read Understanding crisis management risks assessment and planning are key to effective response by Steven E. Nyblom

Tell us what article you read and your reaction to the article. Your 'audience' is your peers, so write your reaction to be of the most value to them. It can include things like:

What was new or surprised you?

What you agree or disagree?

What in your own experience corresponds to what you read?

What was the main 'takeaway'?

Should your peers read it or not? Why or why not?

pg 1

pg 2

pg 3

pg 4

pg 5

pg 6

pg 7

Risk assessment \& planning are key to effective response By Steven E. Nyblom CRISIS MANAGEMENT PLANNING has received with the Society's Online Community) was conductconsiderable attention over the past 18 months due to ed to determine these members' perceptions of their terrorist activities. Many companies are rushing to companies' crisis management plans, their involvebetter address this much like they did during the ment in the planning process and the impact of curmonths and year preceeding Jan. 1, 2000, in response rent events. There were 296 responses; while this to concerns over potential computer failures. Many does not represent a statistically valid sample, it SH\&E professionals are being asked to lead these offers a glimpse of ASSE member opinions. Since the efforts, while others are expected to work closely respondents were ASSE members, it is reasonable to with security, human resources and allied profes- assume that they were safety professionals. Those sionals to help develop plans. with different areas of responsibility and experiCrisis management is a comprehensive subject ence-such as security, human resources and allied that encompasses all aspects of business, including professions-would likely respond differently to operations, marketing and media relations, distribu- many of the questions. tion and legal matters. As such, extensive interper- Questions and percentage answers are provided sonal communication is needed among the affected on pg. 24. Respondents represented a cross-section of groups. Often, however, program components are industries, company sizes and number of locations developed in a piecemeal manner by the individual covered by the plan. A wide variety of crises that had groups responsible for them, without the appropri- occurred in the 12 months prior to the survey were ate planning and higher-level oversight needed to identified. Some 90.5 percent indicated that their ensure a cohesive, comprehensive program. As a company had a written crisis management plan, but result, in the author's opinion, many of the most-sig- less than one-third had had reason to implement that nificant business concerns are not addressed. plan in the 12 months prior to the survey. Over the past 18 months, it has been said many The plans are called a variety of names, including times that crisis managernent planning is more emergency response plan ( 62.8 percent), crisis manurgent now than ever. This is agement plan (18.9 percent), business continuity Steven E. NyBlom, CSP, CPEA, ARM, ALCM, not true; it should have been plan (6.1 percent), disaster plan (4.7 percent) and is assistant director, casualty risk control, urgent earlier. The risks have other (7.4 percent). This diversity illustrates the need technical services, with Aon Risk Services of been known for some to establish definitions and the scope of the plans in Southern California Inc. in Los Angeles. In this time -the difference is that place. It also suggests that confusion may exist when position, he provides casualty risk control public perception has been discussing plans because those involved may not be services to clients in manufacturing, heightened. talking about the same subject matter. construction, entertainment and recreational According to most respondents, their companies' industries. He holds degrees in aeronautical ASSE Crisis plans had been updated during the past year (55.1 engineering and mechanical engineering from Management Survey percent in the past six months plus 25.3 percent in the University of California, Davis. NyBlom is a In February 2002, an the past 12 months). Most organizations (65.2 perprofessional member of ASSE, President of its online survey of some 2,000 cent) had conducted mock crisis drills within that Valley Coastal Chapter and Assistant members of ASSE's Risk period as well. Although the survey shows that conAdministrator of the Society's Risk Management/Insurance siderable effort has been directed at crisis manageManagement/insurance Practice Specialty. Practice Specialty (registered ment planning, some results demonstrate that many Disturbing findings include: -35.5 percent have not implemented all crisis management plans. -32.1 percent have not provided training to all crisis management team members. - 38.2 percent have not provided media training for key team members. - 37.8 percent have not addressed post-crisis counseling. - 33.8 percent have not established preferred vendors to respond following a crisis event. Based on these results, it is clear that plans exist within many organizations and that safety professionals are significantly involved in the process (87.2 percent of survey respondents indicated that the SH\&E manager is directly involved in the planning process). However, a significant number of respondents reported that these plans are often not wellimplemented or are missing key elements. Defining Crisis 8 Crisis Management The most critical question to start the process is "What constitutes a crisis?" The answer will determine the nature and scope of a crisis management plan. A crisis has been defined as follows: Crisis: Any incident that can focus negative attention on company and have an adverse effect on its overall financial condition, its relationships with its audiences or its reputation in the marketplace (Reid). Crisis management: Crisis management involves planning, organizing, leading, and controlling assets and activities in the critical period immediately before, during and after an actual or impending catastrophe to reduce the loss of resources essential to the organization's eventual full recovery (IIA). A wide range of terms are used when discussing crisis management; these include business continuity and business recovery (plans designed to keep a business