Get ready, now

By Daniel Cauchy
Illustration: Geneviève Côté

If you believe that the end of the world is nigh, then it is time to prepare a comprehensive risk management plan

For thousands of years, people have been predicting disasters, each more catastrophic than the last. Without resorting to Hollywood-style dramatics, can we really say that major events disrupt business operations? And if so, can we guard against such contingencies? Any organization’s risk management plans should provide answers to those questions.

A matter of perspective
Whether you’re a police officer, a firefighter or a soldier, expecting the unexpected is part of the job. If citizens are going to depend on civil emergency preparedness, responders have to be effective. Unfortunately, we often learn about the need for prevention the hard way. It’s impossible to anticipate each and every situation that could endanger the population and jeopardize emergency services.

That being said, it would be inexcusable not to prepare an extensive emergency plan in advance. If the plan is well structured, it can always be adapted to similar situations. Being well prepared is the secret to the success of any emergency response. Even without statistics to back up this claim, improvised operations obviously have a much lower success rate than those that are planned in advance.

The trigger
My wakeup call came before I joined the Sûreté du Québec, after a magnitude 6.2 earthquake hit Quebec on November 25, 1988. Although the earthquake’s epicentre was Saguenay, the Quebec City region was also shaken up. The earthquake lasted 10 to 60 seconds, depending on the location. For me, it lasted an eternity because I didn’t know what to do to protect my family.

Since then, I’ve learned how the police force manages such an emergency and I have come up with a wide range of response scenarios.

Organizations that know their risks are aware of the threats and the opportunities that could emerge and can act with confidence in the face of adversity. In terms of your business, why wait for a rude awakening when a little forethought can ensure you are prepared and even provide business opportunities?

What could affect me?
Let’s say you’ve been in business for a while, have a risk management plan and have dealt with your computer risks. Or you have prepared an evacuation plan in case of fire. Or you have ensured that employees who handle hazardous materials have been trained in accident prevention. In addition to occupational health and safety and physical site protection, these are some of the most commonly covered risks. Standards have been established for such risks and specialized businesses can help you implement them.

But what about risks that could affect your business that are not included in routine risk management? For example, if your store specialized in glass items, you should think about the impact of an earthquake. Or if your business was located near a river, remember that Florence, Italy, was submerged under almost five metres of muddy water in 1966.

Consider the possibility of prolonged power outages, floods, social unrest, vandalism or endless snowstorms. Events you read about that happen in other parts of the world can also happen here. What would you do to make sure your business survives?

Did you have a plan for last year’s H1N1 flu? What’s important is not that the epidemic was less serious than originally feared but our ability to react to the warning signs of a major threat. The outbreak turned out to be less serious than anticipated thanks to preventative action taken by public health organizations.

What can you do?
What can you do in the event of a disaster, a catastrophe, an act of God? Not much to prevent the event itself, but you can do a lot in terms of your reaction to it. Your goal is to ensure your business continues to operate by maintaining its management, resource supply and the delivery of products and services to customers or clients.

Be ready for anything to help your company make it through a troubling time. There might be nothing you can do, but knowing that you should do nothing will reassure you and your employees. By planning in advance how you should respond, you avoid making decisions in a crisis situation, which could result in useless or costly actions. And it is possible that these quick-fix solutions could have more serious repercussions for your business.

You need to be able to adapt to any situation. At the Sûreté du Québec, police operations are managed differently if a plane crashes at an airport or elsewhere. In both cases, its role is well defined so that the force can be as effective as possible.

Would you be able to protect your inventory if there was a catastrophe at your warehouse? Do you have a plan to assist your exclusive supplier if its warehouse is hit by a disaster? Have you organized an alternative if your transportation provider can not deliver your product to customers because of a strike? Like the Sûreté du Québec, you have to determine which actions are necessary to maintain services and limit costs. And that means thinking about it in advance. You will then be in a position to act, not simply react. In preparing an emergency plan, you will also know how far you can go and where to stop, a decision that’s usually difficult to make in the midst of a crisis.

Action
Killing a fly with a sledgehammer is effective. However, the difference between using a fly swatter or a sledgehammer is crucial when it comes to protecting your investments, your company’s reputation and your relations with your employees.

