Planning for Human Continuity

Crisis Management, Business Continuity, and the Post 9/11 Paradigm Shift

By MARK BRAVERMAN, Ph.D.

The passage on the left was written in the late 1980s after a series of disasters thrust the issue of corporate crisis management onto center stage. With the Exxon-Valdez spill, the Bhopal India chemical release, the Tylenol tamperings, and the space shuttle disaster, a new responsibility was added to the CEO’s job description: assuring stockholders, directors, employees, and customers that the company would survive a potentially business-ending crisis. Despite these high-profile events and additional crises over the remaining decades of the century, the fields of crisis management, emergency planning, and business continuity continued as they had, confined to their specialty silos and rarely occupying the attention of the top executive at a strategic level. Then came the terrorist attacks of Sept. 11, 2001. The attacks have exerted a profound effect on American politics and society as a whole, and nowhere has this effect been more striking than on American business. Perhaps more than any other single event in our history, the 9/11 attacks have changed the way companies prepare and plan for disasters. In the days, weeks, and months following the attacks, the limitations of existing models of business continuity planning and emergency response became painfully clear to both business leaders and disaster recovery industry experts. As a result, we have seen American business take a sharply renewed interest in how to best be prepared for the worst.

The Broadening Range of Risk
Our increased sense of vulnerability extends beyond threats by malicious intent. Recent events have exposed potentially catastrophic flaws in the systems that control the delivery of electricity and the protection of personal information. We continue to witness the chronic financial vulnerability of the airline industry and the global impact of natural disasters. Scandals such as those that brought down Enron, WorldCom, and a growing list of prominent companies, as well as product crises such as those that have recently impacted the pharmaceutical industry have exposed the vulnerable underside of large business enterprises. Increasingly, therefore, business continuity management (BCM) is conceived as an enterprise-wide project, requiring ongoing attention from the very top of the organization and the combined efforts of a multidisciplinary team. The BCM industry has grown in importance, broadening its scope beyond the preservation of data and information technology. Companies are learning that they can no longer rely on the patchwork of plans “siloed” in their separate disciplines of emergency response, disaster management, physical security, and IT. Rather, these functions must be brought together within a project that begins with regular auditing, team-based plan development, and ongoing program maintenance and testing.
Although there is growing agreement about the need for such a comprehensive, integrated approach to BCM, this is still far from the reality across the business spectrum. Gregory Shaw and John Harrald of George Washington University’s Institute for Crisis, Disaster and Risk Management have noted that business continuity functions do not receive adequate attention from the top levels of management. “…these functions may receive minimal or even no attention” they write, “[and] even when recognized and supported, they may be implemented and managed in a non-integrated manner with dispersed authority and responsibility.” We have called this transformation of business continuity planning into an integrated, enterprise-level project a “paradigm shift” primarily because of two factors: (1) It shifts the business continuity project to a strategic level. Indeed, the ability to plan for and manage a broad range of crises is increasingly a test of corporate leadership in this age of increasing uncertainty and widening threat. (2) It reinforces what was brought home so powerfully by the attacks: the resilience and survival of a business organization rests on its people. Underlying the restoration of bricks and mortar and information systems and the effectiveness of emergency response activities, it is the loyalty, resilience, teamwork, and decisions of individual people, supported by their leaders that determine the sustainability of an enterprise in the face of a disaster or corporate-level crisis.

Human Continuity: An Integral Component of Business Continuity Management
Today, the key components of BCM are well-established, and many templates and guides are available. The best of these go beyond prescriptions for procedures and checklists for emergency response. Rather, they describe an integrated, phased process that balances the development of essential process components with an overarching strategy that guides the development of the plan, its smooth implementation, and its regular testing and updating. An effective BCP can’t be adapted from a template and then consigned to a binder, with the expectation that it can be dusted off and called into service when a crisis or emergency occurs.

BCP, in order to fulfill its purpose, possesses several key attributes:

1. It begins with an assessment of risks and a deep understanding of the company culture.
2. It concerns itself as much with prevention and mitigation as it does with emergency management and recovery.
3. In its processes and procedures, it places a high priority on the welfare of its internal stakeholders, especially employees and their families.

