This information was accurate at the time of publishing, March 19, 2020. We are monitoring and updating as new information is available. This article was originally published in October 2017.
Can you keep your organization up and running during a crisis? Coronavirus disease 2019, also known as COVID-19, has caused the closure of offices, schools and other businesses as case numbers climb in the U.S. The pandemic further underscores the need for truly comprehensive business continuity planning. In other words, now is not the time to wing it.
You need a comprehensive crisis plan in place whether your biggest threat is a pandemic, natural disaster or simply a power outage. That plan must account for both pre-incident emergency preparation and how to ensure business continuity during and after the emergency period. Review your emergency procedures today to make sure your organization can stay afloat even if employees can't get to work.
Related: Is your Facility's Evacuation Plan in Compliance?
The Facility Manager's Vital Role in Business Continuity
Facilities professionals are in a unique position to influence continuity planning and execute the plan during an emergency. No one knows as much as an FM about critical building systems, so if your organization’s emergency preparation and business continuity procedures don’t spend enough time delegating responsibilities to the facilities department and accounting for how to manage the building during an emergency, the next severe storm or public disturbance may bring a rude awakening.
“It all boils down to this: we have to plan for the unexpected unavailability of people, places and things. That means our staff, resources and facilities,” explains Brendan Monahan, Vice Chair of the Crisis Management and Business Continuity Council for ASIS and Manager of Business Continuity and Intelligence for American Water’s Enterprise Security Department. “For FMs, it depends on the nature of the facility; you can walk away from some facilities during a disaster, but others need to be manned and can’t safely be evacuated. Consider what critical functions are required to stay in that building, which ones can be relocated and with what level of effort. For those that can’t be relocated, what are the minimum acceptable resources that would be required to keep those there? If you’ll need generator power, what are you powering and how will you supply fuel to the generator itself? You may be able to keep the lights on and power wireless connectivity and phones, but with no or partial HVAC.”
Hand-picked Article: Tips to Mitigate a Bomb Threat
Continuity planning should start with how to ensure life safety, followed by asset protection and hardening the building so that it can either resist events or be restored quickly, says Scott Newman, FAIA, Partner at architecture and urban design firm Cooper Robertson and an expert on flood protections for museums. Part of this means ensuring the building is built to withstand potential emergencies, but it also means developing the appropriate protocols so that the facilities staff “understands the nature of the protection systems built into the facility, when and how to implement them, and what the most vulnerable parts of the building are so that they can immediately focus on those after an event,” Newman explains.
These protocols should include service level agreements between the facility and occupants that explain important details like which equipment and building systems can be used while the building is running on generator power, Monahan adds. “The facility department should also be involved in planning for events that can be forecasted to a certain degree, like a storm. There are some things you can see coming and some that you can’t. If one of your tenants has a critical facility in the building, it would be helpful to join that tenant’s planning process too so you’re working in lockstep rather than at odds.”
Assess Risks and Set Priorities
When was the last time you reviewed your organization’s business continuity plan? If it’s been a while or you feel like it could be more comprehensive, start by reviewing what you already have and conduct a business impact analysis to determine which critical assets need to be protected and maintained to minimize disruption during an emergency, recommends Sean Ahrens, Security Market Group Leader for Affiliated Engineers. Determine whether there are already some continuity procedures in place, then work on updating them.
“You have to identify the biggest risks and threats to the organization and then make sure you have the appropriate plans to address those risks,” explains Tonya Coultas, Assistant Vice President for Emergency Management at Georgetown University. “From a crisis communications perspective, how can you best mitigate the impacts of an event? What does it look like for you to reconstitute the business operations of your organization while at the same time protecting your brand and maintaining the confidence of the faculty, staff, students, parents and the board of directors? Once all that’s in place, you have to have the muscle memory to know what to do, so I can’t stress training and exercising enough.”
