The Emergency Management Gap - Why It Could Threaten Business Resilience
Vincent B. Davis - CEM
This past summer I began my 15th year as an emergency manager on an exciting new path, moving from frigid Chicago to sunny southern California to assume a newly created position of Corporate Emergency Preparedness Manager for Sony Network Entertainment in San Diego. As I began to settle into my new role, I attended a series of internal meeting and events with colleagues, part of a carefully planned on boarding process to acclimate me to the culture of the company.
In preparation, I held a fresh stack of business cards, a single page bio, and a firm understanding of my profession as an emergency manager. As I walked into meetings with an outstretched hand and met my new colleagues from the various business units , the response was quite welcoming, although a bit awkward at times. “Oh, you’re part of the Business Continuity team” was the standard greeting. Not exactly, I politely retorted. Then without missing the opportunity for clarity, I forged ahead to explain the difference between emergency management and business continuity.
In the years since the Y2K scare, through the tech boom, the explosion of the internet, and evolution of sophisticated cyber systems, corporations have spent billions of dollars in their efforts to ensure business resiliency in the face of new threats, risks and vulnerabilities. Often lost within these processes, procedures and plans for redundancy of data systems and information, is a subtle but powerful reality…..If you can’t effectively manage the event response, none of your long-term efforts to protect the business will succeed.
Many corporations have invested little time, effort and resources to prepare to “manage” the inevitable outcome of a catastrophe at its onset. That discipline is the core of emergency management, not business continuity. I equate this failure to having a new, state-of-the-art computerized automobile with all the bells and whistles, but forgetting to include a tire jack with instructions on how to use it.
If the wheels fall off all your continuity planning work, it will likely be the result of a disorganized and disconnected response, fraught with chaos and confusion at every level. This means facing some hard facts about where your corporate team is with regard to emergencies.
Four fundamental realities make up a phenomena I call the “Emergency Management Gap”.
Most businesses don’t employ a full-time emergency manager because they believe managing disasters can be handled by an existing security or functional management staff such as facilities.
The heavy emphasis of business managers on data and IT recovery has left a gap that does not account for prevention, protection, employee preparedness and capabilities essential to response and recovery of the whole business.
The assumption that managing emergencies is a “natural” consequence of managing the business has itself led to a deficiency of proper planning, training, and exercises to manage life-safety and response operations for many businesses.
The training, experience, and insight needed to effectively harness the coordination of response and recovery in a major emergency is best left to those most qualified....emergency managers.
Contributing to the Emergency Management Gap is something I’ve found to be conspicuously absent in the business planning cycle of companies with whom I’ve worked, dialogued, and benchmarked……a robust employee and family preparedness program.
Add in a mix of “corporate fear” among business managers, many of whom may feel intimidated and threatened by their deficiency of understanding of emergency management best practices such as ICS and EOC operations, and you’ve got the perfect storm for a failed response to major disasters, or even minor emergencies.
In my many travels throughout corporate structures, I’ve experienced multiple models and hybrid subsets of emergency management and business continuity planning, most of which evolved independently within wide-ranging corporate structures. The result has been a mixed bag of programs that vary in their emphasis and approach. For clarity I’ve provided the following matrix of program types:
The matrix is a first step in assessing where you are with regard to BC Planning and Emergency Management. Integrated programs work, however, they must be firmly anchored in true collaboration and understanding of what is needed, what is important, and what is effective. When it fails, the results can be catastrophic. A fully mature program will have no gaps that are unchecked either as part of overall planning.
An example of such failure is a company I’ll call ABC manufacturing. They spent hundreds of thousands of dollars establishing very detailed IT recovery plans and strategies, but excluded (intentionally) all other departments and disciplines from the planning process.
The “we’re in charge and we know what’s best” attitude of the company’s lead planners was fully in play. A structural fire at a main data facility exposed the fact that despite their planning, the company had not created a simple evacuation plan or conducted a drill for the employees at the data facility.
Although this sounds improbable, it actually happened, and thankfully nobody was killed or injured. The incident did, however, underscore the very weaknesses I’ve described in many corporate plans, and led to changes in the company’s planning policies.
A few lessons learned may help corporate leaders address the Emergency Management Gap.
Lesson A: Don’t allow BC, IT, Risk, Compliance, Security or other key business functions to plan in a vacuum. While these organizations are typically specialists, they often lack a broader understanding of emergency planning. Not a criticism, just a fact. This means you can’t necessarily expect your key stakeholders to play nice and collaborate on their own, because chances are it won’t happen. To ensure accountability, consider the following:
Lesson B: Establish a planning team representative of the key players. If possible, retain an outside consultant to help establish regular planning meetings, goals, objectives and outcomes. This will help prevent “turf wars” and ensure all voices are equally heard in the planning process
Lesson C: If you don’t already have one, hire an experienced emergency manager. Although your BC and other teams may be staffed with quality people, they are not necessarily experienced in the nuances of emergency planning and operations.
Lesson D: Establish an inclusive and comprehensive guidance document that clearly sets forth the company’s philosophy, culture, and methodology for handling emergencies. Don’t leave planning to chance, and don’t assume all your key managers and departments are entering the discussion from the same vantage point. Collaborate at all costs, don’t assume any function has all the answers
Finally, every company’s goal is to be resilient to support its stockholders, investors, and customers, and to continue to lead the long-term financial viability of the communities it serves. Often forgotten in that effort is the people who make it happen.
Every business continuity or emergency management program plan should begin and end with the understanding that regardless of your business controls and sophistication of technology, it can’t run by itself without employees.
Part of every resilience plan, emergency program, and business continuity activity must beg the question, what have we done today to ensure our employees are equipped and capable of supporting recovery?
Disaster planning should be anchored in a robust employee and family preparedness program. Be sure you actively engage HR on your planning team. If an employee’s family is affected by the emergency, they won’t be inclined to come to work to play their part in the company’s recovery.