Unfortunately, these attributes are consigned to the background in most planning projects, and often not articulated at all in overall business continuity and recovery objectives. We propose that these principles be brought to the foreground in a BCM paradigm based on the understanding of organizational culture, leadership involvement, early reporting, and commitment to the health and safety of internal stakeholders. We will use the term “human continuity” to cover issues having to do with human factors in the detection and prevention of crises, the assessment of business impact, the implementation of business continuity plans, and the pursuit of operational recovery.
Every crisis is a human crisis. Disasters, whether of human or natural origin, have direct impact on the health and job functioning of employees. They have an immediate and often long-lasting effect on workplace morale, personal and family life, and employee loyalty. Indeed, there is no business continuity without people who are assured enough of their safety to remain at work or, the acute danger having passed, to return to the workplace. The quality of emergency response, is, of course, paramount. However, it is equally as critical to business recovery that in the days, weeks, and months following the event, employees remain healthy, vital, and productive. Therefore, the following components should be integral to the BCM project:
u Plans, systems, and resources to preserve individual and organizational health and functioning during the emergency recovery periods.

• Systems to monitor the ongoing health of individuals and work organizations.
• Systems to ensure two-way internal communications – to be the “eyes and ears” of the organization.
• Appropriate protocols to respond to the acute and ongoing needs of employees and their families.
• Methods to support managers in their efforts to maintain business operations through the recovery phase.

Human Continuity in the Phases of BCM
As noted above, BCM is not composed of an unconnected string of procedures and activities. Rather, it is a process that proceeds through a number of phases. The fundamental phases are:

I. Planning for prevention and mitigation
II. Emergency response procedures
III. Crisis management, restoration, and recovery
IV. Program maintenance: review, testing, validation
Human continuity plays a critical role in each of these phases.

Phase I: Project Initiation
In this phase, planners identify the warning signs or events which will trigger plan activation. The BCP must be specifically suited to the particular profile of risks, organizational structure, and management culture of each company. It is particularly important in this phase to review lessons learned from past crises and incidents and to identify specific gaps in procedures, systems, and resources. The basic elements of this phase should include:

• Organizational assessment
• Business impact analysis
• Review of existing plans and procedures: e.g., business continuity, emergency response, crisis management, disaster management
• Project organization, activation thresholds, team composition, roles and responsibilities

Organizational Assessment: Human Continuity Components
It is crucial to understand the organizational structure and culture of an enterprise in order to ensure effective early warning, communication pathways, decision-making and ultimate recovery from a crisis. Some critical questions include:

• How is the company centralized or decentralized with respect to particular functions and operations?
• How does critical information flow: Through formal or informal channels or both? Is communication “open” or “closed?”
• How is “bad news” received? How safe is it to deliver bad news, and what is the response in terms of action?
• Does the company use mistakes and crises for learning and change?
• Is the management culture authoritarian or participatory?
• How are decisions made?

The answers to these questions will affect the way subsequent business continuity planning is carried out. For example, in a decentralized corporation, standard notification thresholds will likely need to be modified to ensure timely escalation to corporate levels when a crisis occurs. How information travels is another critical element for planning. In a culture in which information flow is tightly controlled through formal means and upper management tends to be insulated from information, crisis-related information may need to be specifically defined and accountability for transmission carefully set out to ensure that crisis-relevant information flows effectively.

Business Impact Analysis: Human Continuity Components
Most guides to business continuity planning advocate beginning the process with a business impact analysis (BIA). This is typically a financial analysis identifying the impact of losing an organization’s resources and how that impact will affect operations and revenue over time. Most guides make some reference to human resource losses as part of the BIA. For example, they may provide guidance on how to quantify the effects of losing staff to death or injury, or estimating the number and type of staff needed to restore systems, staff remote facilities, or maintain a skeleton operation. Few, however, consider how crisis conditions may affect the ability of surviving staff to fulfill critical functions. It is crucial, for example, to account for the possibility that people may be present but not fully functional, because the effects of traumatic stress, fear, grief, or simple physical exhaustion have compromised their ability to concentrate. It is also possible that staff may be unharmed but unwilling to report because of fear of returning to the workplace or reluctance to leave their families. It is also crucial to consider the effects of operating under stressful, pressured, understaffed conditions. When these considerations are made part of the BIA, the employer can plan for needed shift rotations, monitoring of stress, and procedures for intervention when signs appear that employees’ health or work accuracy may be compromised.

Project Organization and Team Composition: Human Continuity Components
For human continuity issues to be fully articulated in subsequent phases of the BCP, it is important to bring the proper expertise to the assessment and planning phases. At a minimum, this requires that human resources be involved as a key player and team member. It is also recommended that human resources be joined by an expert in human continuity. This may be an internal or external consultant. In this phase the planning team will lay the groundwork for systems to monitor organizational and individual health in the crisis management and recovery phase. Sufficient thought and attention to human continuity issues be part of the process at this point.

