AmalfiCORE Blog

Health and Welfare of the People During Disasters

Introduction

A sometimes overlooked aspect of building a successful business continuity program is the impact of disaster on people’s thoughts and emotions. Whether an actual disaster, major disruption, or emergency occurs, or whether we are simply making plans for how to recover from a crisis, the welfare of the people should be a prime concern.

Since crisis situations are not a typical part of our everyday life, most people will not feel immediately comfortable discussing or handling events. Training must be included in the business continuity plan that provides a solid educational footing upon which we can build a team of responders, prepare executives to properly manage communications, and increase our chances of successfully navigating a disaster situation.

Set Requirements for BC Training and Awareness

Before setting requirements, the business continuity professional would benefit by gaining insights from the people most likely to be involved in the disaster.

Understanding to some degree, the thoughts, feelings, and motivations of each stakeholder, can assist the BC professional in the quest to build a cohesive team and reliable continuity program. The training portion of the program can then be based more on requirements that reflect the true reality of the people.

It is a well-known adage that awareness is the first step in a learning process. In the emergency services field, I know that learning and understanding more about the unknown, can calm nerves, settle fears, bring comfort, and a more realistic perspective to difficult topics, like disasters.

The next step is to identify the group that might be impacted by a disaster and obtain their insights. Knowing how to reach many of the people may be a hallmark ingredient of the BC strategy. Those impacted might include:

• First responders and immediate bystanders
• Emergency Response Team
• General employees population
• Family and friends of those directly involved
• Suppliers, vendors and other 3rd-party businesses
• Customers
• Citizens

While it may often be beyond the scope of the BC program to consider impact on all of these groups, an effort should be made to provide:

• tools like coping mechanisms
• resources like counselors
• respite, like how we arrange duty shifts and time off.

In addition, by providing avenues to appropriate resources, those groups which are outside our scope of control will have an awareness of who to call, where to go, and what to do and not do during the crisis.

Awareness of Health and Safety

Generally, keeping a workforce healthy and safe has become part of routine programs in larger companies. However, smaller firms have less time, money, or energy to do so. The smaller company will, of course, meet minimum standards of regulatory agencies, for example OSHA, and adhere to such requirements that are germane to their business environment. The owner of a small to medium sized business may more often relies on the common sense of their employees to be healthy and make personal choices related to handling stress and disruptions.

As part of the business continuity program, the BC professional can introduce information and resources that employees can turn to for help. Typical examples might include:

• Stress management educational materials
  • obtain from licensed professionals

• Information targeted to build confidence in the company’s ability to manage crisis
  • share and disseminate a summary of the BC plan
  • provide guidance with employee badge cards, online FAQs and other such tools

• Formal disaster preparedness awareness training
  • create training specific to the company or make use of a plethora of valuable and existing training material at online sites like Ready.gov [1], FEMA [2], and American Red Cross [3], to name a few.

Training our First Responders

We need to train our first responders how to recognize signs and symptoms of stress in each other and the list of stakeholders previously mentioned. The scope of people impacted in our business will be wider than can be observed by a small group of leaders or managers. By training first responders, they can help be the eyes and ears of the company. There should be feedback mechanisms in place that make it convenient and comfortable for these first responders to bring back information that can help themselves, their families, and the company as a whole.

Care of Home and Family

There are two aspects of disasters which can affect the home and family. One, is the first responder who is part of the emergency and the other is the larger group of employees impacted by the event usually in an indirect manner.

The first group, the formal first responder may be a member of the emergency response team. Or, they may be part of the crisis management or disaster recovery team, who up until now, only experienced practice drills and scenarios, and are now faced with the real thing. These employees not only must deal with their own personal reactions to trauma, but also may bring home the stress of the day. Fortunately, many official first responders today have training in recognizing stress and managing it appropriately. As business continuity professional, we must ensure that the less experienced members of the team are provided with the coping resources.

The other group of employees is those individuals who are thrust into a situation as a bystander or untrained first responder. They were there when the crisis occurred, they spontaneously offered help and participated and did so without thought to what happens next in their daily life. For this group, there may be more of a need to immediate attention post-event.

Unlike the first responders or emergency response team-ERT, this second group of employees may need more prompt attention because they probably have not had any experience, training, or preparation. Like the more experienced group, these employees may also bring home the stress of the day or event. Again, it would behoove the company to provide helpful resources either directly or through referrals.

