As of May 23, there have been at least 236 mass shootings so far in 2023, according to data compiled and verified by the Gun Violence Archive. The organization joins the FBI and the Congressional Research Service in defining “mass shooting” as an incident in which four or more people are killed or injured by a firearm, not including the shooter. Mass killings are similarly defined as cases where four or more people are killed, excluding the assailant. Amid the surge in mass shootings this year, 2023 is currently on track to set a tragic record as the worst year for mass killings in recent history. Over 20 such cases had occurred by early May, setting the nation on pace for a total of 60 mass killings this year, compared to 31 in 2019, 21 in 2020, 28 in 2022 and 36 in 2022.
Unfortunately, with comprehensive gun control legislation perpetually stalled and gun violence surging, the risk does not appear to be going away any time soon. This year’s mass shooting rates are an urgent reminder of the imperative for risk management and crisis response planning.
For those who attended this year’s RISKWORLD conference in Atlanta, this message became tragically clear on May 3, when news broke of a mass shooting approximately two miles from the Georgia World Congress Center, where almost 9,000 people gathered for the RIMS annual conference and exhibition. Shortly after noon, a patient at a medical facility in the Midtown neighborhood shot four female employees, killing one and leaving three in critical condition. The shooter fled the scene, kicking off an eight-hour manhunt and a range of lockdowns and shelter-in-place advisories that shifted throughout the day as law enforcement chased dozens of leads all over town.
Thankfully, RISKWORLD never became a scene of tragedy, but in a rapidly evolving situation with a shooter on the loose, the RIMS team had to mobilize quickly to keep attendees safe and informed. Behind the scenes, staff raced to activate emergency contact plans, verify employee locations and safety, coordinate messaging and notifications for attendees and vendors, establish a shelter-in-place option in the event center’s ballroom, and even arrange for food and drinks to keep people comfortable while staying put.
Several RIMS leaders like CEO Gary LaBranche, Chief Events and Sales Officer Stuart Ruff-Lyon and Director of Communications Josh Salter spent hours in the GWCC’s command center with crisis response and local law enforcement partners, drawing upon the center’s advanced safety technology and intelligence connections to monitor the situation and navigate response.
LaBranche and Ruff-Lyon sat down with Risk Management to share an inside look at how the risk management society handled its own risk management. Their insights on the crisis also highlight several key lessons in emergency planning and crisis response for other organizations fortifying against one of today’s most critical physical risks.
Make Detailed Plans, Then Broaden Your Perspective
RIMS maintains a 60-page crisis management and response plan that encompasses a wide range of scenarios, including active shooter response. While RIMS never had to use them, the team had well-documented procedures for ancillary considerations like evacuations, identified locations for ambulance pickups from the GWCC and emergency medical help such as the use of AEDs. The organization even funded employee CPR certifications to boost the number of potential responders in an emergency.
However, according to LaBranche, the plan did not contemplate threats in the broader area and the trickle-down impacts such incidents might have. While the shooting was two miles from the convention center, four out of the 32 hotels housing attendees were close enough to the shooting to be impacted by lockdowns and street closures imposed by law enforcement. On the event’s closing day, when many people might be returning to their hotels and then leaving town, midday at a conference hotel had a different risk profile than just a day before. The shuttle buses running between the convention center and those hotels were also then either caught in the gridlock or unable to ferry people into the area safely.
“One of the first takeaways that comes to my mind is that we did not focus enough on city-based incidents versus center-based incidents,” LaBranche said. “Most of our safety, security and crisis planning focused on the convention center because that’s where 9,000 people were congregating for four days. That is why we drilled and trained on: Where are the AEDs? Where are the fire extinguishers? Where does an ambulance come? All those kinds of things. We didn’t focus as much as we should have on how an incident miles away in the city might potentially have an impact on us. We weren’t as prepared for that.”
Ruff-Lyon agreed. “Developing crisis plans and incorporating active shooter planning is imperative to any event emergency plan,” he said. “I recommend that these plans extend not just to the convention center and headquarter hotels, but to the entire city if you have a large convention like RISKWORLD. It is imperative that organizers think about the impacts that any crisis or active shooter event will have on your event, despite its distance from your venue.”
Like contemplating supply chain risks or contingent business interruption instead of standard BI, it can become an enterprise risk management exercise in connecting the dots between your operations and risks one or two steps removed. “Figuring that out took a while, in part because it was such a fluid, fast-moving scene with an armed, dangerous and mobile gunman whose whereabouts were unknown,” LaBranche said. “We were trying to get a handle on where this incident site was, and the site kept changing. And then we had to figure out how that site might relate to the 9,000 participants at RISKWORLD. Ultimately, we realized that the security perimeter touched on the areas near four of the 32 hotels. And that meant that the shuttle bus routes were impacted.”
Organizations should reassess their crisis plans to account for potential impacts of emergency scenarios in the broader community, not just on-site. Given the surge in mass shootings, every community is at risk. In turn, every organization should be contemplating the resulting threats or disruptions.
Expand Training to Build Muscle Memory
Many organizations do some form of basic training on emergency response measures or circulate instructions on response procedures. When it comes to stepping up preparedness, organizations should consider having staff actually use the tools in place to execute crisis response plans. When the chaos and pressure set in and every moment counts, there is significant value to having road-tested your tools and developed the muscle memory to be able to respond more automatically.
Indeed, LaBranche noted this was a key takeaway from the response process, and will be an area for RIMS to improve moving forward.