functioning after a crisis); consequence emergency planning (the planning phase to prepare for and establish plans for responding to disasters); disaster or emergency response (response to an actual disaster); and emergency preparedness. Depending on one's background (e.g., risk management, safety management, government), these terms may mean different things. Each term has its place within the subject of crisis management. For example, some organizations define business continuity planning (BCP) as the whole process, with emergency response planning, crisis management planning and business resumption included under the BCP umbrella. Some of these terms are used to define portions of an overall crisis management plan, while others are used in a generic manner to mean the whole subject. In this context, "crisis management planning" refers to the issues from risk identification and assessment through the recovery and lessons-learned phases. The Goal of Crisis Management Planning The goal of a crisis management plan is for the company to survive the crisis with its reputation and Hoc analys named and IIA; ACC). Economic risks, such as currency fluctuato SH\&E professionals. it despledabb.ng car do our Neve doub the power of 6 . piece of equipment during manufacturing, then damage to that equipment would shut down the process stronger dependence on timely arrival of products or Risk Assessment Matrix raw materials since a smaller pool of resources is Evaluation of existing control or mitigation measavailable should deliveries be suspended. ures is part of the initial risk assessment process. Potential downtime for each critical busines; Improving these measures is part of the crisis prepafunction must be estimated in order to properly ration process. A crisis that does not occur as a result assess the risk and establish priorities for recovery of proper preventive activities saves an organization efforts. A business impact analysis (defined by time and money. Plans should include a range of Disaster Recovery Journal as "the process of analyzing information such as: all business functions and the effect that a specific incident command system (ICS) structure; disaster may have upon them") should be complet- emergency operations center (EOC) location ed. "Critical" business functions can be thought of as and backup location with instructions for team those functions absolutely necessary for the busines' members to assemble at the backup location when to remain in operation. This will vary from business the primary location is not available; to business, but could include items such as com- eemergency response team structure, roles and puter and/or phone capability, the ability to collect responsibilities; accounts receivable or the ability to manufacture a requirement for team members to maintain product. Noncritical business functions could copies of the most recent plan in multiple locations include word processing, housekeeping, preventive that would not be subject to the same incident; maintenance and stocking of amenities. - detailed diagrams including access roads, build- As part of this phase, budgets must be created for ings, surrounding structures, utility lines and control mitigation measures. The cost-benefit relationshij valves; must be included in the decision-making process. a defined contact for working with responding Mitigation measures may result in risks being down- governmental agencies; graded from a frequency and/or severity standpoint. - mutual aid agreements or contracts that allow Awareness of certain risks will be heightened bv access to preferred vendors; global, regional or local events. For example, plans details on identified risks, control methods for are typically upgraded following a significant earth- those risks and response actions required following quake (e.g., the 1994 Northridge, CA, quake). an event; Following Sept. 11, 2001, many crisis management - communication procedures during and after the plans were reviewed and modified in order to crisis, including notifying the emergency response address terrorism. As management perception of a team and communicating with employees, employee problem inevitably fades, it is more difficult to retain family members, suppliers, vendors, shareholders emphasis on a particular subject. In his 2001 Chais- and the press; this document should include an offman's Letter to Shareholders of Berkshire Hathawav site emergency phone number for messages (preferInc., Warren Buffett said, "Fear may recede with time, ably an 800 number shared with all employees) and but the danger won't. The war against terrorism can procedures for updating the recording; equipment never be won. The best the nation can achieve is a could include telephones, cell phones, radios, meslong succession of stalemates." Similar statements sengers, pagers and emergency alert systems; could be made with respect to other risks. Crisis man- location of all emergency response equipment agement planners must take advantage of heightened and supplies, including maps, first-aid kits, fire management interest. extinguishers, AEDs, cell phones and radios, food Crisis Planning \& Preparation and water provisions; The crisis management plan must be in writing - search and rescue procedures; and must address each issue identified during the provisions for backing up data and accessing identification and assessment phases. It must also vital records, as well as contingencies for hardware, clearly define roles and responsibilities. If a crisis software and paper records; occurs and multiple people attempt to take control - contingencies for plan failures, particularly with of the situation, confusion will result at the scene. respect to alternative power sources, communicaMany emergency plans likely already exist within a tion methods/equipment and provision of medical company, so rather than reinvent the wheel, it is best services; to scrutinize such plans to assess their adequacy. employee training; wwwasse.org MARCH 2003 PROFESSI - psychological evaluations for crisis manage- actions to take during and after an earthquake, and ment team members; providing emergency supplies. - psychological counseling for employees follow- Fire. The plan could cover alarm systems/proceing a crisis; dures, firefighting equipment, evacuation