September 11 – What Actions should you take Now?
A year has now passed since that defining moment. Why did the World Trade Centre attacks have such an impact on all of us – it was almost as if we were personally under attack. Like most of you I watched the events unfold on television, surrounded by my colleagues. What initially looked like just another Hollywood Blockbuster suddenly took on the ominous aura of impending doom. We watched because it seemed the right thing to do – and our lives changed forever. The City of London, itself no stranger to terrorist attacks, went silent. Throughout the afternoon people quietly went home to their own worlds, where they could come to terms with the enormity of what they had just seen. Where they could reach out to friends and family and just check that everyone was fine. For all of us the Age of Innocence was over – welcome to the Age of Fear.
So we now live in a world of heightened tension, where the unthinkable could – and indeed did – happen. Now we need to look at the key issues that arose out of the disaster to make sure that, were such a horrific event to occur again, that we could do what is appropriate to mitigate some of the appalling effects.
People Matter
When you look at the issues surrounding September 11, the People Issues are at the forefront of your concerns. Buildings can be rebuilt, power can be switched on, data recovered – but without people there is no business. Without people, who will go to your wonderful contingency site? The importance of people and the techniques required to deal with their differing needs are lessons that we all needed to heed.
The Immediate Aftermath
Different firms dealt differently with this. What was crucial were two things – firstly the People Chain and secondly the Mission Room. Immediately the event occurred, you had to find out where your staff were. To do this you needed to have a pre-designed People Chain where everyone knew exactly who to contact. In this way rather than just a couple of people trying to contact the entire firm, you utilise existing team structures with seniors contacting their direct reports – and peers within the business also checking on each other. There is a need for this matrix management style of approach since you must recognise that some of the key individuals may be missing – and not only for reasons related to the disaster you are looking at.
The People Chain responsibilities should be clearly documented, with this information being both centrally held (on site and at the contingency sites) and at the private address of each and every one of your staff. One of the lessons that was also clear was that people need to know what to do. They may not be able to contact your central office, so they will need that information available where they are.
The People Chain will be used to coordinate actions within your whole team, to allow you to assess what you needed to do and to identify specific problems that need immediate addressing.
The Mission Room
Whilst many firms had reasonable contingency plans, although, more of that later few had pre-designed Mission Rooms. The Mission Room is something that needs to spring into action immediately and to work efficiently throughout the disaster. Individuals should be identified in advance and know at least two sites where the Mission Room could be set up. Each needs to have at least one person as cover, in case they are themselves directly effected. The methods of working within the Mission Room should be clearly documented, tried and tested.
The first stage of the work is to obtain information from the People Chain and to identify areas where immediate action is necessary. The other immediate action is to coordinate the release of information to the media, for many of your staff may only find out what is happening from news releases. In terms of protecting the interests of the firm, the clear and unambiguous release of information concerning the actions you are taking are of greatest importance. Those firms that recovered fastest and most effectively from the disaster were those that had a team to deal with the media, fully briefed on what to do and were able to make clear statements of policy to satisfy the needs of clients, staff and shareholders.
The Mission Room will need to systematically review each of the key areas of the business. The key contacts, together with an authorised deputy, must be pre-identified. Each will be contacted to see what is needed now and the actions to be taken in the future. The Mission Room will collate all of this information building a Mission Plan. Some things must happen right away, others may have to wait for hours or even days. The Mission Room must have total authority to make decisions as to who gets what resources and when, what are the actions needed to safeguard your staff and your business and which could wait a little longer. Again it is worth emphasising that under the pressure of such an event it is necessary for the Mission Room to work automatically, to minimise, where possible, the level of innovative thinking. Under pressure you want people to work on automatic, separating themselves from the horrors that surround them.
People Matter
At such a time do not underestimate the needs of your people. Just because they are physically unaffected, does not mean that they are able to operate effectively. They may have lost loved ones or colleagues, they may be homeless or without power, they may just be in a state of shock. It is important for the People Chain to identify what are the specific needs of each and every member of your staff and to attempt to ameliorate the problems that they are facing. It is only by facing the adversity with your people that the true sense of camaraderie necessary to sustain your firm through these problems can come into force.
You will need to arrange individual stress counselling to deal with the psychological needs of your people. Their mental well being is just as important as their physical well being. Before they return to working in what will be an increased stress environment, you need to know that they are able to cope. You also need strategies to deal sensitively with bereavement, to provide accommodation support where required, to provide immediate short term cash support in other cases. There is a lot to do and your firm will be judged by the way that you handle these difficult issues. But you must have thought all of this through in advance. Under pressure there is not the time to work all of this out afresh, it needs to have been considered so each member of the Mission Room knows exactly what to do and so that they will all work the same way.
