NO COMPANY CAN count on escaping a traumatic crisis at some time in its future. Acts of terrorism, workplace shootings, toxic exposures, natural disasters, or civil unrest can take place right in your own neighborhood. Yet with proper preparation, you can mitigate the effects that catastrophes have on your organization.
Preparation can be daunting. After all, you need to know how to protect yourself from something, but you can't be sure what it is, when or where it might hit, or what damage it will cause. Worse, your firm may be vulnerable on many fronts.
The way to meet this challenge is to prepare for disasters using six steps:
1. Analyze your vulnerabilities. Analyze the most likely ways your company could be vulnerable to catastrophic or critical incidents. You don't want to leave it to a prosecutor, plaintiff attorney, regulator, reporter, or spouse to point out risks you could have foreseen-after it's too late. Conduct a comprehensive analysis in advance.
Begin by thinking of all possible scenarios. Consider every aspect of your operations. For example, your company might work with dangerous materials or equipment that are potential sources of injury. Perhaps your facilities are open to those with malicious intentions. Maybe your employees fly frequently, risking involvement in air disasters, or visit destinations where security is unreliable, so are vulnerable to kidnappings or terrorism.
Next, determine the likelihood of occurrence and the relative severity each scenario could have. Assign numerical values to the likelihood and severity of their perceived vulnerabilities, and then graph them. Analysis will enable you to prioritize your efforts.
2. Evaluate your existing procedures. Evaluate your preparedness procedures to determine how well what you have in place matches up to the risks you face. Evaluate them to ensure that they are valid and reliable. Can they accomplish what they are designed to do? Can they be counted on in response to repeated challenges? Some procedures may need to be enhanced. Graph corrent strengths in three columns: 1) list the risks, 2) list policies, procedures, or other controls you have, and 3) list how you can enhance or leverage your preparedness for maximum effect.
3. Identify the new procedures you need. For some perceived risks you may have no response strategy, so you must devise new procedures. But other organizations are dealing with similar threats. Look to companies that face similar vulnerabilities. If your risks include earthquakes or hurricanes, investigate the measures neighboring organizations and regional emergency management agencies are preparing. If you send employees to unstable parts of the world, find out what controls are used by other companies whose people visit the same places. And draw on your own people for valuable input.
Keep in mind both primary and secondary prevention. Primary prevention (physical security, travel policies, and safety programs) keeps incidents from occurring. Secondary prevention keeps an incident from escalating by addressing issues such as assistance for traumatized employees and their families, dealing with the media, and resumption of normal operations. For every vulnerability, you should ask, "How could we keep it from escalating into a full-blown catastrophe?"