procedures - provision for emergency funding of activities and employee training on firefighting techniques. (FEMA). HazMat incident. A plan could include alarm Public agencies often provide substantial support systems for notifying the response team or signaling during the response. Understanding what level of an evacuation; procedures for isolating the spill or support such agencies can provide for given types of contaminated area; procedures for notifying the fire emergencies is part of the planning stage. The sup- department or EPA; and policies on cleanup and disport available depends on many variables, including posal of material. the nature of the crisis, the agencies' capabilities and - Workplace violence. The plan could include the nature of a business. Public agency support could awareness training, de-escalation training, selfbe in the form of firefighters to help control a fire, a defense, response protocols and emergency notificaHazMat team to address a chemical spill or an ambu- tion procedures. lance with medical care providers. A large-scale flood Once plans are developed, appropriate personnel may result in the involvement of the Federal Emer- must be trained, with refresher training provided on gency Management Agency (FEMA) whereas a small a regular basis. Written plans, particularly contact flood may not. A police department with a trained names and phone numbers, should be reviewed and bomb squad might respond differently to a suspi- confirmed. cious package than one without specialized training. Emergency contact names and phone numbers A hospital may receive better assistance than a retail may include: alarm company, ambulance service, store in a similar crisis because assisting the hospital attorney, bomb squad, building inspector, crisis might be considered a greater public service. counselors, demolition service, utility companies, Pre-incident planning for specific issues may EPA, fire department, guard service, HazMat include: cleanup, hospital and medical care providers, insur- - Evacuation procedures. Procedures could de- ance broker, kidnap and ransom specialists, media, scribe how to call for an evacuation; how to ensure OSHA, poison control center, police, Red Cross, everyone exits; how to shut down critical equip- sprinkler contractor, suppliers and vendors (IIA). ment; and where to gather following evacuation. This review should be completed by the crisis manDiagrams could include designated exits (at least agement plan coordinator and anyone with specific two remote exits from every location); gathering responsibilities set forth in the plan. points (where and to whom to report); first-aid sup- After plans are prepared and training has been plies and fire protection equipment; electrical circuit conducted, the risk identification and risk assessbreakers, and gas and water control valves. ment phases must be revisited regularly. Businesses - Earthquake. The plan could include seismic up- continually change, which may necessitate revisions grades for the facility, educating employees on to the crisis management plan. As soon as a crisis occurs, investigations to assign responsibility begin. Many agencies and interest groups will ask the fundamental questions of who, what, when, Crisis Mobilization \& Response where and why. Local agencies such as fire and police will investigate. The media The response phase begins once an will assert the public's right to know. Regional and state agencies will arrive as incident has occurred or a warning sug- well. And don't forget about the insurance companies and attorneys for any gests an incident may occur soon. injured workers and third parties. Clearly, managers' corporate and personal vulMobilizing personnel and responding nerability to civil and criminal litigation and administrative penalties is greater properly will help minimize business dis- than ever before. ruption. Therefore, having a well-trained, Without early attention to the organization of crisis response, a company's SH\&E team is crucial. professional's goals may quickly diverge from its attorney's. SH\&E professionals One pressing issue during this phase is and other experts are trained to analyze root causes of incidents. To do so, they ensuring that people know their responsi- immediately start gathering facts - photographs, diagrams, documents and witness bilities and have the authority to act. This statements. They put working hypotheses about what might have occurred (someincludes a succession protocol if key per- times called "cut sets") on paper, to be revised as new information is received. They sonnel are not available. These issues are summarize findings and likely scenarios of cause in notes or memos. Their purpose defined during the planning process and is to say, with some degree of certainty and as soon as possible, what caused the are included in the incident command event and how systems or procedures should be changed to prevent similar occursystem structure. Establishing alternate rences. Their training also instills in them a collegial spirit that supports the ethic of worksites may be important if a location sharing information so that others may use it to prevent similar events. is rendered unusable or hazardous. All of this is good. All of this also makes attorneys nervous. In the uncertainty Arrangements for such sites should be of the aftermath, management hires attorneys to do two things: 1) inform the comconsidered during the planning phase. pany of its potential liabilities, and the pros and cons of alternative courses of Crisis management plans will never action; and 2) limit, to the extent possible, the company's potential liability in any address all specific risks. New risks may forum in which it might find itself. To do this, attomeys are trained-much like be identified or become more apparent SH\&E professionals to learn as much as they can as soon as possible. They also over time. Therefore, personnel must be analyze all evidence retrieved. But they ask different questions. Is this fact friend trained to be flexible so they can use com- or foe? How could this fact be used against the client? How soon am Ilikely to be mon knowledge to respond to an un- required to disclose this document/statement/photograph/lab report to a foe? planned situation. Attorneys also are