First, determine clear, simple and precise steps to take. Think of the levels of a military alert: green, yellow, orange and red. Your plan should indicate when to take the next step, i.e., from alert to preparation to minor or major actions. Plan how to return to normal operations. For each level, determine what new information will cause you to take action. Also, determine the resources needed and how they will be used.

When the Sûreté du Québec carries out emergency measures in a given region, it puts a parallel structure in place, which is flatter and less bureaucratic and focuses on the problem. Everyone involved is clear about the role he or she will play, who to report to and what his or her responsibilities are. Members of the force who are not involved in the emergency response handle the day-to-day operations.

Naturally, responding to emergencies is a law enforcement agency’s raison d’être, but its response can also serve as an example on a more basic level. Appointing a team to implement a plan already approved will give you the distance you need if you have to make tough decisions and, at the same time, make sure your company continues to operate as usual. And who can make urgent decisions if you can’t?

Careful planning will ensure you make the right decisions, at the right time and with the right people.

Is everything under control?
So you have drafted emergency plans for different situations, indicating procedures to follow and the human resources needed; however, this is not enough. You have to deal with the administrative aspects of the plan. The solutions should not cost more than what they are intended to save, which is why you need to determine the extent of the resources you will deploy and prepare a list of the suppliers you will need.

For example, if you are likely to need a generator, you could buy one ahead of time. If you don’t, include the supplier’s name and contact information in your plan, along with the estimated cost. You will have fewer decisions to make when the time comes, and those that you have to make won’t need extensive research.

If your plan requires an extra efforts by your employees, it may be a good idea to discuss it with them or the union beforehand.

If you don’t, problems are more likely to surface once things return to normal. In the heat of the moment, everyone wants to pitch in and help, but claims and grievances could come flooding in afterwards. Procedures that have been agreed upon ahead of time are clear and will prevent misunderstandings. If you have a positive working relationship, why not invite a union representative to join your crisis team?

In short, the aim is to provide as much information as possible about your disaster plan, the resources you’ll need and the necessary guidelines to translate it into action.

Plan management
Not only should you develop a disaster plan, but you also need to consider how to manage it. First, the plan should be regularly updated, depending on the amount of information that is likely to change. For example, if you need to lease machinery from various suppliers, the contact information you use at 3 a.m. on a Sunday had better be accurate or it’s useless.

Second, the people assigned to implement the disaster plan should know it, understand it and be able to access it at the critical moment. A plan saved on an office computer would be no use if the office were on fire. Nor would it be much help to make a copy on a USB key if the plan contains sensitive or confidential information. It’s up to you to make the call.

If there is a strong risk that something will happen to your business or you fear a disaster, it may be a good idea to carry out a simulation exercise, especially if reaction time is key to the plan.

Finally, one of the strengths of the Sûreté du Québec’s emergency measures plans is the quality of the debriefings held after a crisis. Learning from past experience helps to be better prepared. Obviously, nobody wants to have to experience a disaster first-hand simply to learn how to deal with it. However, there’s nothing stopping your team from analyzing situations other organizations have experienced and asking what you would have done.

Why are you in business?
You are no doubt familiar with a risk management approach that focuses on administrative factors. Even though the events looked at may be highly unlikely, they could have alarming consequences for your business. Hopefully this overview of emergency measures that could apply to the business community will encourage people to think about external factors. In addition to protecting your assets, risk management can also create business opportunities.

Defence can sometimes be the best offence. Being prepared will allow you to continue operating and ensure the survival of your business. If your competitors are affected by the same situation but lack an action plan, you will come out ahead. You can return to normal operations faster and can move to garner their market share. Rewards come to those who are prepared.

In addition, the care you put into your preparations can benefit your suppliers, clients and customers. The anticipated resources (storage, tools, backup operating facilities) and a list of suppliers and collaborators are valuable in an emergency.

For example, if you decide to buy a generator and are not affected by the event but your supplier or client is, you can lease or lend the equipment, thereby strengthening your business relationship.

Finally, if you believe, as the Mayan calendar predicts, that the end of the world will be in 2012, I suggest you start preparing now.

Daniel Cauchy, MBA, is an inspector with the Sûreté du Québec and head of audit and access to information

Technical editor: Yves Nadeau, audit and risk management partner, RSM Richter Chamberland in Montreal