|Disasters take many forms and don’t have
to be as destructive as a terrorist attack.
Companies must plan for hurricanes, floods,
blizzards and other natural disasters. They must
also plan for disruptions in telephone, electric,
Internet and other essential resources, regardless
of the cause. A good crisis management plan also
addresses public health and safety, including
employees, customers, clients, vendors or suppliers.
Secondary considerations include preservation of
information—both hard copy and electronic
media—protection of equipment, supplies and other
business personal property and reestablishing the
flow of services or products to customers. |
STEP ONE: CHOOSING A TEAM
The most effective
disaster plans are those company personnel
developed, tested and implemented. Companies with
existing disaster-response plans should review
them to make sure they are up-to-date and take
into account all possible contingencies. Those
leading the planning effort must ensure that all
company constituencies are adequately represented
on the team that develops the disaster response.
Senior executives should select a team that is
qualified to address the overall needs of the
business. Each of the disciplines listed below
needs one regular and one backup or substitute
member on the crisis response team, in case the
regular team member is unavailable when a crisis
occurs. Executives should select team members who
are experienced, reliable and adaptable, with
proven track records at working well under
In a medium to large
business, here are the disciplines requiring a
voice in the planning process, including details
of their role on the crisis management team:
The company’s corporate executive
leadership, with one or more of the most senior
officers involved. These individuals should lead
the company’s overall recovery operations as well
as communicate to Wall Street and national media
outlets details about the company’s status, plans
and contingencies following a disaster.
A senior accounting or financial
officer. He or she is responsible for restoring
business critical financial functions and would
establish access to any crisis-based financing
resources the company needs.
A senior human resources
representative. This person’s responsibility is to
facilitate the health, safety and welfare of the
surviving workforce, provide support to the
families of injured or deceased personnel and
monitor employee well-being during the recovery
and eventual return to normal operations.
A senior manufacturing or operations
representative. He or she should provide an
immediate assessment of what the company needs for
business continuity, schedule a return to
production and oversee the implementation of
alternative facilities if necessary.
A senior information systems or
technology officer. This individual is responsible
for preserving data operations, testing
connectivity and integrity of all electronic
databases, communication systems and systems
A senior insurance or risk management
representative. He or she will gather and
disseminate claims details to facilitate prompt
submission and payment of property and business
interruption insurance entitlements.
Public relations/media relations
representatives (both inside and outside). Their
task is to gather and disseminate as much accurate
information as feasible while maintaining regular
contact with all media to best communicate the
Legal counsel (both inside and
outside). These people will address potential
liability issues and assist and support all of the
other functions listed above with advice on
contracts and other legal issues.
management should designate a single team leader—a
crisis management director or officer. He or she
may or may not have overall responsibility for a
particular discipline as well. An assistant or
associate crisis management director should also
be named in the event the senior leader is not
As with any complex
multi-discipline corporate undertaking, the
leaders should meet and map out
Their respective crisis management
strategy and tactics within each discipline.
How to integrate their respective
disciplines at the time of a crisis.
A testing and evaluation protocol
that will allow a methodology for adjusting the
plan as needed.
STEP TWO: CREATE A RISK MANAGEMENT PLAN
continuation will hinge in large measure on a
company’s precrisis planning. Advance planning by
the disaster management team should incorporate
procedures intended to first prevent or mitigate
disasters of all kinds. This is essentially a risk
management function, addressing issues pertaining
to structural conditions, facility operations
procedures, preemployment screening and all other
tasks that can help a company identify and reduce
the likelihood of a crisis.
potential crisis, risk management will seek to
remedy, to the extent possible, any
vulnerabilities the company faces. For example, in
evaluating a facility’s exposure to acts of
workplace violence, risk management might limit
ingress and egress to only a few locations or even
to only a single locked entrance. Other options
include installing informed and trained security
officers or establishing employee and visitor
identification cards or passes.
for Disaster? |
events of September 11 made you alter
any part of your current disaster
In the past 10 years, how many times
have you enacted your disaster recovery
One to three: 26%
Four to six: 4%
More than six: 5%
*Totals more than
100% due to rounding.
Disaster Recovery Journal, ongoing
facility is located in an area prone to floods,
hurricanes or tornados, risk management
professionals should be sure all employees are
familiar with evacuation routes and the location
of the company’s preselected alternative site in
the event of serious damage or destruction to the
screening of prospective workers will serve
several risk management/crisis response functions.
First, ideally, all applicants with any history of
violent or criminal antisocial behavior can be
eliminated from the hiring process. Second, the
company can identify in advance any employees with
special evacuation needs so that if disaster
strikes, it can dispatch special assistance.
Any plan a company formulates should prepare it
for damage to its own facility as well as to other
locations. Disastrous losses in remote locations
can still have a direct and grave impact on a
company’s business operations. Losses affecting
vendors, suppliers and customers also may
jeopardize a company’s ability to obtain raw
materials, data or a market for its products.
One key to success in developing a
viable crisis response and management plan hinges
on carefully identifying the constituencies inside
and outside a company that will require
information immediately following a crisis. These
those at the affected location, but also any
employees at locations remote to the crisis site.
