Disaster Management - Allen Johnson of Scenaris

Others may argue differently, but the outrage of 9 September 2001 was the catastrophe that persuaded the insurance industry that Business Continuity Management is essential to the running of every enterprise. The cost to the insurance industry alone is conservatively estimated at £80bn and businesses have felt the backlash as Business Interruption and Extra Cost of Working premiums have soared spectacularly and companies trading from high profile premises are also being told to take terrorist cover; it is not an option. And insurers further demand evidence of Business Continuity Plans, and if you do not have them, you pay the maximum. Risk Management has at last arrived, but what a painful delivery.

Disasters are the ultimate catalyst in change management.  You don’t want them, and yet they arrive.  Any when they arrive, you have to deal with them. The employees of any organisation that has experienced serious and unwanted incidents have found themselves catapulted down a path of dramatic and rapid change. And the daunting task of maintaining control, in what is often a run away process; is the testing examination that the people of any such unfortunate organisation must face.  But because most who face the incident are meeting it for the first time; it is reasonable to assume that in the challenge between the people and the disaster, the smart money is on the disaster.  Thus plans are required to help in dealing with such events to bring guidance and order.

The primary planning task is to identify those functions which are essential to the organisation and to ensure the resources that underpin them are available in the right quantity and at the right time.  Next is to ensure that the right blend of people is used in the formation of any team which has responsibilities for recovery. To do this the planner needs to adopt an objective view of the participants, irrespective of status, gender, or ethnic origin.  The planner must also understand that everybody employed by the affected organisation has some measure of responsibility for recovery. The parallel to draw here is that everybody employed by the company is important to the company – for why else would they be employed? This simple and non-trivial issue, is invariably ignored or not understood, and, historically, when plans have been written, the employee community is therefore divided into two distinct groups.  The first group comprises the “chosen people” – i.e., those deemed senior enough or responsible enough to be accorded one or more recovery roles with definitive responsibilities; to have to themselves or to share with others who are similarly chosen.

The remaining group consists of everybody else in the company – the “rest”, or as they see themselves, ”the rejects”. Thus, even before an incident has occurred, the planner has unwittingly introduced an unnecessary division within the employee base. In certain high profile cases, like the Bishopsgate Bomb, the rejects even arrived on site to help and were turned away by senior management as being surplus to requirement.  The very nature of such treatment of employees in this instance, served more to divide than unite, and at a time when striving for common goals demanded unification.  And when the disaster has struck and recovery is achieved as the business is put back together again, now what happens? Well the “rejects” return to a company full of heroes, heroines and champions.  The “chosen people” had worked long hours; they had done unusual deeds; they had met impossible challenges in difficult circumstances; and despite being held and shaken in the teeth of adversity, they had come through it all – victorious and euphoric. In reality, the company’s employee population has also gone through a significant cultural change. And the “rejects” who still belonged to the pre-disaster age, did not understand this, which has the effect of further isolating them. The combined effects of this isolation and the violent nature of this particular incident meant that over the following few weeks, 25% of the staff resigned and left the company.  This example is not unique.

However, to avoid the negative aspects associated in the creation of these two cultural groups, it will help if one identifies who the “rejects” are and redefines their role by telling them what is required of them.  This is an integral part of the planning process which we call “Awareness Sessions”.  We do this for such audiences in our client base and the feedback is astonishingly positive.  The audiences learn of the investigative processes that have resulted in the plans.  They learn that, even if the building is destroyed, they still have a job; which is a normal, if selfish, question which frequently arises.  They learn that they have not just one role, but sometimes more, although any given role may not be within the first 48 hours.  This is because the organisation cannot make such predictions without knowing what the incident might be, when it will occur and who will be around at the time. So the message for each individual is to be somewhere where they can be contacted, and to be available at all times because recovering the business is not a 9 a.m. to 5 p.m. operation.

However, it is not always thus, as it is the combination of the nature and the extent of the incident which will be the prime drivers in determining how people will react to recovering the business, and, more importantly, themselves and each other.  According to industry statistics, and ignoring fraud, 75% of disasters, are from computer-related problems.  But where there has been a violent invasion of one’s work space, such as through criminal act, fire or explosion, etc., then problems of a different ilk visit those personally and directly affected.  And those problems tend, in the main, to be emotionally charged. So why is this the case, and what can be done about it?

You begin by understanding how one’s own workspace is treated. The majority of employees tend to have something at or about their desk or workstation which tells others that this is where they work. It is usually evidenced by such things as photographs, a sports trophy, a photocopy of an amusing cartoon, a small soft toy, a child’s early painting, etc.. Whatever it may be, it is a “thumbprint” that expresses a message to the world and says, “This area is mine”. Although this declaration is made indirectly and implicitly, it is, nonetheless, a very strong statement.  But this area can be invaded by unwanted intrusion. For example, you return from lunch one day to find a person, you do not know who they are, sitting at your desk, using your telephone and writing on your note pad with a pen that was given to you, by a loved one, last Christmas. Now the only thing that is genuinely and legally yours is the pen. The rest – the desk, the chair, etc., all belong to the company. But that is not the issue. The issue is, actually, how do you feel about the intrusion?  Mostly the feeling is one of negative reaction because you want that person out of your space.  So the relationship between ourselves and the territory we are required to operate within is very important; and there would likely be an understandable attempt to defend it.  Take it away, even temporarily, and there is potential for a problem.