The Business Continuity Plan
Did most plans work in the light of what happened. We have heard the stories of contingency sites in the same building, or too near to the affected office. The lessons are clear. You need a contingency site that is likely to be affected as little as possible by the event you are dealing with. This not only means that the location must be sufficiently separate, but also that the support facilities required to operate the contingency site are, where possible, different from those required at the main site. This may require more than one site, with contingency power and ate back up, for example. If you require water to cool a system down, then just ensuring that there is sufficient power to start the system is not going to be enough. Throughout disaster planning you need to think the unthinkable – what if this happens, and this, and this. Another key lesson from September 11 is that the domino affect really happens. When the disaster struck you lost your staff, your building, communications, transport, data processing – each of these needs to be considered.
The effective Business Continuity Plans had been well tested so that staff were aware of what to do. The best had them at the staff’s personal private address. However you cannot rely upon staff being at their main residence, so centrally it will be necessary to have possible alternative addresses already available. These could include their parents’ or siblings’ addresses, for example.
- Those that failed had the following characteristics:
- They had only been tested on a department by department basis and failed to deal with the totality of the issue
- They were only held at the main office and were not available to staff
- They were only held electronically and staff did not have access to the central systems
- They failed to deal with the geography issue appropriately
- They failed to consider which other firms within your location also had contracted with the same provider of contingency services
- They failed to consider the failure of the infrastructure and its impact upon the Business Continuity Plan
- They failed to identify the coordinating unit, the Mission Room
- They failed to set up a communications unit to coordinate communications with staff and the press
Considering the Infrastructure
A good Business Continuity Plan will take each of the key infrastructure issues and deal with them both individually and collectively. How should this be done? What are the issues to address? Consider the following list:
- Electric
- Telephone
- Mobile phone
- Water
- Trains
- Roads
- Airlines
- Fuel
- Data Processing
- The Market
- Data Feeds
- Customers
- Staff
- Premises
Before you can consider getting back into business you will need to have considered all of these issues. Without electric will your customers be operating? What is the impact on the infrastructure? Can I get pricing feeds through?
Some of the actions to be taken will need to be taken quickly and may not be seen as the best possible solution with hindsight. However you do not have time for hindsight under the pressures of such an event, so it is better to take an action and move on, than to agonise for hours and not act at all. The Mission Room staff needs to be decisive and not blamed for making well-intentioned mistakes.
Do you want all of your staff to go to contingency sites? In the modern world this is unlikely to be a cost-effective solution, so for many staff working from home may be a better solution. This could mean you needing to deliver personal computers, modems and new mobile phones to their office address. It will also be important not to assume things. Do not assume that everyone is at his or her personal private residence. Do not assume that just because they are alive that they are able to work. The less assumptions that you make, the better your results will be – just remember what the first three letters of the word assumption are.
Insurance
At a fairly early stage you need to look towards your insurance cover. We all know the length of time that it can take to get a claim settled, but keeping your insurer aware of what you are doing and the nature of your potential liabilities ma increase your ability to recover sums in the future. Some insurers are moving towards shorter settlement cycles.
But there were clear lessons in terms of insurance. Firstly many companies were not covered for terrorist activity, it was simply an exclusion under their policy. You need to consider buying separate terrorist insurance if this is a major threat to your business – and if you are in a tower block anywhere in the world it is a major threat.
Many institutions still buy insurance to cover routine expected losses, the losses that can be deal with through pricing. It is important to have sufficient insurance to cover these cataclysmic events. If you are a multi million dollar business, do you really want $100m of cover with a $10,000 excess. Do you really need $500m of cover with a $1m excess?
By having insurance levels and excess levels that are too low you are only moving things between cost centres – and on balance moving profits from your balance sheet to those of the insurance company.
Conclusions
When disaster strikes there is a lot to do. Those that will survive the best will be those that have planned the best. They will have tried and tested plans that attempt to consider everything and will have educated their staff to know what to do in a crisis. They will have identified their Crisis Management Team within a Mission Office and will have vested in them the authority to make decisions, highlighting things that need to be done now and those that can wait. They will have acted decisively, if not always correctly. They will have considered their staff, their clients and the infrastructure and will have communicated effectively with all of their stakeholders, including their regulators and insurers.
Do you feel confident that your plans could deal with another September 11 event at your offices or in your City? Perhaps the most important lesson from September 11 is that, I am afraid, it is sure to happen again.