conditioned to not share with others until they must. They are Recovery taught that the party which controls information the longest usually gets the best Once a business has responded to the result. This does not mean withholding or burying information forever; modern immediate crisis, it must deal with recov- discovery rules prevent that. Instead, attorneys play a tactical game, protecting ery of normal operations. Recovery prior- clients by maintaining control over the rate of the release of information and the ities and plans for varying lengths of context in which it is disclosed. Unless the information gathered in an investigation downtime should be addressed in the can be effectively protected, everything that is gathered, from photographs to lab established plans. Maintaining regulatory samples, from written statements to brainstorming notes speculating why the event compliance during recovery is important occurred, is fair game for subpoena in any later court litigation or administrative as well. For example, employees must be hearing process. protected with appropriate PPE. They Two legal privileges against disclosure help attomeys and clients protect informust also be trained how to respond to mation developed during an investigation. The attorney work product privilege various situations. Improper response- protects information developed by an attorney and his/her investigators (including such as spraying water on a HazMat SH\&E professionals). While not fully effective, this privilege can usually protect an spill-may create a larger problem than investigator's written notes and impressions. The attomey/client communication no response at all. privilege protects exchanges of information between these two parties and their The recovery phase is often completed affiliated representatives. without assistance from public agencies Management attorneys must be especially sensitive about signed witness statesuch as fire and police departments (they ments. While such statements created just after a traumatic event might preserve typically leave after the initial response). the writer's memory better than on a later day, they will likely be charged with Each organization must determine how emotion. It is natural for near-victims to feel some degree of guilt after an incident; to respond. Some go out of business, today's emotionally based speculations (if only I had ... ) can quickly become while others implement fully developed tomorrow's admissions against interest. plans and recover quickly. Attomeys also are concerned about expert's written reports. One person's Restoring critical functions at the crisis hypothetical scenario is another's speculation. Once made public, it is hard to pull site or an alternate location is the first back, even if a particular hypothesis is later discounted by new information. step. Once this occurs, other business The best results are achieved by assigning an attomey to direct and supervise functions can be restored. As noted, what the investigation as early as possible. Once legal privileges are properly established is critical for one business may not be crit- and with the company's attomey as a team member, the experts can continue their ical for another. In many cases, decisions work and speak freely, leaving any worries about the ramifications of their findmust be made about rebuilding, repairing ings to the attomey. or refurbishing buildings and equipment. This will vary depending on the nature of the event and resources available. Beyond dealing with buildings and equipment, a crisis poses psychological aspects that should be addressed, yet are often neglected. Recovery teams are often subjected to physical and mental demands that can produce depression, fatigue and poor decision making. Counseling for team members and other employees, particularly witnesses, should be made available; these services should be arranged during the planning phase. The recovery process can be facilitated by insurance policies, public agencies and private relief organizations. For example, insurance policies can pay for direct damage to buildings or equipment, injuries to personnel; damages caused to third parties; direct and contingent business interruption losses and expediting expenses; and other costs. An organization's ability to rely on financial protection from the insurance company depends on the type. and scope of policies written and exclusions includ ed in them. Aside from ensuring that the proper types of coverage are in place, appropriate insurance limits must be established. This is particularly impor tant for property policies with coinsurance provisions. Such policies may require insurance limits at 80,90 or 100 percent to value with penalties after at loss if limits are inadequate. Guaranteed replacement costs policies are different from actual cash value policies. Insurance policies cannot, however, ensure? the recovery of operations nor can they prevent customers from going to a different provider. Insurance protection is only part of the equation. According to the Liberty Mutual Workplace Safetv Index, "When the indirect costs of workers' compensation claims are added to the $38.7 billion in direct [injury] costs ... the total economic burden of workplace injuries and illnesses is far greater, with estimates ranging between $125 billion to $155 biilion" (Liberty Mutual Reseach Center, Feb. 26, 2001. This shows that indirect costs are three to four times higher than direct costs. Public agencies and relief organizations may provide housing, medical assistance, financial grants and low-cost loans to affected organizations and their employees. For example, following the World Trade Center collapse, emergency service personntl, American Red Cross and FEMA provided assistance, while private organizations provided aid in the form of communication equipment, food and water, and cash grants. The eventual recovery of most individual businesses was left to the businesses themselves. Plan Testing Once a plan has been established, exercises must be conducted to verify that it works well. Training simulations/exercises need not be held for all contingencies, but they must involve key decision-making personnel. Just because a senior executive h.s assumed responsibility for leading the team does not mean that executive