If the territory is removed and it is intact, then one has options as to how to manage the situation to regain it.  If, however, the territory is the subject of a violent invasion, then human reactions will follow and the nature of such reactions is likely to differ from individual to individual because no two people are identical.  A flood, or leak, or system outage, or some other temporary reason for denial of access, does not to carry the same message as that of an incident whose violence disfigures or obliterates the operating space.

Imagine standing outside your offices, at the proper emergency muster point, only this time it is not a fire drill. This time it is for real; and you can see the building burning and the sounds, the sights and smells of this experience are further magnified by how others around you are reacting.  The growing fire spreads to the car park engulfing vehicles in its path.  The Emergency Services eventually arrive.  The intensity of this experience is further swollen by such uncertainties of getting home, because the jacket containing your railway ticket is in the building; once home, how do you get in, because the front door keys are in the same jacket; as are your credit cards, etc..  And after the initial euphoria subsides, the trapdoor of emotional turmoil yawns before you.  There are many other matters which arise, and if you worked for Digital Equipment Company in Basingstoke, then you will know that this event actually happened. Recovery depends upon the actions of people and from a frightening incident, stress and trauma are certain visitors.

And where does stress and trauma management sit in all this? It logically follows that it must feature in the Continuity Plan with one thing being for certain, and that is if this subject has not been accorded sufficient attention as an integral recovery process, then for staff who require such support, it may simply leave them stranded with little more than the belief that the problem is theirs and theirs alone; a trouble of the mind. They can demonstrate no wound, no bruising, no blood and no scar; no outward evidence that here is a person in trouble.  In the absence of proper professional support, each person will be left to deal with it themselves.

So who provides such professional support and where does it come from? Well, for a start, it is nobody who begins by saying “Pull yourself together”. What is required is a sympathetic approach by qualified practitioners who have a proven track record, in more than one related field of expertise – typically clinical psychologists; although the initial approach that a sufferer may take could be through their immediate manager, a member of the Human Resources department or a confidante.  At this point it must also be stressed that it is not disasters alone of Bishopsgate Bomb proportions which can trigger a demand of this type. Incidents of lesser dimensions can have serious consequences for the individual and from sources which may not be obvious.  It does not have to be an incident of newsworthy proportions for staff to be exposed to a troublesome experience; let me explain. A senior manager of a London bank collapsed at work one afternoon with cardiac arrest. Two females, both trained in first aid, applied the appropriate treatment to revive him but their vigorous attempts failed and shortly after a doctor arrived on the scene, he was pronounced dead. These two unfortunate young women became stricken with guilt and remorse, not only at the death of a colleague, but also at their own abortive efforts which failed to save his life. This is how these two people began their journey towards trauma and it was the sensitivity of the Bank’s own management team that lead to them undergoing treatment to help them come to terms with the incident. The bank hired qualified experts to help these women, and in time, they were able to discuss the matter cogently and without emotional breakdown. Thus stress and trauma management must be an integral part of any recovery process whose principal aim is to deliver an organisation from major difficulties through the unusual efforts of the people it employs.  Any Plan should pull in external expertise to deal with the matters that the organisation cannot otherwise deal with.

Preparing an organisation to use their contingency measures, does not end with providing for the needs of people, but should extend to rehearsals if it is to be effective. The methodology to do this is not complicated but it is involved and should use exercises which grade in complexity over time.  I liken this to learning to drive a car.  A friend gives me a copy of the Highway Code (equivalent to the Continuity Plan), and tells me that if I learn everything within the book, which informs me of all the rules and regulations that are part and parcel of the system of highway usage, that I will be able to drive a car. Wrong! And it could be no further from the truth.  When I have learned the book, I still need driving lessons, and probably quite a few before I take my test. Remember your first lesson?  Three pedals, three mirrors, two left feet, responsibility, the like of which you never had before and the chance of killing somebody. So your first lesson was full of uncertainty, trepidation and kangaroo petrol. But over time, the lessons became more involved, and the more success you enjoyed, the more confident you became; until such time as you were prepared to take your test.  Well an organisation and its people are no different. They too need to begin with simple exercises which examine their abilities to use their plans and which grade in complexity over time.  Preparedness is the key, and provided everything attempted is achievable, then success should follow. But an enterprise must be taken through a logical process that culminates in it re-booting its business from its recovery centre.  We have seen organisations attempt recovery tests which have been extended IT tests with a few End Users in attendance, and it all looks okay but it has never been a proper test.  We have also seen the insane risk takers that lock the main door and declare a disaster.  In the case of the latter, every attempt we have knowledge of, has ended in abject failure. Over the last nine years our team of dedicated specialists has tested and exercised in excess of 80 Business Continuity Plans for 78 organisations in such places as Moscow, Frankfurt, Paris, Dublin, Tokyo and throughout the UK.

In conclusion, it should always be borne in mind that the key resource, and it’s most volatile, in any business, is people; without people you have no business.  Similarly, you cannot fully recover a business without its staff, all of them.  Thus by having a plan, having the people and preparing them properly, then recovery from a disaster becomes a more viable outcome.

If you would like to discuss anything you have read in this article, please call us on 01483 454033 and talk to a Consultant for free.

Allen Johnson

Director

Scenaris Ltd

allen.johnson@scenaris.co.uk