Managing Multiple Disasters

Season 1, Episode 4: Managing Multiple Disasters discusses ways to work through and manage more than one disaster at the same time. Join Manager of Advisory Services Kim Hirsch Senior Advisory Consultant Mark Elsenheimer for a back to the basics discussion. In this episode, you will learn about preparation, simulations, and exercise; being cautious of employee burnout; and key resource planning. Learn more about Fusion Risk Management and see how technology can help with the basics. Discover what's possible and request a demo!

Transcript

Kim Hirsch (00:00):
Welcome back to Building a More Resilient World, sponsored by Fusion Risk Management, where we discuss the basics of business continuity and risk management. Today we're going to talk about why you should plan for a difficult situation that any business continuity professional might face − multiple crisis or disaster situations happening simultaneously. Today we're talking with Mark Elsenheimer, a Senior Advisory Consultant at Fusion, and my name is Kim Hirsch, I'm the Manager of Advisory Services. Our team's comprised of subject matter experts, and most of us have been BC practitioners, so we've been in your shoes, and we know how hard this type of planning can be, especially for smaller teams. So thanks for joining us to talk about an important topic today, Mark.

Mark Elsenheimer (00:39):
Thanks for inviting me, Kim.

Kim Hirsch (00:40):
Yeah, absolutely. So let's probably start by defining the term that we're going to be discussing today. What do you mean when we say 'second disasters'?

Mark Elsenheimer (00:50):
To me, probably an example is the easiest to kind of get the idea across. Right now parts of the United States are experiencing tropical storms, other parts are experiencing wildfires. If you're a large enough company that you have locations in both of those parts of the country, you could very well be experiencing multiple secondary disasters. It's also possible, in my past we've had something like it was hurricane season − there either was or was not an active storm, but then all of a sudden there's a transit strike. Actually in one case, a train accident where all of a sudden, something very sudden will come up along with something that may be going on for a period of time. And then, of course, there's always the chance of a cyber incident happening simultaneous to a natural disaster or something like that. So lots of different potential situations that might require a different level of your involvement, but just the fact that you're not just focused on one event, I think, is really what we're going to talk about today.

Kim Hirsch (01:44):
Yeah, and I would guess that if you have a longer term event that's happening, like you said, like maybe a hurricane where it's coming at you for a week, and then it's with you, and then post-event. The longer those events are, the more likely it is that you might also face a secondary event at the same time.

Mark Elsenheimer (01:59):
Yep, something else is going to happen along the way. COVID-19 didn't care that hurricane season is going to come and go, or that an earthquake is going to happen, or that a, oh, water pipe will break, or, you know, any of those things that we used to plan for will happen along with the pandemic that we're currently experiencing.

Kim Hirsch (02:15):
So tell me about what are some of the actions or plans or best practices that you've seen be successful for this type of planning?

Mark Elsenheimer (02:23):
As you test, think that this is a possibility. I've been both a practitioner and a consultant in my professional life, so as I was preparing clients for exercises, we actually had started down a path. The team that was being exercised thought it was going one direction, and then we gave them the next piece, and suddenly they realized, 'Oh, this wasn't cyber, this was an earthquake'. So they actually kind of put themselves into that situation where they even read beyond the script. I guess, really planning for it and thinking of the possibility. I think we'll probably get into it as we continue the conversation, but just look beyond your immediate team and think, who else could support us if we needed to pull them in? Maybe you as a professional would run the call, keep the dialogue going, stay on task for, you know, the critical elements, people, facilities, confidential documents, data protection, those types of things, but maybe there's someone else who could be taking notes or be responsible for following up. If your organization has a project management office, maybe enlist those people to keep the follow-ups on track, but you'll be the subject matter expert running the calls or the situation updates. Defining where possible − defined forms in advance to kind of keep the details of particularly those ongoing things like hurricane, where do we stand with this? What offices are threatened? Things we can see coming so that when the earthquake happens or the water pipe breaks, you can start to lay those across each other and say, 'Okay, so we may have a storm approaching this one, but we've also got this water problem that we have to deal with and coordinate with all the building managers, landlords, all those types of things'. So as part of your planning, think about it during exercising as your program matures. And also if you can define key elements that you attract for any type of an incident or disruption, as much as you can, put it on a form or even mentally have a rundown of the things you're most concerned about. I always say the best reason to gather data is that someone else wants you to report on it. So if your executives, for example, need a briefing, what are the key things they're always interested in? Make sure you capture that for any incident when it happens.

