disaster recovery, emergency response and crisis management, is offering a risk free, satisfaction guaranteed Program Review.  SHC will review your program documentation, interview employees with key responsibilities in your solutions and review other program material in an effort to discover opportunities to strengthen your programs, improve your strategies and/or expand your solutions.

If, at the completion of the review and following the delivery of the SHC Findings Report, you are not satisfied that we have identified valid, substantial opportunities to advance your program and/or better position your organization’s response and recovery posture, you will not be invoiced for SHC services.

“I have found that having outside experts review program material prior to conducting a Tabletop Exercise or Physical Program Test is an excellent technique for ensuring your program material is in tip-top condition prior to sharing it with internal management and employees”, says Joe Flach, CEO and Lead Consultant at SHC.  “If the material we review is in excellent condition and, other than a few cosmetic fixes has no real identifiable issues, problems or concerns, than our review will indicate as much and we will not charge you for our efforts.  Only if we discover legitimate opportunities to improve the program or program material, and only if the customer agrees that we have achieved this, will we prepare an invoice for our agreed upon fees.”

To take advantage of this Risk Free, Satisfaction Guaranteed Program Review offer, please contact Safe Harbor Consulting at (253) 509-0233 or email them at safeharborconsulting@yahoo.com.  To learn more about Safe Harbor Consulting you can visit them at www.safeharborconsulting.biz.

Atmospheric River 1000 (ARk)

Really, it’s not like I just sit around thinking up the next disaster that might occur; or that I spend all day searching the Internet for catastrophic events to scare the stuffing out of people.  But, given what I do for a living, they just kind of have a way of finding me.

About a year ago, someone told me about the potential of a huge rain storm on the West Coast of the United States known as an ARk Storm.  Apparently there is this weather pattern known as an Atmospheric River (the “AR”) that has a catastrophic occurrence about every 1000 years or so (thus the “k”) that scientists are studying and suggesting could occur again.  The last ARk Storm to hit the West Coast happened in the late 1800s, (so, in my book that means we have another 900 years to wait) but meteorologists are just starting to understand the potential impacts another ARk Storm could carry.

Up here in the Pacific Northwest we are very used to the Pineapple Express weather pattern, which, I now understand, is an example of an Atmospheric River – just not the build your Ark kind of event the ARk Storm is supposed to be.

Certainly, throughout the US we have had our share of floods, mudslides and other heavy rain events that have resulted in Emergency Response, Crisis Management and Business Continuity plans being engaged.  Who cares what neat, scientific name we give the events that caused them?  But, I did find some interesting articles about this ARk Storm potential that I thought you might want to check out, including a story that suggests its just a bunch of Internet hype.

And no, I am not suggesting we now need an ARk Storm Response Plan!  I just like to share potential risk information with people who might want to know.  You know, to scare the stuffing out of you!

Tabletop Exercises: Are These Enough?

At Safe Harbor Consulting we specialize in creating and facilitating Tabletop Exercises.  In fact, most of our projects and a large percentage of our revenue is earned from performing this service.  We, therefore, understand, appreciate and tout the benefits and values of conducting these exercises and realize the efficiencies and effectiveness of using this non-invasive testing technique.

I do get concerned however, that organizations depend too much on the tabletop exercise as their one and only business continuity, disaster recovery, crisis management testing tool.

Tabletop exercises are great for educating management, employees and others on the strategies and solutions in place.  Tabletop exercises are terrific for ensuring the documentation supporting these programs are complete, accurate and easy to understand.  Tabletop exercises are tremendous for promoting communications and cross-checks between various departments and groups that have different yet coordinated roles in a comprehensive resiliency and recovery organization.

But …

Tabletop exercises do not physically prove the validity, effectiveness and timeliness of most of the physical infrastructure and logistics in place to engage and support a real-life implementation of the solutions in place.

Talking through how you would engage call trees or notification and escalation protocol should not take the place of actually performing call tree and notification tests.

Ensuring people know where to go and how to conduct business in alternate site locations (even those that use in-house, displacement strategies) should not stop you from physically exercising this strategy every now and then.

Reviewing lists of phone numbers of people and agencies to call at time of a crisis, should not prevent you from physically dialing those numbers to verify they reach the intended party and that party understands what is/would be required of them at time of crisis.

Tabletop exercises are indeed, relatively inexpensive ways to educate people, heighten awareness of programs, procedures and protocol.  Tabletop exercises can be conducted with little disruption to the production work environment and little risk of impacting productivity.  And, conducted properly, tabletop exercises can absolutely discover plenty of opportunities to improve your programs and implemented solutions.  I just wish to caution folks that these exercises should not stop you from attempting mock events that more closely simulate a real life response to a potential business interruption event.