Continuity Concepts
In addition to determining what resources you’ll need to maintain operations, your planning should also lay out how you’ll physically move those resources where they need to go, Ahrens says. Forecastable incidents like large storms require proactive thinking and multiple solutions to make sure that crucial supplies like fuel and food can get to where they need to go. Georgetown, for example, maintains a three-day supply of food at all times through its contract services provider and has enough storage space to preorder up to seven days’ worth of food for the 5,000-6,000 people living on campus if a tornado or hurricane is predicted, Coultas notes. “There are a number of buildings we’ve identified that will stay open to support the community as well, including the library, student center and athletic center, so students don’t have to be locked up in their dorms for three days,” Coultas adds.
If your organization doesn’t have the storage space to store enough essentials ahead of time, you’ll want to take a close look at delivery logistics. Ahrens suggests developing memoranda of understanding or retainers with area support services that you might need in a crisis.
“If you’re in a remote area, that might be a helicopter. If you have a generator, develop agreements with multiple organizations that could provide fuel,” Ahrens says. “What we saw as a result of the storms on the East Coast was that we had all of these resources but no one could get them to the site because of downed power poles and obstructed roads. The other important thing in these types of emergencies is that sometimes services go to the highest bidder, so if you’ve contracted for a board-up crew and a crisis happens, people will start paying big money and those companies that promised support might now be saying they won’t be there, so having redundancies is important.”
How to Structure the Plan
Because the first priority of any emergency planning process is safety, your business continuity plan should present several options for how employees can access the systems they need in situations where they can’t get to the facility.
“There’s no point in trying to drive through a storm to get to work if you can stay home and work remotely,” Monahan says. “If you can’t work remotely from home, then stay in a safe place until you can get to somewhere where you can log in. Eliminate the causes of unnecessary risk-taking.”
Next, Monahan recommends taking the risk assessment and prioritization of critical needs that you just finished and using it to develop a hierarchy of critical activities to “keep the heart of your business beating until you can get back to the blue sky day,” Monahan says. “By doing that analysis beforehand, you can adapt it when the situation arrives. It may go exactly as you planned and you do points 1, 2 and 3 in that order to meet your customers’ needs, or it may be that you have to do 3 first, then 1 and not do 2 at all. That’s why having a good plan in place that you can adapt to the circumstances is important.”
Resist the temptation to create a plan with a solution for every minor variation that could occur, Ahrens warns: “There are a number of really well-written plans out there, but they’re like 200 pages long. When there’s an actual crisis occurring, you’re not going to say, ‘Excuse me, person on the phone with a bomb threat, can you hold on a second? I need to flip to page 56 on this.’ A quick action guide is extremely important. That guide should facilitate some very easy, common responses to a wide variety of emergency situations.”
The plan should also emphasize timely and accurate communication, Ahrens says. If you don’t stay in constant contact with building occupants, employees and anyone else potentially affected by a disaster, they may take matters into their own hands, which could end with tragic consequences.
“Once when I was in New York City, I felt like the building was shaking. It was an earthquake,” Ahrens explains. “I watched in dismay as the building did not provide a timely response, so people made up their own minds and there was a self-evacuation. That’s arguably the worst thing we could do during that type of incident because then you’re under a whole bunch of glass. Tabletop exercises will help you calibrate what to do during these incidents and how to get that information to building occupants.”
10 Things That Belong in Your Plan
Nearly one in five organizations surveyed by IFMA and RLE Technologies does not have a plan for emergency preparedness and business continuity, according to a joint study by the two organizations. FM professionals have a key role to play in instituting the study’s top 10 crisis plan concepts.
- Define roles. Who is responsible for forming and executing the plan? The facility department often either fills this role or is a major contributor to it.
- Define mission-critical functions. Prioritize your organization’s most important functions so you can determine where to dedicate the most resources and what to address first in case of a failure.
- Define risks. Assess all vulnerabilities, especially to the mission-critical functions from step 2, and determine the likelihood of those vulnerabilities.
- Calculate costs. Estimate the cost of downtime and the cost of proper preparation and planning.
- Monitor conditions. Utilize your manpower and technology to catch disasters before they occur.
- Communicate. Make sure your post-emergency communications plan is resilient.