Employee’s families, who
will require immediate access to information about
the safety of their loved ones, as well as the
steps the company or public officials are taking
in terms of rescue efforts, transportation to
trauma centers or hospitals or other arrangements.
The local community and
government entities, including health care
organizations, that will require prompt, accurate
information about conditions at the scene; the
risks of off-site damage or injuries; the need for
any community response such as evacuations or
closures of schools, residential areas or large
commercial complexes such as shopping malls.
Government agencies at the
local, state and federal levels, that will need
complete details about a crisis. Specifically
those agencies requiring immediate notice include
departments of public safety; law enforcement
including both local law enforcement, state police
and potentially the FBI; environmental agencies
and highway authorities.
Customers the business
serves, who will need immediate information about
the state of the enterprise; the status of orders,
deliveries, and good faith advice as to whether
they should seek alternative manufacturers of
goods or suppliers of services.
Suppliers and vendors, who
will need information about the future delivery of
goods or services to the affected company; the
viability of the company; whether orders should be
delayed, modified or canceled.
The media— local, regional
or national—which will need information on what
happened; what is known to date about the facts
and circumstances leading to the crisis; the
status of employees; risks to the community; and a
detailed accounting of the steps the company is
taking in response to the crisis.
in a publicly held company, who will clamor for
information as to whether the crisis will affect
sales, revenue, growth, profit projections,
capital, creditworthiness and other measures of
Insurers of the affected
enterprise, generally, and by the specific terms
and conditions of their insurance policies, who
are entitled to prompt reporting, preliminary
estimates and other details of significant
property losses to the company’s own buildings and
equipment; potential workers’ compensation claims
arising out of injuries and/or deaths and
potential claims from third parties against the
Another key to
developing a successful crisis management plan is
to analyze carefully all potential disasters and
provide a detailed written response to personnel
throughout the company—before a crisis occurs. The
crisis management team should provide two written
copies of the plan to all employees, suggesting
they keep one at work and the other at home. The
company should review the plan regularly and
discuss it at staff meetings attended by all
employees. A meaningful plan will provide
employees with a sense of confidence that the
organization has carefully weighed, analyzed and
prepared for the full range of potential crises.
STEP THREE: THE MOMENT OF CRISIS
prepare a comprehensive plan capable of handling a
real crisis, company leadership must carefully
consider a wide variety of theoretical what-if
scenarios. When conducting a what-if analysis,
consider these questions:
What if we have to evacuate the
building? Where should we meet to determine that
all employees are safe?
What if we are denied all access to
our premises or facilities for a period of days,
weeks, months or permanently?
What if our premises or facilities
are completely destroyed by the disaster?
What if one of our vehicles is
responsible for a massive explosion, spill or
other significant catastrophe?
What if one or more senior management
officers dies either in an on-site or off-site
What if there are significant numbers
of deaths among midlevel and entry-level
personnel? How can a company be prepared to handle
the consequences and the eventual need to replace
How a particular company
handles a crisis will depend in large part on the
nature of the business. Companies engaged in
manufacturing will have a different response than
service businesses. In many respects, a service
enterprise is a far more mobile and flexible
operation. If the crisis response plan saves the
people and preserves the data, a service
enterprise can most likely relocate with relative
ease. A manufacturing facility with specialized
machinery, equipment and production lines may
require careful preplanning and potentially far
more recovery time following serious damage to its
Similarly, an entity with multiple
locations throughout a region or the nation will
have different issues to consider than a business
with a single site. Multiple locations afford an
organization the opportunity to provide crisis
response facilities at preexisting alternative
sites that already belong to the company. A
business with a single location must, by
necessity, establish a new off-site facility.
A disaster plan should outline chronologically
the procedures the company will follow and the
measures it will take in the event of a crisis.
Among other factors, the plan must address
The safe evacuation of employees,
visitors, clients, customers and vendors.
Postcrisis communication with
employees, customers and suppliers.
Preservation of hard copy and
The personnel and contractors needed
to restore damaged facilities.
Contingency plans for an alternate
Contingency plans for alternate
sources of material or information that are
required for normal provision of services or
Additional measures required to
resume normal operations such as developing a
postcrisis business plan with target dates for
Partial resumption of operations.
Full resumption of operations.
Processing employee life insurance,
health insurance and accident claims.
Simulated disaster drills and exercises are
useful ways to test each component of the
company’s disaster plan. Critical evaluations of
such drills by the disaster planning team will
identify potential shortfalls and serve as
blueprints for constructive changes. Simulations
should, to the fullest extent possible, mirror
crisis conditions including
Use of safety wardens during
Physical evacuation of premises.
Marshaling of evacuted personnel.
Activation of alternative site
Use of emergency e-mail or other
alternative communication networks.
Testing of messaging capability to
vendors, suppliers and the media.
START PLANNING TODAY
Few businesses can
survive a disaster without advance planning. Since
it’s impossible to know when and how a disaster
will strike, a company must be ready for anything.
Companies that don’t have a disaster plan, or have
one they haven’t reviewed recently, should act
immediately to build a team and develop a crisis
response that will ensure the safety of employees
and the ongoing survival of the business.