I am not saying, “Do not do tabletop exercises”, or even, “Do fewer tabletop exercises”; I am just suggesting that you should strive to include physical tests in your overall exercising process, when possible, to better prepare your company for the eventual business interruption event.

These, “other kinds of exercises” are hard to coordinate, take up time of many employees in the organization, can be disruptive to the production environment and, can be rather expensive to conduct – but, the further validation they provide and the heightened level of preparedness they instill can be worth the investment, every now and then.

Just don’t let yourself become too complacent with the tabletop exercise.  Try to get permission to do more, if you can.  Outside agencies, like fire departments, local emergency management agencies, and the such, usually love to assist and play a role in these exercises – I urge you to reach out to them and see how they might help you raise your exercise bar.

Safe Harbor Consulting would absolutely love to continue to perform a bunch of tabletop exercises – but, we would be even happier if we could assist you with a more life-like simulated exercise to really test your business continuity, disaster recovery and/or crisis management posture.

Lessons Learned

The 10 Year Anniversary of 9/11 has come and gone.  Some tears were shed.  Some memories were shared.  Some hugs were given.  And, some heartache relived.

I wrote an article for Continuity Insights magazine on Lessons Learned from this event and whether or not they are still applicable today.  It is now posted to their web site for all to see.

I also participated on a panel discussion on the topic for the American Bar Association.

Both of these events were somewhat cathartic for me as I still have some healing to do from this event.  I cannot imagine how those who lost loved ones (beyond the few acquaintances that I knew) must feel.  Again, my family was one of the lucky ones – my wife, who would have been in the middle of it all, took that day off for a doctor’s appointment and I did not have any business scheduled downtown that day.  My children will tell you about the fears they had for hours while away at college waiting to hear about our well being.

I do hope that the lessons learned from that tragic day, business continuity related and otherwise, remain with us always as well as the memories of those who were lost.

My thanks go out to all the agencies, organizations and others who did a fantastic job in remembering that day and paying tribute to the heroes – many of whom we will never know.

The Emergency Notification and Escalation Process

I think that one of the biggest challenges in the Emergency Response process is devising efficient and effective escalation and notification protocol.  Who gets called and when?  What are the triggers to escalate?  Who is being called into action vs. who needs to simply be informed?  This is particularly challenging when the event is one that starts out small and grows into something larger.

The response to Hurricane Katrina is a prime example of an event where this process got confused and mismanaged.  Certain agencies were waiting to be called into the response process while those in need expected them to engage automatically.  The “engagement trigger”, if you will, was not defined and understood.  The responder thought the trigger was a request by the local authorities, the local authorities expected the trigger was implied by the extent of the crisis.  One waited for the phone call, while the others sat waiting for help.

I think it is important that engagement triggers be defined for all entities that could have a response action.  Are there automatic triggers, where a response team will conditionally engage given certain parameters?  Or, are there teams who will always be called into action by others?  These must be defined, communicated, known and rehearsed.  Back to the Katrina disaster – most agencies knew what to do – they just did not start doing it at the right time due to the confusion on when or how to engage.

With regards to the notification process, I often see confusion in programs between a notification that calls you into action vs. a notification to be informed or put on stand-by.  Many organizations use a multi-tiered notification process utilizing, Alerts, Declarations and an Alls Clear notification system.

An alert, prepares responders for the potential to engage should the situation escalate.  A declaration is a call to action.  Some events will bypass the alert stage and immediately result in a declaration.  Not all alerts will result in a subsequent declaration.  But, all alerts and declarations must be followed by an eventual Alls Clear. 

I have also worked with many organizations that did not have a protocol for issuing an Alls Clear communications.  I think it is important to notify all team members and all parties included in the response process, whether actively engaged or not, that the situation has ended and they can return to normal operations.

And then there is the challenge of notifying those who must engage (a call to action) and simply those who want to know.  I highly encourage limiting that “want to know” group to a select few.  Most of these folks can be kept informed after-the-fact with post event summaries.  Most of your emergency notification calls should be a call to action (or an alert to those who may be called to action).  Too often I have seen Command Centers and the emergency response process get bogged down by curiosity calls and fringe management interfering with those who have a job to do.

I recently worked with an organization that had a large number of non-responders who insisted they had a “need to know” about certain incidents.  This was remedied when there was an on-the-job injury at 3:00 am resulting in a phone call to all these individuals.  Suddenly, it became less important to include them in the notification tree and they settled for being on the post incident report distribution list.