Overall Company Health and Welfare

Corporate leaders can play a crucial role in helping an organization be prepared for disasters. McClain suggests that “A comprehensive disaster assistance programme should cover support to affected employees and family members.” [4] Vital to the plan is communications, both internally and externally.

In a current human resources article it was reported that corporate leaders may still not be informing their employees about how to manage the flu. “A recent national survey by Mansfield Communications Inc. (New York, www.mcipr.com) found that 69 percent of respondents say they have received no communication about policies in the workplace pertaining to H1N1— not even information related to hand washing or sick leave.” [5]

An informative communications plan can help set the tone for each phases of crisis and delivery of a confident message is critical to the communications success,

• Pre-crisis – The communications can address how well prepared the company is prior to a crisis.

• During the crisis  -  The communications can address what’s happening, what’s being done, and specifically target employee concerns like getting paid, reporting or not to work, how to stay in touch with loved ones etc.

• Post-crisis – Communications again address the recovery and restoration efforts and a timeline of coming changes and events.

“Like first responders, senior leaders need to practice their crisis skills safely and effectively.” [6] It is incumbent upon the people managing a company to set an example of not only caring about their business and its people, but also to demonstrate a sense of awareness through readiness programs.

Conclusion

Business continuity programs should consider the impact of disasters on our greatest assets, the people. This can be accomplished by first understanding who the people are and developing a strategy to defined requirements of an appropriate awareness and training program. The program can provide tools, resources, and support for the stakeholders as a means of ensuring the health and safety of employees, their families and the company as a whole.

First Responders plan an in important role in more than the initial crisis intervention, but also they can be trained to recognize signs and symptoms in themselves and others. By incorporating such training in our BC program, we are building a more mature preparedness strategy.

Bibliography

McClain, Melissa A. 8-JAN07. “Employee Crisis Communication and Disaster Assistance Planning: Providing Disaster Assistance to Employees and Their Families”. Journal of Business Continuity & Emergency Planning. Henry Stewart Publications Volume 1, Number 2, 213-200

OSHA- “Employer Responsibilities“. Retrieved 11-13-09 from http://www.osha.gov/as/opa/worker/employer-responsibility.html

Citations

[1] Ready.gov training information. http://www.ready.gov/business/index.html

[2] FEMA training information: http://www.fema.gov/areyouready/

[3]  American Red Cross Training information.  http://www.redcross.org/portal/site/en/menuitem.d8aaecf214c576bf971e4cfe43181aa0/?vgnextoid=46de1a53f1c37110VgnVCM1000003481a10aRCRD&vgnextfmt=default

[4] McClain, Melissa A. 8-JAN07. “Employee Crisis Communication and Disaster Assistance Planning: Providing Disaster Assistance to Employees and Their Families”. Journal of Business Continuity & Emergency Planning. Henry Stewart Publications Volume 1, Number 2, 213-200

[5] Chussil, Mark and Rbeiro, Pedro C. 2009. “Crisis! The Urgent Need for Learning“. Disaster Recovery Journal Fall 2009 Volume 22 Number 4, 44-45

[6] Irvin, Elizabeth T., Forment, Pedro, Besnoff, Larry. “Most Workers Lacking Employer Direction for the H1N1 Flu Season.” Source: Managing Benefit Plans; Dec 2000, Vol. 9 Issue 12, p4-6, 3p

Testing the IT Function for Resilience

Information Technology experts are worth their weight in gold. This is especially true when we rely on a  Systems Administrator to keep our network running smoothly, our data center operational, and our information protected.

I believe we should go out of our way to include the sys-admin, as they are commonly called, in our business continuity planning. The plan that means the most to them, and possibly to us, is the disaster recovery plan. In my experience, if there is anyone that can ‘test the heck’ out of a plan, it’s a really good sys-admin. Our challenge, is to help them understand the merits of following the test plan instead of winging it. To do that, we need to have them help us write that test plan.

If you know a sys-admin, you probably recognize a bit of appropriate arrogance that goes along with geeky-ness. They are smart, logical, analytical, and understand a great deal about bits and bytes, applications, networks, back-doors, protocols, policies,  transfer rates, redundancy, and timing, and so much more. In my opinion, we owe a great deal to the often unsung hero of the data center. They are the ones that can help save the day during a disaster. The sys-admin is so good, however, that often they appear to be ‘winging it’.

