Bill DelGrosso, CBCP, CEM
Commercial business lives with risk every day from competitors, cash flow, and changing technology. They also face threats from recent events including the outbreak of the Ebola virus, including in the US, increasing natural disasters, and protests in Hong Kong. These external, uncontrollable events suggest that you review the Emergency Response Operations, and the Coordination with External Agencies Professional Practices elements of your continuity plans. In each of these examples, organizational business continuity management system (BCMS) planning will be dependent on external agencies level of sophistication, legal jurisdiction, and response capability. Effective BCMS planning reviews, given this framework, should include three key areas:
- Make This about People
The core of any business is the people that you employ to do the job. Incidents that interrupt your business will likely impact your personal extending the time that they will get back to work. The Ebola outbreak is having significant personal impacts, as well as economic ones. Viruses don’t respect national boundaries, so consider how your BCMS would address these issues;
- Infection of your personal: If Thomas Eric Duncan were an employee, how would your HR policies support him and his treatment, as well as interacting with public health entities that will need to track movement and exposure of clients and coworkers. Is your corporate communications personnel ready for the social and traditional media frenzy?
- Contamination of your workplace: If your work place has been contaminated, you may not only have to take internal steps to decontaminate, you may be required to by the jurisdiction where the facility exists. Draconian measures in some countries have brought micro economies to a standstill to put public health measures into place. You will also have to make sure that employee accountability measures and contact procedures are in place so you can notify employees. You will need to be fully aware of necessary medical screening, understanding the disease, the level of their exposure so that they can take actions to protect their health, and aid in the investigation of the event.
- Absenteeism: Every incident I have responded to include the no-show of personnel that were unable or unwilling to respond, including public safety personnel. Your BCMS plan should account for that, especially with something as personal as a health threat. Keep in mind that home and personal preparedness elements should also be part of your personnel awareness program.
- Risk Based Decision Making based on External Agency Capabilities
There are broad critiques of how public agencies globally have responded to the Ebola virus outbreak; much of it is second guessing, and misinformation. Emergency managers, including BCMS directors or planners can address that if they add External Agency Capability as a risk category in their risk assessment/ calculations. When I worked at Miami-Dade County Emergency Management, we met often with our business and industry groups to underline for them what to expect pre and post hurricane incidents. It was crucial for them to understand how evacuation orders and post incident recovery. Reaching out to local authorities as part of your risk assessment is a step toward understanding what their response capabilities, priorities, and legal authorities are. The latter is especially important when legal actions like evacuation or medical quarantine are put into place.
If you recall the 2013 Boston Marathon bombing, millions of people cooperated with the extraordinary measure taken by State and local officials for entire sections of Boston to shelter in place. The economic cost may never be calculated, and revealed the response mechanisms that public safety entities have available to them. They could not have implemented it without public cooperation. As part of your outreach to local responders, offer to exercise your plan with their participation and get feedback on what to expect. The more transparent the local officials are, the lower the risk; so be advised that you may need to raise the risk level if your research or outreach doesn’t reveal much. If your response officials know you before an event, the easier your integration into their plans and continue your prioritized business functions will be.
- Manage the Technology Dependency
Information technology (IT) is either integrated into your operations, or is integrated into the vital systems your organization or business relies on every day. A good BCMS planner should have the vision and the experience to identify, inventory, categorize and maintain the vital systems you can control, or manage as well as public infrastructure that you are dependent on. Determining how something that doesn’t destroy the systems, but limits access to their physical presence (like a protest that blocks access or a quarantine) would impact your IT infrastructure.
Learning from other peoples Emergency Response/ External agency coordination Professional Practices lessons can drive quality updates to your BCMS strategy and plan.
Bill DelGrosso is a Resiliency Strategist in the risk and business continuity practice for Booz Allen Hamilton’s Middle East/North Africa (MENA) office. He advises commercial and public clients globally on governance, critical infrastructure protection, enterprise risk management, emergency management, business continuity, and exercise programs in various industries and sectors. firstname.lastname@example.org