will perform adequately in the event of a crisis. Training simulations help identify who will respond well to a crisis. Public agencies expected to respond to a crisis should be involved in these exercises as well. Many fire departments and police departments become Risk assessment \& planning are key to effective response By Steven E. Nyblom CRISIS MANAGEMENT PLANNING has received with the Society's Online Community) was conductconsiderable attention over the past 18 months due to ed to determine these members' perceptions of their terrorist activities. Many companies are rushing to companies' crisis management plans, their involvebetter address this much like they did during the ment in the planning process and the impact of curmonths and year preceeding Jan. 1, 2000, in response rent events. There were 296 responses; while this to concerns over potential computer failures. Many does not represent a statistically valid sample, it SH\&E professionals are being asked to lead these offers a glimpse of ASSE member opinions. Since the efforts, while others are expected to work closely respondents were ASSE members, it is reasonable to with security, human resources and allied profes- assume that they were safety professionals. Those sionals to help develop plans. with different areas of responsibility and experiCrisis management is a comprehensive subject ence-such as security, human resources and allied that encompasses all aspects of business, including professions-would likely respond differently to operations, marketing and media relations, distribu- many of the questions. tion and legal matters. As such, extensive interper- Questions and percentage answers are provided sonal communication is needed among the affected on pg. 24. Respondents represented a cross-section of groups. Often, however, program components are industries, company sizes and number of locations developed in a piecemeal manner by the individual covered by the plan. A wide variety of crises that had groups responsible for them, without the appropri- occurred in the 12 months prior to the survey were ate planning and higher-level oversight needed to identified. Some 90.5 percent indicated that their ensure a cohesive, comprehensive program. As a company had a written crisis management plan, but result, in the author's opinion, many of the most-sig- less than one-third had had reason to implement that nificant business concerns are not addressed. plan in the 12 months prior to the survey. Over the past 18 months, it has been said many The plans are called a variety of names, including times that crisis managernent planning is more emergency response plan ( 62.8 percent), crisis manurgent now than ever. This is agement plan (18.9 percent), business continuity Steven E. NyBlom, CSP, CPEA, ARM, ALCM, not true; it should have been plan (6.1 percent), disaster plan (4.7 percent) and is assistant director, casualty risk control, urgent earlier. The risks have other (7.4 percent). This diversity illustrates the need technical services, with Aon Risk Services of been known for some to establish definitions and the scope of the plans in Southern California Inc. in Los Angeles. In this time -the difference is that place. It also suggests that confusion may exist when position, he provides casualty risk control public perception has been discussing plans because those involved may not be services to clients in manufacturing, heightened. talking about the same subject matter. construction, entertainment and recreational According to most respondents, their companies' industries. He holds degrees in aeronautical ASSE Crisis plans had been updated during the past year (55.1 engineering and mechanical engineering from Management Survey percent in the past six months plus 25.3 percent in the University of California, Davis. NyBlom is a In February 2002, an the past 12 months). Most organizations (65.2 perprofessional member of ASSE, President of its online survey of some 2,000 cent) had conducted mock crisis drills within that Valley Coastal Chapter and Assistant members of ASSE's Risk period as well. Although the survey shows that conAdministrator of the Society's Risk Management/Insurance siderable effort has been directed at crisis manageManagement/insurance Practice Specialty. Practice Specialty (registered ment planning, some results demonstrate that many Disturbing findings include: -35.5 percent have not implemented all crisis management plans. -32.1 percent have not provided training to all crisis management team members. - 38.2 percent have not provided media training for key team members. - 37.8 percent have not addressed post-crisis counseling. - 33.8 percent have not established preferred vendors to respond following a crisis event. Based on these results, it is clear that plans exist within many organizations and that safety professionals are significantly involved in the process (87.2 percent of survey respondents indicated that the SH\&E manager is directly involved in the planning process). However, a significant number of respondents reported that these plans are often not wellimplemented or are missing key elements. Defining Crisis 8 Crisis Management The most critical question to start the process is "What constitutes a crisis?" The answer will determine the nature and scope of a crisis management plan. A crisis has been defined as follows: Crisis: Any incident that can focus negative attention on company and have an adverse effect on its overall financial condition, its relationships with its audiences or its reputation in the marketplace (Reid). Crisis management: Crisis management involves planning, organizing, leading, and controlling assets and activities in the critical period immediately before, during and after an actual or impending catastrophe to reduce the loss of resources essential to the organization's eventual full recovery (IIA). A wide range of terms are used when discussing crisis management; these include business continuity and business recovery (plans designed to keep a business functioning after a crisis); consequence emergency planning (the planning phase to prepare for and establish plans for responding to disasters); disaster or emergency response (response to an actual disaster); and emergency preparedness. Depending on one's background (e.g., risk management, safety management, government), these terms may mean different things. Each term has its place within the subject of crisis management. For example, some organizations define business continuity planning (BCP) as the whole process, with emergency response planning, crisis management planning and business resumption included under the BCP umbrella. Some of these terms are used to define portions of an overall crisis management plan, while others are used in a generic manner to mean the whole subject. In this context, "crisis management planning" refers to the issues from risk identification and assessment through the recovery and lessons-learned phases. The Goal of Crisis Management Planning The goal of a crisis management plan is for the company to survive the crisis with its reputation and Hoc analys named and IIA; ACC). Economic risks, such as currency fluctuato SH\&E professionals. it despledabb.ng car do our Neve doub the power of 6 . piece of equipment during manufacturing, then damage to that equipment would shut down the process stronger dependence on timely arrival of products or Risk Assessment Matrix raw materials since a smaller pool of resources is Evaluation of existing control or mitigation measavailable should deliveries be suspended. ures is part of the initial risk assessment process. Potential downtime for each critical busines; Improving these measures is part of the crisis prepafunction must be estimated in order to properly ration process. A crisis that does not occur as a result assess the risk and establish priorities for recovery of proper preventive activities saves an organization efforts. A business impact analysis (defined by time and money. Plans should include a range of Disaster Recovery Journal as "the process of analyzing information such as: all business functions and the effect that a specific incident command system (ICS) structure; disaster may have upon them") should be complet- emergency operations center (EOC) location ed. "Critical" business functions can be thought of as and backup location with instructions for team those functions absolutely necessary for the busines' members to assemble at the backup location when to remain in operation. This will vary from business the primary location is not available; to business, but could include items such as com- eemergency response team structure, roles and puter and/or phone capability, the ability to collect responsibilities; accounts receivable or the ability to manufacture a requirement for team members to maintain product. Noncritical business functions could copies of the most recent plan in multiple locations include word processing, housekeeping, preventive that would not be subject to the same incident; maintenance and stocking of amenities. - detailed diagrams including access roads, build- As part of this phase, budgets must be created for ings, surrounding structures, utility lines and control mitigation measures. The cost-benefit relationshij valves; must be included in the decision-making process. a defined contact for working with responding Mitigation measures may result in risks being down- governmental agencies; graded from a frequency and/or severity standpoint. - mutual aid agreements or contracts that allow Awareness of certain risks will be heightened bv access to preferred vendors; global, regional or local events. For example, plans details on identified risks, control methods for are typically upgraded following a significant earth- those risks and response actions required following quake (e.g., the 1994 Northridge, CA, quake). an event; Following Sept. 11, 2001, many crisis management - communication procedures during and after the plans were reviewed and modified in order to crisis, including notifying the emergency response address terrorism. As management perception of a team and communicating with employees, employee problem inevitably fades, it is more difficult to retain family members, suppliers, vendors, shareholders emphasis on a particular subject. In his 2001 Chais- and the press; this document should include an offman's Letter to Shareholders of Berkshire Hathawav site emergency phone number for messages (preferInc., Warren Buffett said, "Fear may recede with time, ably an 800 number shared with all employees) and but the danger won't. The war against terrorism can procedures for updating the recording; equipment never be won. The best the nation can achieve is a could include telephones, cell phones, radios, meslong succession of stalemates." Similar statements sengers, pagers and emergency alert systems; could be made with respect to other risks. Crisis man- location of all emergency response equipment agement planners must take advantage of heightened and supplies, including maps, first-aid kits, fire management interest. extinguishers, AEDs, cell phones and radios, food Crisis Planning \& Preparation and water provisions; The crisis management plan must be in writing - search and rescue procedures; and must address each issue identified during the provisions for backing up data and accessing identification and assessment phases. It must also vital records, as well as contingencies for hardware, clearly define roles and responsibilities. If a crisis software and paper records; occurs and multiple people attempt to take control - contingencies for plan failures, particularly with of the situation, confusion will result at the scene. respect to alternative power sources, communicaMany emergency plans likely already exist within a tion methods/equipment and provision of medical company, so rather than reinvent the wheel, it is best services; to scrutinize such plans to assess their adequacy. employee training; wwwasse.org MARCH 2003 PROFESSI - psychological evaluations for crisis manage- actions to take during and after an earthquake, and ment team members; providing emergency supplies. - psychological counseling for employees follow- Fire. The plan could cover alarm systems/proceing a crisis; dures, firefighting equipment, evacuation procedures - provision for emergency funding of activities and employee training on firefighting techniques. (FEMA). HazMat incident. A plan could include alarm Public agencies often provide substantial support systems for notifying the response team or signaling