Mistakes Businesses Make in a Disaster
When the unexpected happens to a business a delayed action – or the wrong action – can cause as much harm as the initial incident itself.
That’s the message of John Bresland, former board member and chairman of the U.S. Chemical Safety and Hazard Investigation Board, who will be a keynote presenter at the 2016 World Conference on Disaster Management, to be held June 7-8 at The International Centre in Toronto.
“The last thing you want to do is be taken by surprise,” said Bresland, who now consults large organizations on chemical process safety. “There are practical steps every business should take to effectively learn, communicate and plan for future disasters to which the organization may be vulnerable.”
According to the UK-based Business Continuity Institute Global Top 10 Threats list, cyberattacks remain the number one risk facing organizations today, followed closely by data breach and unplanned IT outages. Businesses are also deeply concerned about threats to physical security, with acts of terrorism jumping from tenth to fourth spot on the list and security incidents moving up from sixth to fifth.
“Regardless of the size or nature of the incident, ramifications will be huge when businesses fail to prepare,” Bresland said. After painstakingly analyzing its investigations of industrial fires and explosions since 1998, the Chemical Safety Board found most accidents could have been prevented and errors in response avoided.
He cited the following as the five top mistakes businesses make when preparing to respond to, mitigate and move forward from disaster:
1. Failing to define worst-case scenario. What might be considered a relatively small incident can quickly become a very expensive one if a company fails to look beyond the immediate safety issues and consider business impact. For example, even a small event like a fire can lead to significant loss of production and profits long after the fire is extinguished. “Ask yourself: what is the worst possible scenario and prepare for that,” advised Bresland, pointing to the 2010 BP Gulf of Mexico oil spill where losses have mounted well into the billions of dollars. “I don’t think there are many companies in the world that could afford the amount BP has had to spend on response to the oil spill.”
2. Lacking understanding of risk. A company that fails to fully understand the risks associated with its operation, and fails to take the necessary steps to mitigate them will find itself caught in the crossfire. Bresland cited the example of a small, family-owned fertilizer business in Texas that was forced to declare bankruptcy following a tragic explosion that killed 12 firefighters and three members of the public, an event he said could have been avoided altogether. “As part of their operation, they were storing and using ammonium nitrate, a material that can explode under the right circumstances,” he explained. “They should have been aware of those hazards and ensured proper procedures were in place to appropriately guard against them.”
3. Neglecting to build community ties. When disaster strikes, it’s crucial to have good relationships with “people on the outside,” Bresland said. For chemical companies, outreach is often in the form of community advisory panels made up of first responders, community representatives, local authorities and health officials who meet regularly with facility management to discuss important issues. For other companies, it may be Information Sharing and Analysis Centers (ISACs) to help combat cyber security threats and problem solve in the event of an attack. For example following data breaches at large retailers such as Target and Walmart where millions of personal records were stolen, the retail industry took steps to create its own ISAC to ensure information sharing between retailers, law enforcement and other relevant stakeholders moving forward.
4. Overlooking response requirements. Never underestimate the time and resources required to get your operation back up and running following an incident. Businesses often fail to take into account the loss of productivity that will ensue when employees who are usually involved in productive work will be pulled away to deal with insurance claims, regulatory agencies and possible investigations by outside groups. “The bottom line is a single incident can suck the oxygen out of your company for a long time afterward,” Bresland said. “You’re going to need to rebuild your business and your reputation so it’s important to build the resources for that into your contingency plan.”
5. Being ill-prepared to deal with media. In order to respond effectively to media questions and a possible backlash arising from an incident, senior executives need to be well rehearsed. Outside consultants trained in crisis management often work with organizations to ensure managers are equipped to deal with the pressure. You don’t have to look far for examples of what not to do, Bresland said, pointing to the 2014 water crisis in West Virginia as an example. At a press conference to address his company’s role in the chemical spill that disrupted water service in nine counties, Freedom Industries’ then president announced he was done answering questions and promptly left while taking sips from a water bottle. “It was the middle of a disaster and he was unable to face the tough questions,” Bresland said.
Bresland will share some of these, and other, insights in his keynote address entitled Is your company and your community prepared for an unanticipated incident? at WCDM on June 8 at 8:45 am.
For more information or to register for the event, visit www.wcdm.org