Kim Hirsch (04:22):
The theme behind what you were just talking about is to do some of these things in advance. So as you said, have some forms, the way that you're going to take notes already preestablished. But I think the thing that I'd like to also emphasize out of that is that it's important to have those people that don't have the day job of working in business continuity alongside of you, also pre-identified and trained, so you could just point to anybody walking by your cube and say, 'I need you to help me take notes'. But there's some people who are really good at taking notes and can really understand the type of notes that you need for crisis situations, and you should actually identify those people and do some specific training with them before, right?

Mark Elsenheimer (04:59):
Yeah, absolutely. And I would say, as you identify those people and have a sense in your office who you might be interested in having in a role like that, bring them to an exercise, and actually have them take notes during the exercise so that everyone else is comfortable with them. They can stop and say, no, wait, what was that? And how does that work? Or does that relate to this plan or this other thing that I've seen? Make them a part, even if you think it's an outside chance, at least have them be an observer in an exercise, if not actually do the role that you think that you might use them for in an actual incident. Again, pre-planning: who are the people? What are the resources? When might I use them? Are there forms or things that they would be using so that they can get comfortable with that? Would it be electronic? Do you expect it to be paper? Is it a PDF? Is it a Word? You know, those types of things. Work out those details because those can really trip you up.

Kim Hirsch (05:47):
One of the other things to do is to consider the skillset in a crisis for people. So you have a lot of people who in a normal situation can take on a task, like, could you write me a memo that says this, or could you take notes that do this? But during a crisis, people's emotions get elevated. Sometimes they're a little bit scared by what's going on or it's just a very high adrenaline kind of environment. And you kind of need to pre-identify people who perform well under that kind of stress as opposed to people that don't.

Mark Elsenheimer (06:16):
Very true. I mean, I can think of examples. I happened to have been out in New York on 9/11, and title isn't necessarily the best determinant of people who keep a cool head during an incident. It was actually someone I know from, through my church actually at the time, who everyone in the office naturally looked to to say, what should we be doing? And whatever the bosses, the people with the titles were doing, actually, those were some of the people looking to her to say, what's the best thing for us to do right now? There are just people who, you know, as they've been with the organization a long time, they've been through some incidents, they're experienced − just people will sort of gravitate toward them for that initial incident type of response, or the emergency response as we sometimes call it. Or another example I had is, actually it was 9/11, same time, but within my own company is a, and we'll touch on it, some about giving people breaks and things is where I was going to go with this, but really it goes to that skillset. It was the command center for a recovery vendor that I was in, and we were on, I want to say it was roughly 12 − actually it was probably about a 14 hour day, and then the whole thing kind of shut down for 10 hours, and then everyone was back early. There were a couple of people who were in key roles but just were the kind of people who wanted to see it all the way through. And it's like, I've started this, I know all the details, I will see this through. We got to the point after a few days where it was clear: we were getting a little short with each other within the command center. But when it really came down to it, when I really needed that person's skills most was going to be in a couple of days when our recovery center filled up with customers − when our clients were in our building, recovering, that's what I needed − those people to be the sharpest, and they were in the process of burning themselves out before we even got to that point where I needed them most. So identify the skills and make sure that those people are ready when you need them most. Sometimes in an IT situation, you'll have systems people, you'll have database people, you'll have application people − potentially those are three waves of people that will help your support and recovery. You want to make sure that the database people are staying fresh until you need them, and you may need them at three in the morning. So the sooner you can have a handle on the timing of when you're going to need those key resources to help them plan. It's like, you need to go home by noon today because we're going to need to call you tonight to start validating. And that could be facilities people, that could be database people, that could be any of the skills. But if you understand who's on your team, who the resources are that are available at a rough timeline as the situation unfolds. And particularly, as we're talking here today, multiple things could be happening when y'all need those people so that they're rested and able to help when you need them.

