In today's competitive environment, it is easy to get wrapped up in the daily details of running a business. While this mind-set helps get the job done, it can be overdone, particularly when it leads to tunnel vision. As recent disasters have vividly demonstrated, the choice between focusing on daily operations and planning for future disasters is no choice at all -- planning is essential to the survival of the enterprise.
The nature of some disasters makes planning easier. Such is the case with hurricanes, which are seasonal and can be tracked from inception. Most disasters, however, strike without warning. For example, who other than an implicated few woke up on a seemingly average September morning in 2001 imagining that day would change the world? Nevertheless, many companies lost personnel, property and data because their assets were concentrated in one place. In the aftermath, the country mobilized, meetings were held and emergency response plans were devised. But then, slowly over time, many organizations became caught up once more in daily activities. The lessons of 9/11 were forgotten.
One of the best examples of this collective amnesia can be found in the federal government itself. Certainly it does not take much imagination to realize that Washington is a significant target. Still, approximately 15% of all federal employees are concentrated in the city (even more if you include its suburbs). More importantly, most federal agencies have their headquarters there, including the Department of Homeland Security and the Federal Emergency Management Agency (FEMA).
While FEMA would undoubtedly counter that contingency plans exist in the event Washington is eliminated, if FEMA's headquarters was destroyed it could significantly cripple the organization. So why do the federal employees of FEMA need to be in Washington at all?
Standard definitions suggest that there are four phases of emergency management and learning these is critical for any business, no matter whether its located in New York, Washington or a tiny town in the Midwest. The first is mitigation, an attempt to eliminate or reduce the opportunity of a loss before it can occur. The second phase is preparation, planning for a loss inorder to reduce its severity. The third phase is response, the immediate reaction during and just after a loss. The final phase is recovery, which happens after the loss occurs.
As those in the Homestead, Florida area, where Hurricane Andrew hit in 1992, can attest, some recoveries can go on for years. And some never happen at all -- a 2002 study from insurer The Hartford found that nearly one-third of businesses significantly affected by a major natural disaster never open their doors again.
Underlying the definition of mitigation is the concept of risk analysis. Specifically, which type of disaster is one preparing for? Traditionally, the emergency management community categorizes disasters as one of three types: natural (such as hurricanes or earthquakes), man-made (such as a natural gas explosion like the one in Allentown, Pennsylvania in February or the Gulf oil spill last year) or malicious attacks, (like 9/11 or the Oklahoma City bombing).
Given the recent economic problems and the increasing interconnectivity between traditional property/casualty risk management and financial risk management, it is probably appropriate to also add financial disasters to that list. As companies struggle with economic concerns and international conglomerates close up shop or are swallowed up by competitors, the risks posed by international finance should not be ignored by traditional property/casualty risk managers.
For instance, the ongoing revolutions in the Middle East have pushed U.S. gasoline prices to more than $4 per gallon in some places. Some experts even expect further increases. Once upon a time, political strife in Egypt would have had little to do with the business of a mover in Kansas City or a trucking firm in Omaha, but in today's international climate, everyone is connected.
Although there is no way to know what the future will bring, historical precedent usually provides enough information to make natural disasters the easiest to predict. Obviously this is not always true, as a disaster like the earthquake and tsunami in Japan demonstrates. While these types of anomalies will occur, and earthquakes will likely never be predictable, there are patterns to natural disasters that can aid preparedness.
Currently, the Midwest is bracing for the threat of tornados. Companies in the Gulf States are having meetings to get ready for hurricane season. In California, officials must plan for either rain and mudslides or drought and wildfires this summer. No one can be certain that any of these catastrophes will occur. Natural disasters hit sporadically and often spare at-risk areas for long periods of time. But the fact remains that these perennial risks are the easiest for which to prepare.
Patterns become more difficult to recognize for man-made disasters, but careful analysis can offer some clues. For example, because of the natural gas explosions in Allentown a few months ago and in San Bruno, California, last year, much has been made about the aging infrastructure in the United States. Will the health of federal and state budgets allow for infrastructure improvements or will the problem become worse? More importantly, what does this mean to your business in terms of future risks?
Similar analysis can apply to potential chemical spills. Are there any chemical plants near your location? What about major highways and interstates where dangerous chemicals are transported? This information is fairly easy to obtain. Local emergency planning committees, which are federally mandated by the Superfund Amendments and Reauthorization Act of 1986 have done research into what the local hazards are, even in remote, rural counties. Companies can contact their state emergency management office, which might have different names in different states, through the governor's office for specific information on the local area.
Probably the most difficult disaster to predict is a malicious attack. But it is not impossible. Geography can play a part in the risk, for example, as the residents of New York can attest. (Although this method is not absolute, as the relative randomness of the Oklahoma City bombing in 1994 demonstrated.) Another factor to consider is the type of organization. A manufacturer of computer chips for weapons guidance systems would obviously be at a much greater risk than a manufacturer of patio furniture.
It is also imperative that companies not forget financial risks. Derivatives, credit default swaps and the subprime market are all terms that most would have been blissfully ignorant of five years ago. Today, these terms are commonplace, and the abuse of these complicated financial instruments can threaten a company's survival just as much as -- if not more so than -- any other type of disaster.
Unfortunately, all of these risks are so disparate that it has become increasingly difficult for any one person or department to handle them all. As a result, the effort an organization undertakes to bring true enterprise risk management under one umbrella, especially as it pertains to emergency management, is compromised. More interdisciplinary collaboration and education is needed.
Thankfully, guidance is available. For example, FEMA provides extensive resources that anyone with a little training in emergency management can use to perform a realistic risk analysis based upon historical trends. FEMA also offers free, online training courses that are available to anyone. These are the same types of courses FEMA provides to government workers responsible for emergency management, as well as police, firefighters, the military and students. Additionally, college courses, certificates and degree programs in emergency management now exist in essentially every state and are available online.
Although all teach "emergency management," some have more of a public entity flavor while others stress public health, fire science, criminal justice or public administration. Regardless of whether one is seeking a basic class or a doctorate in the field, opportunities for emergency management education abound for those who wish to increase their skill set in a particular area of the discipline.
The more complex a firm becomes, the more risk the firm faces. Even a simple sole proprietorship operating a company in rural South Dakota can be negatively affected by political and social unrest in Egypt. Our world has become that inter-related and that complex. It is no longer enough to manufacture the best widgets in the world, because the risks of the world can put the company out of business regardless of the quality of the product. For enterprisewide risk management to truly be "enterprisewide," it must be proactive in addressing all risks threatening the company, whether they are natural, man-made, malicious or financial.