- Test. Ensure the elements of your plan are in good working order by testing them to ensure they’ll work during a real emergency.
- Practice. Whenever possible, conduct live drills and tabletop exercises. Developing muscle memory for how to respond is crucial for responding to a real emergency.
- Adapt and adjust. Don’t just write a plan and file it away in a drawer. Make regular adjustments as needed based on testing, practice and changing priorities.
- Crowdsource. Develop a network of strategic partners (including service providers and other nearby organizations) and FM colleagues that you can reach out to for advice in an emergency.
How to Measure Successful Exercises
How well can your team execute your crisis plans during tabletop or live-action exercises? Measuring key crisis management and business continuity metrics during practice is a great way to confirm that you’re ready for a real emergency and find areas that need more work, explains Ahrens. Try starting with these metrics, then add others that are specific to your organization.
- Participation: How many people were involved? Did everyone know what to do? How fast were you able to evacuate or complete the event? How long did it take people to make decisions?
- Critical functions: Was critical machinery shut down on time? How long did it take to identify all critical functions that were either at risk or compromised?
- Law enforcement and first responder communication: Were local law enforcement and first responders notified and briefed in a timely manner? Did the crisis team appoint a specific person to work with each? Were law enforcement and medical personnel informed about any health or safety risks they might encounter in your facility?
- Media response: Did the crisis team have a media liaison in place? Did they know what to say? Were scripts already developed for specific types of incidents?
Test Your Plan
The best crisis plan won’t help you during a real emergency if it’s been sitting in a drawer since it was written. Before a crisis hits, your team needs to develop the muscle memory to execute the plan by practicing it. This should happen at least once a year with a mix of tabletop exercises and live drills that will not only ensure that everyone knows what to do, but also highlight areas that need more work.
“Work those plans on a continuous improvement basis. Exercise first and don’t feel like you have to write perfect plans all the way through. Fix what you need to fix as you go,” Monahan recommends. “The old saying is ‘No plan survives first contact with the enemy.’ When things happen, the plan will inevitably fall to the wayside because you have to respond to a set of conditions that are entirely unique. But if you internalize the components of the plan, like where do I get the resources I need and how do I apply them in these conditions, that leads to a better outcome.”
The specific scenarios you’ll test should be customized to your organization’s unique risk profile. Basing some exercises on local weather phenomena is a no-brainer, but don’t neglect man-made disasters. Georgetown, for example, has several exercises planned on human-related factors like active threats and infectious outbreaks in addition to an early winter tabletop exercise just for the weather team, which monitors storms and makes decisions on closings and late openings.
“I did an executive C-suite tabletop exercise for an active shooter event in June, and I’m in the process of putting together a long-term strategy on a variety of different tabletop exercises that we’re going to test,” Coultas explains. “Right now I’m working on one that we hope to do within the next four weeks revolving around a controversial speaker, where a protest comes to campus and there’s a riot. How do we warn the community and use the technology that’s in place? We practice for cybersecurity incidents like breaches to determine how we’ll communicate with the community if the internet or cellular signals go down, and I also have the international program, so we’re looking at what happens if we have to evacuate travelers from one country to another or if we have a death or kidnapping. We really want to test our procedures here and make sure we’re as prepared as possible.”
Setting up live drills can be fairly disruptive to your organization, Ahrens notes, so aim to do at least one of them every two years and fill in the gaps with tabletop exercises every six months or so if you can. “Then you’re in a really good place to calibrate that response,” Ahrens adds. “I would do tabletops as often as possible where you just walk through a storm or other emergency and test your procedures. Business continuity planning and crisis management is like when you rode a bike – the first time, you probably fell over and had to put training wheels on. You used that for a while and then took the wheels off. Later, you’re driving a car and your significant other says, ‘Let’s ride bikes.’ You haven’t ridden one in 20 years and you’re a little wobbly, but you’re basically riding true. These exercises are training wheels so you’re conditioned and know how to respond.”
Janelle Penny ([email protected]) is Senior Editor of BUILDINGS.
This article was originally published in October 2017 and updated on March 19, 2020.