Kim Hirsch (08:49):

And I think the key takeaway there is in a crisis situation, people will keep on going until they burn themselves out, and then they're not very useful to you, so you as a leader have to be the one to say, no, you are taking a break, and then follow through and make sure that that happens.

Mark Elsenheimer (09:04):
Yeah, we had one person in particular at that command center that just didn't want to leave his desk. And it's like, no, we threatened to call in the security people that we had and remove him. But it's like telling someone to leave and go home and unplug for a while. It's not as easy as people leaving because, as you said, it's adrenaline driven, and they want to take ownership. But I know all the details of this, I know what needs to happen. It's like, yes, I need you doing that now, but I really am going to need you in two days when this building is full of other people, and I don't need you to have a short fuse. And similarly with IT help desk people − it's like, if you're the best person to do end user support, and you've been working 20 hours a day for three days to get a system ready, when those end users come back online, they aren't going to know that you've invested 60 hours into it in the last two days. Take the break, set up a schedule, and follow it.

Kim Hirsch (09:50):
And these days when you send them home, you have to make sure they stay offline once they get there because I would leave the office and then come home and turn on the computer and start working again because it's really hard to get your mind out of it once you're working on a crisis.

Mark Elsenheimer (10:02):
It is, and, you know, short of confiscating their phone, but even just watching the news, you know, you'll stay amped up. You know, it's like you need to find a way, and in a larger organization we've talked, you know, if you may be part of a smaller company, so you don't have this, I'll say luxury, but in a large corporation to really have teams on a schedule, if it's three eight-hour shifts, two 12-hour shifts, whatever it may be, and have people know there's a good clean turnover process. Everything that I was working on, here it is. And again, maybe a format or some sort of a planned way to do a turnover from shift to shift so that the overnight shift will continue to make progress or at least monitor the things that the day shift was working on so that the day shift people can go home and disconnect from it and say, it's all right, I know it's being handled by the command center.

Kim Hirsch (10:45):
Yeah, that's all awesome. So do you have any final thoughts to share? So you think about maybe what are the most important one or two things that anybody could do no matter what their team size to be more prepared while you're developing the larger multi-crisis response? It's a little more detailed as we've talked about.

Mark Elsenheimer (11:02):
Yeah, it all comes back to planning at some level. One of the aspects of having a plan and being prepared aren't necessarily the same things − if you've been through some incidents, you're probably aware of that. I believe it's a quote from the Art of War that I will butcher it, but roughly, any plan is great until your first encounter with the enemy. In this case, the enemy would be that one or multiple incidents. It's important to have a documented plan so that you know what the parts are that need to be coordinated, but also knowing your other resources. Either they would be available because of the disruption or they can be called upon because of their experience or expertise. Being aware of the resources probably would be one of the most important things, and practice as much as you can. And the more realistic your practices can get, the more it will help you when something actually happened. Hours of preparation may go into the first 20 minutes of a response, but it will save you days of mopping it up later, if you do it well. Um, and that really comes through practice in my experience.

Kim Hirsch (11:59):
Well that's great, Mark. Thank you for sharing all your expertise with us today. I think that people have had an opportunity really to think about no matter what size their team, what they can do before a crisis hits to make sure that they're ready to go when one or more come across their radar.

Mark Elsenheimer (12:14):
Yeah, thank you, hopefully it was helpful.

Kim Hirsch (12:16):
Absolutely. So we want to thank everybody for joining us again today. This has been Building a More Resilient World sponsored by Fusion Risk Management, and we'll look forward to speaking with everybody again soon.