during the response. Understanding what level of an evacuation; procedures for isolating the spill or support such agencies can provide for given types of contaminated area; procedures for notifying the fire emergencies is part of the planning stage. The sup- department or EPA; and policies on cleanup and disport available depends on many variables, including posal of material. the nature of the crisis, the agencies' capabilities and - Workplace violence. The plan could include the nature of a business. Public agency support could awareness training, de-escalation training, selfbe in the form of firefighters to help control a fire, a defense, response protocols and emergency notificaHazMat team to address a chemical spill or an ambu- tion procedures. lance with medical care providers. A large-scale flood Once plans are developed, appropriate personnel may result in the involvement of the Federal Emer- must be trained, with refresher training provided on gency Management Agency (FEMA) whereas a small a regular basis. Written plans, particularly contact flood may not. A police department with a trained names and phone numbers, should be reviewed and bomb squad might respond differently to a suspi- confirmed. cious package than one without specialized training. Emergency contact names and phone numbers A hospital may receive better assistance than a retail may include: alarm company, ambulance service, store in a similar crisis because assisting the hospital attorney, bomb squad, building inspector, crisis might be considered a greater public service. counselors, demolition service, utility companies, Pre-incident planning for specific issues may EPA, fire department, guard service, HazMat include: cleanup, hospital and medical care providers, insur- - Evacuation procedures. Procedures could de- ance broker, kidnap and ransom specialists, media, scribe how to call for an evacuation; how to ensure OSHA, poison control center, police, Red Cross, everyone exits; how to shut down critical equip- sprinkler contractor, suppliers and vendors (IIA). ment; and where to gather following evacuation. This review should be completed by the crisis manDiagrams could include designated exits (at least agement plan coordinator and anyone with specific two remote exits from every location); gathering responsibilities set forth in the plan. points (where and to whom to report); first-aid sup- After plans are prepared and training has been plies and fire protection equipment; electrical circuit conducted, the risk identification and risk assessbreakers, and gas and water control valves. ment phases must be revisited regularly. Businesses - Earthquake. The plan could include seismic up- continually change, which may necessitate revisions grades for the facility, educating employees on to the crisis management plan. As soon as a crisis occurs, investigations to assign responsibility begin. Many agencies and interest groups will ask the fundamental questions of who, what, when, Crisis Mobilization \& Response where and why. Local agencies such as fire and police will investigate. The media The response phase begins once an will assert the public's right to know. Regional and state agencies will arrive as incident has occurred or a warning sug- well. And don't forget about the insurance companies and attorneys for any gests an incident may occur soon. injured workers and third parties. Clearly, managers' corporate and personal vulMobilizing personnel and responding nerability to civil and criminal litigation and administrative penalties is greater properly will help minimize business dis- than ever before. ruption. Therefore, having a well-trained, Without early attention to the organization of crisis response, a company's SH\&E team is crucial. professional's goals may quickly diverge from its attorney's. SH\&E professionals One pressing issue during this phase is and other experts are trained to analyze root causes of incidents. To do so, they ensuring that people know their responsi- immediately start gathering facts - photographs, diagrams, documents and witness bilities and have the authority to act. This statements. They put working hypotheses about what might have occurred (someincludes a succession protocol if key per- times called "cut sets") on paper, to be revised as new information is received. They sonnel are not available. These issues are summarize findings and likely scenarios of cause in notes or memos. Their purpose defined during the planning process and is to say, with some degree of certainty and as soon as possible, what caused the are included in the incident command event and how systems or procedures should be changed to prevent similar occursystem structure. Establishing alternate rences. Their training also instills in them a collegial spirit that supports the ethic of worksites may be important if a location sharing information so that others may use it to prevent similar events. is rendered unusable or hazardous. All of this is good. All of this also makes attorneys nervous. In the uncertainty Arrangements for such sites should be of the aftermath, management hires attorneys to do two things: 1) inform the comconsidered during the planning phase. pany of its potential liabilities, and the pros and cons of alternative courses of Crisis management plans will never action; and 2) limit, to the extent possible, the company's potential liability in any address all specific risks. New risks may forum in which it might find itself. To do this, attomeys are trained-much like be identified or become more apparent SH\&E professionals to learn as much as they can as soon as possible. They also over time. Therefore, personnel must be analyze all evidence retrieved. But they ask different questions. Is this fact friend trained to be flexible so they can use com- or foe? How could this fact be used against the client? How soon am Ilikely to be mon knowledge to respond to an un- required to disclose this document/statement/photograph/lab report to a foe? planned situation. Attorneys also are conditioned to not share with others until they must. They are Recovery taught that the party which controls information the longest usually gets the best Once a business has responded to the result. This does not mean withholding or burying information forever; modern