They are well educated, often needing multiple degrees (e.g. BS/MS in Information Systems) or equivalent experience (e.g. some number of years directly working with systems and networks in a large scale environment)  and demonstrated skills (e.g. working knowledge of multiple platforms and operating systems, directories, servers, routers, switches, firewalls, and wireless technology). [1]

Documentation, to the sys-admin is often a hindrance. Systems can change quite often and the sys-admin will simply not waste time using down-level documentation. [2] They know which data chart they use, and often can be found with that page dog-eared, smudged, and torn from over-use.

I recall several years ago visiting a customer in the UK – a large telephone company. After a great tour of a well-organized data center, the director showed me one of our technical reference guides. Knowing which products they bought from us, I figured the book was about one year old. It was pristine, except for two pages, which were, yes, dog-eared, smudged, and torn. When I asked what else they needed, the director calmly said, “could we have just these two pages, electronically updated on a regular basis?” “Why of yes, of course you, can”, I said.

I think the point is, that the sys-admin, like many other key stakeholders of BC/DR plans, must be included early in the test planning process. If we find that they are testing the disaster recovery without following the documentation, then we need to help them understand the consequences of these actions. We can explain that “If the plan is not tested regularly, organizations will have no idea whether it works as expected or even at all.” [3]  And we should admit that “Even the best and most comprehensive BCDR plan gets stale over time.”[3]

A main consequence of not following a step-by-step process, is the test is not repeatable. By providing some examples of company failures during disasters and struggles with testing, we can hopefully make an intelligent case that persuades the sys-admin to get on-board with adhering to the plan.

The sys-admin can help us write the plan, they can teach others to perform the steps of the plan, and together we can help ensure a more successful outcome to both the plan and recovery from a future real event.

References:

[1] “Job Description: Systems Administrator“. 16-MAY06. Pueblo City-County Library District. Retrieved 11-08-09 from http://www.pueblolibrary.org/pld_about/employment_inc/sysadmin_desc.htm

[2] Wallbaum, Don. 1997.”Creating Usable Disaster Recovery Documentation“. Disaster Recovery Journal. Retrieved 11-08-09 from http://www.drj.com/new2dr/model/w3_002.htm

[3] Hill, Jeffrey, Evancha, David, and Karol, Tom. 29-MAY08. “Keeping Your Disaster Recovery Plan Well-Oiled“. E-Commerce Times. Retrieved 11-08-09 from http://www.technewsworld.com/story/63154.html

A Plan is Not a Plan Until It’s Tested

A business continuity plan, like many plans, is not complete until the testing has been accomplished. By this stage of the business continuity program, the ‘welcome’ of the BC professional may be worn out. There will certainly be obstacles to planning for and implementing testing. Nevertheless, testing is an important part of the timeline and should be included.

Obstacles may include a belief that the plan by itself is enough, testing will take too much time and may cost too much.

I would propose three ways to overcome these obstacles and help build support for the need for plan testing.

1.  Early inclusion in plan – It is crucial for the concepts around testing to be included early in discussions so that early buy-in can be secured. Agreement should be reached that the plan is not complete without testing and that there is a commitment to spend the time and resources necessary to perform adequate and repeatable testing.

2. Use statistics regarding success of plans during disasters – Present evidence to stakeholders that show even with standard testing, many plans still fail. Despite the diligence of IT managers to institute testing of their disaster recovery plans, “…industry analysts [cite] disaster recovery failure rates of at last 60 percent.” [2] So, essentially, we may not know if the plan will work until we have to ‘test’ it live during the actual disaster.

3. Use statistics regarding incomplete testing – There is data that indicates many companies are not testing their plans or not testing them thoroughly: [3]

• “A survey of 200 companies with between 250 and 999 employees by Vanson Bourne found that, of the 81 percent of respondents stating that they had a business continuity plan, 50 percent had only partially tested plans and 18 percent had not tested any aspect of their plans.” [4]
• “A PricewaterhouseCoopers survey found that almost half of disaster recovery plans have not been tested in the last year.” [5]
• “According to the Chartered Management Institute’s 2008 business continuity survey, 33 percent of organizations with a business continuity plan still do not undertake any form of exercise to test their plan.” [6]

With such data, we can explore the many ways in which a disaster recovery plan can miss critical test criteria that truly exercises the plan.