“We did what we were supposed to do, which is basically let people know, and make sure people are safe,” he said. “But we need more actual training on issuing the rapid response communications. While we had drilled, discussed and reviewed the plans several times, when it came time to push out the communications, the questions were ‘How do we do that?’ ‘Who does that?’ ‘And where are they?’ We knew what to do, and we had the tools at hand, but implementation was not as rapid as we would have liked. We needed better muscle memory so that we could respond more quickly during a very stressful time.”
Ensure Rapid and Widespread Communication
The RIMS team pursued a multi-channel approach to communicate with all RISKWORLD stakeholders, including: staff text message alerts, a push notification in the event’s mobile app, an email to all registered attendees and exhibitors, a message displayed on video screens throughout the GWCC, a brief address from LaBranche on the conference main stage, and a video message pushed through the app as well as the RIMS website. This approach was partially born out of comprehensive planning, but also in response to challenges that arose in the moment, such as the limited reach of each mode of communication.
“As we process the lessons learned and update our future crisis plans, one key takeaway is that we need to improve our ability to send mass, timely communications to our event participants,” Ruff-Lyon said. “For example, we emailed all event attendees and pushed out mobile app alerts, but what if the person does not have the app, turned off app notifications, or is not immediately checking email?”
Further, while many of those channels are related to tasks the organization has done before, LaBranche noted they are managed by different people, and reaching several different staff members takes time. “Those minutes add up when you’re trying to do a rapid response,” he said. “So, while we did everything that we had planned to do in our emergency plan and we did it as fast as we could, I think we could have done it faster.”
While the organization was able to send emergency notifications to staff via text, that functionality did not extend to the far broader audience of attendees. Moving forward, Ruff-Lyon said that RIMS will consider additional technology options to address everyone at once. “We will explore the adoption of mass texting and communication platforms to deliver real-time, immediate messaging to our attendees and staff should we experience an emergency of this caliber,” he said.
Create Easy-to-Use Resources
It can also be helpful to consider the options for communicating your crisis response plan more clearly. In the chaos of a crisis, people are frequently operating in a fog exactly when they most need clarity. Set them up for success. For example, while you should have extensive plans encompassing different scenarios, you may want to create shorter “cheat sheets” or one-page overviews with the most critical information.
“We have a 60-page crisis plan—nobody can really remember all that,” LaBranche said. “You’re running around the convention, so you can’t carry it with you the whole time, and even if you digitize it, you’re [scrambling to find] ‘what do I do now?’ You have seconds to act. The action plan needs to be boiled down. It has to be simple to execute the plan.”
For those just getting started, the Cybersecurity and Infrastructure Security Agency (CISA) has many resources to help at www.CISA.gov/active-shooter-preparedness, including a pocket-sized reference card with response essentials, available in both English and Spanish. If you have a sizeable share of employees who are not native English speakers, consider creating resources in additional languages to help ensure everyone can respond to a crisis as quickly and cohesively as possible.
Proactively Engage Stakeholders and Law Enforcement
The day an emergency strikes should never be the day you first meet your crisis response partners or learn the basics about their capabilities.
“In February, we had extensive meetings with all the different law enforcement people that relate to the center, including the chief and senior leaders of the GWCC’s in-house police department,” LaBranche said. “We got tours of their nerve center, which has dozens of video screens, and they explained how they utilize their 700-plus cameras across the 220-acre campus. We went through all of the drills with them, whether the threat was a weather alert warning or a protest that got out of control. We even talked about interdicting drones, or what would happen if there was a cybersecurity attack, and we took the extra step of renting walkie-talkies in case an attack took down cell service. We asked RIMS employees to get CPR certified and offered to pay for it. Because the director of public safety at the GWCC is an instructor in active shooter response, we even added an active shooter response training session.”
This level of preparation helped to refine planning for on-site emergency scenarios and ensure RIMS employees, core partners and GWCC staff were on the same page and ready to respond. It also proved to be one of the major preparation steps that made a difference when convening as a real crisis response team. “Because we had been working so intensely with them over the months, we knew them and we knew the capabilities of the center and we felt confident about what the center could do,” LaBranche said. “Then, when we walked into the response room, they were not strangers. And so we were able to quickly stand up a team that helped drive the response.”
Disseminating and engaging stakeholders in your emergency planning should also extend to other parties that may be called upon to help respond or need to be plugged into major developments. “At RIMS, we involve not just our staff and security teams, but we include our vendor partners, board of directors, and city officials in the development and disbursement of our plans,” Ruff-Lyon said. “The conversation needs to be transparent and inclusive of all key stakeholders.”
Adjust Your Risk Perception
Companies today must accept the tragic reality that active shooter scenarios are one of the top physical risks to organizations in the United States. The rate at which communities across the country are facing these tragedies has changed notably. At over 236 mass shootings in four and a half months, that means almost two incidents a day—and those are just the ones that meet the four-person minimum.
“The first thing I would advise anyone is to expect it,” LaBranche said. “I think you’ve got to start from a place of ‘it’s not a question of if, it’s when.’ And I hate to say that—it hurts me to say that—but the safest place to start is by assuming it could likely happen. That focuses the mind, I think, and really lights a fire under you to sharpen your planning.”
While these incidents are becoming so disturbingly common, we collectively cannot afford to become inured to the sense of risk—or to look away from the brutal reality behind every headline. “I want to emphasize that this kind of incident can happen in any city,” LaBranche said. “It could impact any convention, or any association or business of any size at any time. And it will. That’s the hard truth."