immediate crisis, it must deal with recov- discovery rules prevent that. Instead, attorneys play a tactical game, protecting ery of normal operations. Recovery prior- clients by maintaining control over the rate of the release of information and the ities and plans for varying lengths of context in which it is disclosed. Unless the information gathered in an investigation downtime should be addressed in the can be effectively protected, everything that is gathered, from photographs to lab established plans. Maintaining regulatory samples, from written statements to brainstorming notes speculating why the event compliance during recovery is important occurred, is fair game for subpoena in any later court litigation or administrative as well. For example, employees must be hearing process. protected with appropriate PPE. They Two legal privileges against disclosure help attomeys and clients protect informust also be trained how to respond to mation developed during an investigation. The attorney work product privilege various situations. Improper response- protects information developed by an attorney and his/her investigators (including such as spraying water on a HazMat SH\&E professionals). While not fully effective, this privilege can usually protect an spill-may create a larger problem than investigator's written notes and impressions. The attomey/client communication no response at all. privilege protects exchanges of information between these two parties and their The recovery phase is often completed affiliated representatives. without assistance from public agencies Management attorneys must be especially sensitive about signed witness statesuch as fire and police departments (they ments. While such statements created just after a traumatic event might preserve typically leave after the initial response). the writer's memory better than on a later day, they will likely be charged with Each organization must determine how emotion. It is natural for near-victims to feel some degree of guilt after an incident; to respond. Some go out of business, today's emotionally based speculations (if only I had ... ) can quickly become while others implement fully developed tomorrow's admissions against interest. plans and recover quickly. Attomeys also are concerned about expert's written reports. One person's Restoring critical functions at the crisis hypothetical scenario is another's speculation. Once made public, it is hard to pull site or an alternate location is the first back, even if a particular hypothesis is later discounted by new information. step. Once this occurs, other business The best results are achieved by assigning an attomey to direct and supervise functions can be restored. As noted, what the investigation as early as possible. Once legal privileges are properly established is critical for one business may not be crit- and with the company's attomey as a team member, the experts can continue their ical for another. In many cases, decisions work and speak freely, leaving any worries about the ramifications of their findmust be made about rebuilding, repairing ings to the attomey. or refurbishing buildings and equipment. This will vary depending on the nature of the event and resources available. Beyond dealing with buildings and equipment, a crisis poses psychological aspects that should be addressed, yet are often neglected. Recovery teams are often subjected to physical and mental demands that can produce depression, fatigue and poor decision making. Counseling for team members and other employees, particularly witnesses, should be made available; these services should be arranged during the planning phase. The recovery process can be facilitated by insurance policies, public agencies and private relief organizations. For example, insurance policies can pay for direct damage to buildings or equipment, injuries to personnel; damages caused to third parties; direct and contingent business interruption losses and expediting expenses; and other costs. An organization's ability to rely on financial protection from the insurance company depends on the type. and scope of policies written and exclusions includ ed in them. Aside from ensuring that the proper types of coverage are in place, appropriate insurance limits must be established. This is particularly impor tant for property policies with coinsurance provisions. Such policies may require insurance limits at 80,90 or 100 percent to value with penalties after at loss if limits are inadequate. Guaranteed replacement costs policies are different from actual cash value policies. Insurance policies cannot, however, ensure? the recovery of operations nor can they prevent customers from going to a different provider. Insurance protection is only part of the equation. According to the Liberty Mutual Workplace Safetv Index, "When the indirect costs of workers' compensation claims are added to the $38.7 billion in direct [injury] costs ... the total economic burden of workplace injuries and illnesses is far greater, with estimates ranging between $125 billion to $155 biilion" (Liberty Mutual Reseach Center, Feb. 26, 2001. This shows that indirect costs are three to four times higher than direct costs. Public agencies and relief organizations may provide housing, medical assistance, financial grants and low-cost loans to affected organizations and their employees. For example, following the World Trade Center collapse, emergency service personntl, American Red Cross and FEMA provided assistance, while private organizations provided aid in the form of communication equipment, food and water, and cash grants. The eventual recovery of most individual businesses was left to the businesses themselves. Plan Testing Once a plan has been established, exercises must be conducted to verify that it works well. Training simulations/exercises need not be held for all contingencies, but they must involve key decision-making personnel. Just because a senior executive h.s assumed responsibility for leading the team does not mean that executive will perform adequately in the event of a crisis. Training simulations help identify who will respond well to a crisis. Public agencies expected to respond to a crisis should be involved in these exercises as well. Many fire departments and police departments become