4. How to test properly – Testing of a BC plan is designed to ensure the plan matches the expected real-world conditions. For example, in the IT area, there is a need to perform “…rigorous and realistic testing … of the network and application systems  …including failover and recovery strategies of the production network system, personnel, and procedures.” [2] There are several ways to accomplish this task with one of the less impacting ways being the development of test models and test cases. These test cases will mimic the real world either by using standards for the type of workload and application, or by recording user transactions and replaying them as part of the test case in the model.

Summary

Testing is an important part of any plan. Data suggests that testing is either inadequate or not done at all. There will be obstacles to overcome to get testing inserted and approved in the plan. These obstacles can be overcome by the diligence of the business continuity manager in these ways: early discussion of testing, the use of data to support the exposure and need, and the creation of a test plan that emulates real-world conditions.

References:

[1] Pinhas, Doron. 17-FEB09. “Five Critical Recovery Flaws Your Last DR Test Might Have Missed”.  Retrieved 11-07-09 from http://www.continuitycentral.com/feature0645.html

[2] Gupta, Sam. 24-JAN08. “Network Emulation for Business Continuity Testing”. Retrieved 11-07-09 from http://www.continuitycentral.com/feature0543.htm

[3] Kirvan, Paul. 18-JUL08. “Improving Business Continuity Testing and Exercising”. Retrieved 11-07-09 from http://www.continuitycentral.com/news03892.htm

[4] Potter, Chris. 4-APR08. “UK Disaster Recovery Planning Activities”. Retrieved 11-08-09 from http://www.continuitycentral.com/news03841.htm

[5] 29-APR08. “Survey Looks at Business Continuity in Medium Sized UK Companies”. Retrieved 11-08-09 from http://www.continuitycentral.com/news03892.htm

[6] Mann, Bruce. 11-MAR08. ”Chartered Management Institute Publishes Its Annual Business Continuity Survey”. Retrieved 11-08-09 from http://www.continuitycentral.com/news03812.htm

Eustress vs Distress During Disasters

Disasters, major disruptions, and even training exercises can bring about chaos to a group and to individuals. Individuals will each react in different ways to these very challenging and stressful events. The business continuity manager is wise to consider both the eustress [1] and distress which results when people are exposed to crisis whether they be willing or unwilling participants.

The impact can be mitigated to some degree by employing selection criteria of emergency response team-ERT members. However, many non ERT are called upon to lead and/or help during times of crisis. Therefore, my best recommendation is to plan for these impacts and thereby improve not only our chances of a better event outcome, but also to bring about a more long-term positive result with the people, our most valuable assets.

From my experience, these are my recommended list of elements to be incorporated into early planning Each of these considerations can help address the impact on people:

• Communication – clear, accurate, and transparent; keeping informed and current, plan updates
• Awareness – bring up the level of how to react during a crisis to a broader audience, particularly focus on familiarization of signs and symptoms of stress and how to deal with it
• Training – particularly important for the ERT, but also for leaders and those more likely to be involved in assisting during a crisis
• Setting of Expectations – assignments, what to do and not to do and who should do it
• Support Mechanisms -  Employee Assistance Programs and access to counseling

Like every other aspect of our disaster plan, we need to incorporate a support system that will function to relieve or reduce stress while the crisis is occurring. That plan should include training of the leadership on what to expect related to stress, ensure that employee support mechanisms will exist and can be mobilized for use during the crisis, (i.e. counseling), and have an established method of debriefing, diffusing, and coping with the unavoidable pressures of the crisis.

Experts offer some good guidance on the subject. For example, Math [1], describes the physiology and psychology of stress in his recent paper about the effects of stress on disaster relief workers:

• Debriefing: end of day discussion of problems and difficulties
• Self-Awareness: look for early warning signs, avoid over identifying with victims, personal prejudices, vicarious traumatization
• Team Support: use the buddy system and create a positive atmosphere
• Orientation Tools: exposure to regular and routine items to identify the day, date, time, newspaper, radio TV, internet
• Effective Management Structure and Leadership: clear chain of command, available and accessible supervisors, monitor shift work, regular briefings, provide all necessary tools
• Clear purpose and Goals: crisis intervention
• Functionally Defined Roles: every worker knows what is expected of them, orientations
• Management of Workload: Task priority levels set with a realistic work plan
• Personal stress management: balanced Lifestyle: physical exercise

