In August, a disgruntled former employee from a southwestern Virginia news channel shot and killed two of his former coworkers and wounded their interview subject while they reported live on television. On the first day of October, a student at Oregon’s Umpqua Community College killed nine people and injured another nine before turning one of his 14 guns on himself.
While these cases made headlines—and rightfully so—there were eight other mass shootings in the United States the week of the Oregon shooting alone, according to Mass Shooting Tracker, a crowd-sourced database that catalogs news reports of incidents where four or more people were shot in one event. By those measures, the Virginia shooting would not even be counted.
Researchers from the Harvard School of Public Health and Northeastern University found that the rate of mass shootings has tripled since 2011. According to a study released last year by the Federal Bureau of Investigation, active shooter incidents, where police arrive to a shooting in progress, are also on the rise. The FBI found that 160 of these incidents had taken place in the United States between 2000 and 2013, 70% of which occurred in either a business or educational environment. An average of 11.4 incidents occurred annually, with an average of 6.4 in the first seven years studied, and 16.4 in the last seven years.
“Somehow, this has become routine,” President Obama said at his press conference after the Oregon shooting. “We’ve become numb to this.”
Based on the numbers alone, risk managers clearly cannot afford to become so inured to these incidents. Rather, much like they do for other forms of crisis, from fires to tornadoes, they need to be acting now to train employees, develop emergency plans, and ensure business continuity provisions are in place.
The Value of TrainingBusinesses universally could do better at preparing for active shooter situations, according to Lance Ewing, industry practice group leader for hospitality, leisure and real estate at AIG. Every industry could be impacted by such crises, but those open 24 hours a day, 365 days a year are at greater risk and should ensure there are increased training provisions to match. Smaller businesses are also farther behind in preparing because many struggle to justify the expense of more elaborate efforts for a relatively unlikely threat.
“I think most risk managers need to look at benchmarking information related to workplace shootings,” Ewing said. “Historically, the statistics show real estate, such as shopping centers and malls, and educational facilities, such as universities and schools, tend to have more of these incidents, so they have to step up their training and do so more often.”
Determining the best ways to train employees for such dynamic crises can seem a challenging and costly proposition. Full drills can be expensive and time consuming, as they often require creating a detailed scenario, bringing in law enforcement, and roleplaying an entire incident. Yet less thorough training may not be enough. “The time and expense of doing live exercises is quite onerous, but they’re really valuable because they put people in positions where they’re actually feeling the stress of having to react or physically do something or make a decision,” said William Malone, director of global risk services at McManis & Monsalve Associates and a 26-year veteran of the Royal Canadian Mounted Police.
Developing an effective plan cannot be done in a vacuum—like any other emergency scenario, an active shooter in the workplace presents an unpredictable situation that requires a mix of thoughtful planning, well-communicated procedures, and repeated practice.
“In most cases, it’s not a program, it’s a process, and that process has to be on-going,” Ewing said.
He recommends that full drills be conducted at least annually, perhaps up to quarterly in some industries, and other tools used to supplement and reinforce these lessons. Tabletop exercises, educational videos, and simple routine reminders about safe places to shelter in an emergency or whom to notify if employees see any strange people or activities all help raise employees’ awareness of their surroundings and better prepare.
The real value of going through any scenario, he said, is the exercise in asking “what if?” Doing so throughout the planning process as well can point out simple measures to mitigate risk. It is easy to ensure there is a system in place for alerting employees, for example, or to identify a safer space in the workplace that can be fortified, such as a lockable rear office. Emergency planning provisions can be incorporated into other staff emergency training or onboarding. Teaching employees about when and how to run, hide and shelter in place, or fight if necessary can be done through brief education sessions.
For less at-risk entities, Malone said the resources involved may mean that full-scale exercises are only feasible once every so often, so it is important to conduct tabletop exercises in smaller groups to build skills and refine the emergency plan in the interim. Organizations can also pool their resources to boost collective readiness, which is especially important in areas with high populations or a large number of facilities. “Because it is somewhat costly, there are opportunities for, say, college campuses or hospitals to collaborate. They can then pick a central site and engage stakeholders from all parties to participate, and there is always room for extra observers,” he said.
In a recent drill Malone helped coordinate, he found that opening lines of communication was one of the most valuable functions of a full-fledged drill. Establishing and strengthening contacts with local and state authorities, for example, helped participants better understand what to expect in an emergency—namely, that first responders are not there to offer them help, but to eliminate the threat first. As a result, employees must be trained not to interfere. Further, getting responders more familiar with the layout and unique challenges of the facilities helps ensure they can respond to any threat more quickly and effectively. Malone recommends that all businesses make an effort to do this, providing law enforcement with detailed information like floor plans even if no drill is planned.
A discussion session after Malone’s drill helped highlight weaknesses in current training and gaps in any existing plans. “Across industries, I see a lack of planning, but there is also a failure to follow procedures that are in place,” he said. “In our recent exercise, we saw that there were emergency procedures and protocols, but some people did not know about them and some people who did know did not use them. It’s critical to find out why there are such gaps and how to address them to ensure a consistent approach.”
He favors active training, whether in the form of drills, tabletop exercises, or education sessions. People who are well trained will always default to their training. “It’s not to make people paranoid or induce fear, it’s just to make them aware of their surroundings in order to keep themselves safe,” he explained.
Ewing agreed that any preparation is helpful in getting safer. “Any time you do a tabletop, whether it’s for a hurricane or an active shooter, the value is in awareness and the thought process required, and from that, you actually build a plan,” he said. Even if it is just showing employees a video, he added, “there’s value because these measures all get people thinking out of their normal comfort zone, and you are definitely going to be out of your comfort zone when you have an active shooter.”
Business Continuity Concerns
In conducting drills or helping companies refine their crisis plans, Malone routinely sees a key component missing: business continuity planning.
“A lot of active shooter exercises only deal with the situation up to the point that the shooter is apprehended, not the continuity of operations plan afterwards,” Malone said. “We all know that’s when the real work begins. You have people who have been injured or even killed, all of the other folks who have been traumatized by this event, loss of workspace and, potentially, damage to equipment, property and facilities.”
Insurance can help mitigate some of these damages. Several carriers offer products like crisis response policies, which can cover bringing in outside PR firms to handle the media, medical costs, funeral expenses for the victims, and transportation for the family members of those injured or killed. Better use of these services can fulfill moral obligations to employees after a time of crisis, and also help control costs from any potential litigation down the road, Ewing advised.
“You need to be careful on the litigation side of things, because everything you’re going to do will be discoverable,” he said. “But my view is that everything you don’t do is just as discoverable.” The steps of a robust plan are like stacking building blocks, he added, and the higher that stack goes, the safer employees and the company will all be.
“Like they say, people don’t plan to fail, they fail to plan,” Malone said. “I think there are lots of businesses out there that may be aware of this risk, but in terms of what contingencies or plan they have in place, you’d be hard pressed to find one.”