Phase II: Emergency Response – Human Continuity Components
The BCP should provide for procedures and resources to respond to the acute and urgent needs in a “worst case scenario.” The following list is standard for the industry:

• Save lives and reduce chances of further injuries/deaths
• Protect physical assets
• Restore critical business processes and systems
• Reduce length of business interruption
• Protect damage to reputation
• Maintain customer relations

Taking into consideration the psychological impact on employees, families, community members, and bystanders in this phase will help ensure the effectiveness of the emergency response plan. Here, perhaps more than in any other phase, planning and communication are crucial. The following human continuity components should be included in the emergency response phase:

• Accounting for staff: systems to ensure check-in and immediate information about who is safe;
• Special planning for internal communications: e.g., leadership visibility and credibility, rumor and panic control;
• Pre-arrangements for crisis-related benefits: e.g., housing, cash, death benefits;
• Identification of groups in need of counseling;
• Pre-arranged specialized resources and protocols for counseling;
• Linkages with local and public agencies (e.g., law enforcement, emergency services, Red Cross);
• Planning for staff rotation in response to unusual demand, staffing shortages, and stressful working conditions;
• Emergency staffing to handle critical functions, surge capacity, overload;
• Death notification, family liaison.

Information flow to employees during the emergency is key, not only for the purpose of conveying important information. Frequent communication from leadership carries equally important messages about safety, predictability, and compassion.
At a time when a sense of control has been shattered, there is great need for a sense that leadership is actively managing and communicating. The importance of internal communications cannot be overemphasized.

Phase III: Crisis Management And Recovery
Once the goals of the emergency response phase have been achieved, a level of business activity resumes. During this period, the company takes stock of what has been lost and assesses what is needed in order to fully restore operations during recovery and reconstruction. Human continuity issues play an important role in this process. Because of the nature of the human response to trauma and stress, and the probability that stressful conditions will persist through the recovery period, it is important to actively and continually monitor the overall health of the workforce. Indeed, the most common mistake in this regard is to provide counseling intervention for a brief period during and immediately following the emergency phase, and then to abandon further active attention to staff reactions to the stress of the crisis. Depending on the nature of the situation, Phase III may be brief – even imperceptible to some employees and customers – or it may be quite prolonged. For those responsible for business continuity, this is a crucial period for staff and organizational recovery. The following activities should be pursued during this period:

• Implement ongoing external communications plan (customers, media, board of directors, stockholders);
• Implement internal communications plan (employees, families);
• Assess changing human resources needs;
• Monitor ongoing morale and health of employees, indicators of staff resiliency;
• Provide support for supervisory and management ranks.

Support for managers is a key function during this period. In times of crisis and organizational challenge, it is the managers at middle and line levels who are at most risk for stress and burnout. They are apt to be caught between the demands of their superiors and their sense of responsibility to and connection with the employees who report to them. They are the group most likely to be in touch with the realities “on the ground.” Therefore, having specific methods to carry out ongoing communication with managers about how their organizations are faring in the recovery period is important for overall recovery.

Phase IV: Maintenance
The human continuity perspective is of enormous value in the design and execution of exercises. Drills and exercises can determine to what extent human continuity issues are effectively integrated in the BCP. If the proper expertise is involved, many of the human continuity issues referenced above will surface in the exercises. These will include employee communications, accounting for staff, evacuation and other emergency response procedures, providing services such as death notification and counseling, and coordination of human resources with other functions during the emergency and crisis management phases.

The Challenge for Leadership
Recently, voices in the business continuity field have called for a reframing of business continuity management as a core leadership and business activity. In 2002 David Smith of the Business Continuity Institute called BCM “a business-owned and driven issue that unified a broad spectrum of business and management discipline…provid[ing] the strategic and operational framework to review and…redesign the way an organization provides its products and services.”
In the same year the Standards Australia Draft Business Continuity Handbook claimed that BCM had evolved beyond a narrow approach to specialized areas to “a more holistic approach, embracing all aspects of strategic and operational areas of an organization.”
In 2004, Shaw and Harrald of the George Washington University Institute for Crisis, Disaster and Risk Management called for an “executive level champion with responsibility and authority to develop and maintain a comprehensive and integrated program and proposing “business crisis and continuity management” as the term that best describes this endeavor.
Echoing these points, I believe that leadership issues are central in the continuing evolution of business continuity management. If corporate leadership can take on Smith’s challenge to “own” business continuity as a business-driven issue rather than as a specialty practice, the human continuity components presented here will logically take their place as a lynchpin of the overall process. The creation of a comprehensive, cross-functional business continuity management project incorporating human continuity planning will provide an opportunity to create workplaces more committed to employee health and to individual and group productivity.

©Copyright Systems Support Inc. All rights reserved. Reproduction in whole or in part in any form or medium without the express written permission of System Support Inc. is prohibited.