There are many applications and services that facilitate the notification and alert process, but, the ease of use of these systems should not result in you simply adding folks to the notification list if it is not understood what their response responsibilities are.

Identify your triggers.  Make sure if you have automatic triggers that everyone understands when and where they apply.  And, include these triggers in your response drills and exercises.

Is 2011 Becoming the Year of the Disaster?

What is going on with the weather this year?  My wife and I moved out to the Pacific Northwest over three years ago, for reasons I will not bore you with, and are sitting up here without a worry in the world, while the rest of the country has been bombarded with weather and geological related incidents one right after another.

This year has truly been an epic year in terms of these events in the United States.  Certainly, each and every year brings its own challenges, but this year seems to be one right after the other.

We kicked off this year with the Groundhog Day Blizzard that crippled much of the nation from New Mexico and Northern Texas to New England and Eastern Canada.  Who knew at that time that this was just the beginning?

Shortly after this huge snowstorm, which contributed to the next crisis, the flooding began.  We have had historic levels of flooding on the Mississippi River, Missouri River and others. 

Then, the tornadoes started to occur.  The 2011 tornado season was one of the worst on record seemingly making the news every night with a new city being devastated.  According to this Wikipedia article, there have been 1,764 tornadoes in the US in 2011 – that’s a lot of tornadoes and a lot of damage!

Then, while the weather takes a little break, we get a nice little earthquake on the East Coast.  Nothing real significant (easy to say, sitting here in Gig Harbor, WA) but just a little something to rattle the cages of those who didn’t expect an earthquake to be rattling their cages.

And, that “little break” the weather took didn’t last long, as right on the heels of the earthquake, Hurricane Irene decided to give the East Coast a visit.  It turns out she was not as bad as some prognosticators predicted, but she was pretty bad nonetheless.

So, what’s next?  Oh, how about a few little Texas fires – and by little, I mean Texas-style little, which is pretty huge to the rest of us.  A little more flooding in the Northeast, perhaps – check.

I am currently working with an East Coast company to help them plan for an Emergency Response exercise.  We are quickly reaching the conclusion that they do not have to exercise given the number of real life implementations they have had and are even now currently experiencing with more floods in New Jersey.  Enough already!

Safe Harbor Consulting opened our doors as a new business continuity, disaster recovery, and crisis management consulting firm earlier this year.  Some folks have accused us of causing these disasters as a way of promoting the need for our services.  I assure you, our connections with the man above are not that good.

And I have only talked about incidents impacting the US!  Imagine how long this blog would be if I started listing worldwide events.  I am almost afraid to ask, “What could be next?”  The answer is likely to be in a future blog.

Be safe, folks.

Emergency Preparedness for Airlines

For the past 3+ years I have had the opportunity and privilege to work for a US airlines, responsible for their Business Continuity and Emergency Preparedness programs.

Emergency Preparedness for airlines is a completely different animal than what most of us are used to.  An airline’s Emergency Preparedness program is focused on one particular event – an airplane accident.  Rules, regulations and guidelines issued by the National Transportation Safety Board (NTSB) and the Aviation Disaster Family Assistance Act of 1996 stipulate exactly what is expected from airlines in their response to an accident resulting in the deaths of some or all of their passengers.

Airlines are required to immediately lock down all records and documentation that has anything to do with the aircraft(s) and personnel who operate and/or maintain the aircraft(s); immediately perform drug testing on all surviving individuals who may have operated or maintained the aircraft(s); make available a team of experts on the operation and maintenance of the aircraft(s) involved to assist the NTSB in its investigation of the cause of the accident; and, most importantly, provide immediate care and assistance to the families of the passengers and crew aboard the aircraft(s).

These requirements make it essential that airlines can quickly notify and mobilize a large number of employees (depending on the size of the aircraft(s) involved in the incident) to the accident site (or as close to the site as possible), for employees involved in the investigation; near the accident site, for families to gather, a little distanced from the actual site; at the originating and destination airports, where family members may already be or may originally gather; and, perhaps, at upline and downline airports for passengers that had connecting flights.

The operating airline must provide resources and accommodations for a number of governmental and other support organizations (NTSB, American Red Cross, FEMA and others) to set up operations near the crash site; provide accommodations and transportation for all families who wish to travel to the nearby site location, as well as to provide compassionate assistance to families who decide to remain in their home locations.

There are other requirements regarding the dissemination and security of information released to agencies, families, the media and the general public; investigation logistics; legal matters and other concerns.

The airline must also concern themselves with the fact that now that they have a large number of their employees dedicated to the accident response for days, weeks and in some cases, months, they still have an airline to safely operate with a now depleted workforce who is likely stressed and emotionally impacted by the event.