Team support can be an invaluable tool to help monitor and reduce stress during a crisis. In a recent presentation by former FEMA head, Michael Brown, he shared insights into how stress impacted him and some of the team.  Brown indicated that he and others went without sleep for over 36 hours – and he doesn’t recommend that at all. One of the lessons learned was that teammates need to monitor each other and intercede when necessary to ensure people are rested. This advice is not only good for safety concerns, but also for decision-making ability. [2]

References:

[1]  Math, Suresh B. 12-OCT09. “Stress Prevention and Management for Disaster Relief Workers“. NIMHANS, Bangalore

[2] Brown, Michael D. 16-OCT09. “Katrina, and Other Disasters: Lessons Learned“. ACP Denver Chapter Meeting.

Bibliography

Pinal County AZ.  “Mental Health Response to Mass Violence and Terrorism“. Chapter V: Stress Prevention, Management, and Intervention.. Retrieved 11-1-09 from http://pinalcountyaz.gov/Departments/PublicHealth/EmergencyPreparednessResponse/Documents/CDR/Stress%20Prevention,%20managment,%20intervention.pdf

Influencing: Managing Without Authority

Like many programs, the success of an organization’s Business Continuity-BC program may ultimately depend on the ability of the continuity manager or program lead to convince others of its value. Power of position alone is rarely a long-term helpful ingredient, rather, I’ve found influence can be extremely useful.

The Good Practices Guidelines (based on the BSI {PAS-56} 25999 standard) [1] recommends that the success of business continuity management in an organization is very much dependent on instilling continuity as accepted principles into the culture. In my experience, the act of instilling an accepted concept as an established practice will take a good deal of planned awareness, education and buy-in.

To do this requires:

1. Visible and continual support of senior management
2. Involvement of as many stakeholders as possible in the creation of the program
3. An easy to define and accept connection of real value to the business and its mission. [1]

Without meeting these requirements, most programs will struggle. Some of the ways to accomplish meeting these required elements is to educate the stakeholders and gain their understanding, trust, and buy-in to the concepts of business continuity. We can help them understand the impact that major disruptions may have on our business and gain and use their good ideas in the creation of suitable continuity and recovery plans.

With this responsibility to bring awareness to the organization, the BC manager can draw on generally accepted leadership principles, most notably, the concept of influence.

Yukl says that “Influence is the essence of leadership.” [2] I propose, that this type of leadership does not require rank or title. Yukl goes on to describe in-depth, the etiology of influence, it’s principle strategies and tactics. Some of these tactics include:

• rational persuasion – safety and security, keep our jobs because the company is still here
• apprising of benefits – how this will help the individual directly
• consultative involvement of stakeholders in the BC process
• collaborative support for the program
• Ingratiation – sincere praise and compliments
• Exchange – you help me and I’ll help you with one of your projects
• Coalition – seek the help of others to persuade those who are not yet on board
• Pressure – (I don’t like this, but) persistence and frequently checking in toward completion of assignments

We can find many other reference to the success of influencing. Harari, when referring to Colin Powell’s leadership principles, says “Ultimately, leadership is about power, and power is the capacity to influence, persuade and inspire others.” [3]

Summary

The BC program manager embarks on a plan to influence the organization. It will be important to build  a strategy and choose tactics to influence the senior managers and obtain their support. A key question to be answered for the leaders is to understand how critical is it that the employees are trained and how critical is the BC program to the company’s overall goals. [4]

The BC manager will need to further influence the team, stakeholders, and individuals across the organization, and establish the continuity plan as a viable and necessary part of the business.  The influence will include an awareness program through knowledge exchange or training of some sort. It will include an incentive program (rather than a power-mandatory action) which will engender belief in the system, which will affect attitudes, which drives behavior. [Good Practices Guidelines, pg 5]

Together, the strategy of influence can go a long way toward building a successful business continuity program.

References:

[1] BSI. Good Practices Guidelines 2008 Section 6 “Embedding BCM in the Organisation’s Culture” version 2008.1

[2] Yukl, G. 2006. “Leadership in Organizations“.  (6th edition). New Jersey. Pearson-Prentice Hall

[3] Harari, Oren. 2002.  “The Leadership Secrets of Colin Powell“, New York. McGraw Hill

[4] Ulrich, D., Zenger, J., Smallwood, N. 1999.  “Results-Based Leadership“. Chapter 4. Boston. Harvard Business School Press.