Preparedness

The Continuity Gap

by Vincent B. Davis

Corporate confusion could spell disastrous response in a crisis. To dispel such confusion, companies should have an emergency manager on staff, ensure that employees are well prepared, and recognize that managing daily business operations is not the same as managing response and recovery operation after a disaster.

Business continuity and emergency management, with various nuances, are not the same. In the years since Y2K – through the technology boom, the Internet, and the evolution of sophisticated cyber systems – corporations have spent billions of dollars in their efforts to ensure business resilience in the face of new threats, risks, and vulnerabilities. Often lost within the processes, procedures, and plans for redundancy of data systems and information is a subtle but powerful reality: if the event cannot be managed effectively, no long-term efforts to protect the business will succeed.

Many corporations have invested little time, effort, and resources toward preparing to “manage” the inevitable outcome of a catastrophe at its onset. That discipline is the core of emergency management, not business continuity. This type of failure can be equated to having a new, state-of-the-art computerized automobile with all the bells and whistles, but forgetting to include a tire jack, with instructions on how to use it. When the “wheels fall off” of costly planning efforts, though, the result is a disaster of disconnected response.

Fundamental Gaps & Models for Success The following three fundamental realities create a phenomenon that can be best described as the “Continuity Gap”:

  • Most businesses do not employ a full-time emergency manager because they believe managing disasters can be handled by existing security or management staff.

  • The heavy emphasis of business managers on data and information technology (IT) recovery has left a gap that does not account for prevention, protection, employee preparedness, and capabilities essential to response and recovery of the whole business.

  • The assumption that managing emergencies is a “natural” consequence of managing the business has itself led to a deficiency of proper planning, training, and exercises to manage life safety and responses first for many businesses.

Contributing to the Continuity Gap is something that conspicuously seems to be absent in the business continuity planning cycle of many companies: the focus on employee and family preparedness. Adding to the mix is “corporate fear” among business managers, many of whom may feel intimidated and threatened by their lack of understanding of emergency management best practices such as the Incident Command Structure (ICS) and emergency operation center operations. Combined, the Continuity Gap, family preparedness levels, and corporate fear create the perfect storm for a failed response to major disasters, or even to minor emergencies.

Multiple models and hybrid subsets of emergency management and business continuity planning, most of which evolved independently, exist within wide-ranging corporate structures. The result has been a mixed bag of programs that vary in emphasis and approach. Table 1 provides a matrix of program types. A fully mature program has no gaps that are unchecked either as part of individual or overall planning. This matrix is a first step in assessing where an organization is with regard to business continuity planning and emergency management. Integrated programs work; however, they must be firmly anchored in true collaboration and understanding of what is needed, what is important, and what is effective. When it fails, the results can be catastrophic.

Lessons Learned – Failure to Plan An example of such failure is ABC Manufacturing (company name changed for privacy). ABC spent hundreds of thousands of dollars establishing very detailed IT recovery plans and strategies, but excluded (intentionally) all other departments and disciplines from the planning process. The “we’re in charge and we know what’s best” attitude of the company’s lead planners was fully in play. However, a structural fire at a main data facility exposed the fact that, despite their planning, the company had not created a simple evacuation plan or conducted a drill for the employees at the facility.

Although this may sound improbable, it actually happened, and thankfully nobody was killed or injured. The incident did, however, underscore the very weaknesses in many corporate plans, and led to changes in the company’s planning policies. The following four lessons learned may help corporate leaders address the Continuity Gap:

  • Lesson 1: Do not allow business continuity, IT, risk, compliance, security, or other key business functions to plan in a vacuum. Although these organizations are typically specialists, they often lack a broader understanding of emergency planning. This means not merely expecting key stakeholders to “play nice” and collaborate on their own, because chances are it will not happen. To ensure accountability, consider Lessons 2-4.

  • Lesson 2: Establish a planning team representative of the key players. If possible, retain an outside consultant to help establish regular planning meetings, goals, objectives, and outcomes. This will help prevent “turf wars” and ensure all voices are equally heard in the planning process.

  • Lesson 3: If not already on staff, hire an experienced emergency manager. Although the business continuity and other teams may be staffed with quality people, they are not necessarily experienced in the nuances of emergency planning and operations. 

  • Lesson 4: Establish an inclusive and comprehensive guidance document that clearly sets forth the company’s philosophy, culture, and methodology for handling emergencies. Do not leave planning to chance, and do not assume all key managers and departments are entering the discussion from the same vantage point. Collaborate at all costs, do not assume any function has all the answers

Finally, a common company goal is to be resilient to support its stockholders, investors, and customers, and to continue to lead the long-term financial viability of the communities it serves. Often forgotten in that effort are the people who make it happen. Every business continuity or emergency management program plan should begin and end with the understanding that, regardless of the business, it cannot run by itself without employees.

Part of every resilience plan, program, and activity should involve asking the question, “What have we done today to ensure our employees are equipped and capable of supporting the recovery?” Disaster planning should be anchored in employee and family preparedness. To accomplish this, human resources must be actively engaged on the planning team. If an employee’s family is affected by the emergency, he or she will not be free to come to work or to play a critical part in company recovery.

 

Vincent B. Davis, CEM, is senior preparedness manager for Sony Network Entertainment, where he is responsible for developing disaster plans and programs for the company’s North America locations. Before joining Sony, he was program manager of emergency preparedness and response for Walgreens Co., where he designed emergency plans and coordinated emergency operations center operations for the company's 8,300 stores and facilities during major disasters. Following his career in the U.S. Air Force and Illinois National Guard, with 23 years in military public affairs, he served as: external affairs and community relations manager at the Federal Emergency Management Agency (FEMA); regional preparedness manager for the American Red Cross of Greater Chicago; and private sector consultant to the Illinois-Indiana-Wisconsin Regional Catastrophic Planning Team. He holds certifications as an Illinois Professional Emergency Manager and FEMA Professional Continuity Practitioner, and is a member of the International Association of Emergency Managers Children’s Caucus and a lifetime member of the Black Emergency Managers Association. He authored, “Lost And Turned Out, A Guide To Preparing Underserved Communities For Disasters,” and founded PreparednessMatters.org Consulting. He also is vice president of strategic alliances and community relations for PrepWorld LLC, creators of PrepBiz Video Gamification for Disaster Preparedness Education APP for children.