Without getting into the gory details about how all of this works and the challenges the airlines face, suffice it to say, this requires a lot of planning, education and testing of the process and procedures.  Those employees who volunteer to assist in providing family care must be trained and participate in annual refresher courses.  Those employees targeted to manage the response process in the airline’s Corporate Command Center and at the accident site, must be trained and participate in annual exercises.  Station management and staff, any of whom might be called on to set up Family Assistance Centers at their airport must be trained and tested in their responsibilities.  All, a huge undertaking.  And all what makes Emergency Preparedness a different animal at airlines.

Whereas most airlines have a relatively well developed and rehearsed Emergency Preparedness program for this specific incident, I found that they do not have very well developed or rehearsed programs for any other kind of incident that may impact their ability to operate the airlines.  Emergency Preparedness for them has become very myopic.  But, that is fodder for another blog on another day.

Hurricane Irene – The Aftermath

There are still plenty of homes and businesses without power – and may be for days to come; there are still plenty of streets and communities under water – with lots of clean up to come; there are still plenty of insurance claims to be filed and resolved – with lots of tears to accompany the frustration.  But, all in all Hurricane Irene was not quite as bad as most models projected.

There will be some discussion, no doubt, on the merits of being safe rather than sorry and the benefits of preparing for the worst versus the media sensationalizing the news and people and governments overreacting to the threat.  I, personally, could almost argue both sides of that discussion.  Although I hate this phrase, I’ll use it:  “it is what it is” or, in this case, “it was what it was”.

As stated above, in the first paragraph, it is not over for many, but the “exciting” part of the story has come and gone without too much damage being done, especially in terms of corporate crisis management, business continuity and disaster recovery programs are concerned.  If your experiences suggest otherwise, I would love to hear from you.

One interesting point to note, particularly on the domestic side of things, the American Red Cross has a terrific Safe & Well website where people, once they are safe and have access to the internet following a crisis, can post information about their whereabouts and status so loved ones can be informed.  I am not sure how well publicized this is at this time and how many “loved ones” know to look here for information, but, I think it is a terrific concept.

As I watched the media coverage for hours, it always struck me as somewhat hypocritical that reporters and camera men (and women, I suppose) stood in the wake of the storm telling people how important it is to evacuate and take cover.  If you are going to report from the middle of the storm, people (yes, the stupid ones, but there are plenty) are going to take that as a sign that they can, too.  It is almost like issuing them a challenge – obviously, it can’t be so bad; if the news reporters can stand there, so can I.

Hurricane Irene did, at least, do us the favor of inflicting the most harm over the weekend with minimal impact to commerce and allowing some time for clean-up prior to kicking off our work week.  Thanks, I guess.

Now it’s back to business.  And, back to business for business continuity planners is to ensure this event, even if it was not as impactful as anticipated, allowed us the opportunity to revisit our level of preparedness and discover opportunities for improving and preparing our programs.  Certainly, I can imagine that many of you discovered shortcomings in your communications program for disseminating information concerning your organization’s practices and procedures in response to this pending and then immediate threat.

I am glad that Hurricane Irene was not as bad as some people thought it would be.  The downside of this, however, is that the next time, fewer people will take heed to the warning remembering the, somewhat false alarm they experienced here.  I think there was this, “cry wolf syndrome” somewhat at play with Hurricane Katrina – where they had gone through hurricane after hurricane with limited impacts that they took the warnings lightly.  Let’s hope this is not the case here.

Hurricane Irene

Her she comes, ready or not.  As Hurricane Irene treks up the East Coast of the United States, individual home owners and businesses brace for her impact.

By now, you should know if you lie in her projected path and you should have prepared best you can.  The video clip in this article tells and interesting story about the potential impact Irene could have on NYC.  It shouldn’t surprise most people that the real damage is mostly likely caused by the flooding and water surge that accompanied a hurricane.  The video clip states that New York City has 17 low lying flood zones.  I wonder how many places of business fall in the footprint of these zones?

Then, of course, there are the residual effects.  If the NYC subway system is shut down, how does this impact your employees’ ability to get to work?  Do they have work from home capabilities?  What about your customers – if you depend on their presence at your place of business?

I, along with many of you, will be watching intently the next few days.  For me – I will be watching from afar.  If you are in an evacuation area or near the projected path of Irene, I wish you well.

Please feel free to post comments to this blog with any lessons learned or other stories about how Hurricane Irene impacted you, your home or your place of business.  I would love to learn from you.

Good Luck.