Continuity of Operations in the context of business gets on the Board
of Directors agenda after every tragedy. Whenever the magnitude of the
business disruption involves loss of life, or major property damage the
executive management goes into "Crisis Management" mode. Unfortunately
for many, this may be the only time the Board and corporate executives
have tested or exercised for such an incident.
So what is
Continuity of Operations? What does it mean to your business? How
pervasive does this Operational Risk strategy have to be? Let's think
about a simple process from the time a sales person picks up the phone
to schedule an appointment to the time the product or service team has
delivered or installed the items that have been sold to the customer.
In
the context of university higher education, the process of recruiting,
admissions, housing, fund-raising, sports and alumni relations. How many
touch points, steps in the process or procedures for manufacturing,
integration, sourcing, learning and implementation exist? Now think
about your supply chain that provides the necessary resources, energy,
infrastructure and people to make it all happen. Does this business
issue seem like a trivial matter?
The aftermath of any major
incident will require a thorough investigation to determine what
happened. Everyone will have their version of what they saw, heard, felt
and remember about it. Then the finger pointing, litigation and media
frenzy begins. Only then do the Board of Directors and Executive
Management wish they had practiced and exercised for the eventual day
that has now landed on their front door step.
Such an example is
in the news again, more than two years after the tragic day in April
2007 on the campus of Virginia Tech University in Blacksburg, Virginia.
In Lucinda Roy's latest book, "No Right To Remain Silent", her opinions magnify the need for effective continuity of operations planning, exercises, auditing and testing:
After tragedies like this, people clam up. They are warned that it is too dangerous to talk about the specifics of a case when lawyers are chomping at the bit, when the media is lying in wait like a lynch mob. But people also remain silent when they are worried that what they have to say could injure them somehow.
In the days and weeks that
followed the tragedy at Virginia Tech I was reminded of how much silence
has to say to us if we listen with care.
Sadly, the tragedy at
Virginia Tech did not usher in an era of openness on the part of the
administration. Questions that related to the specifics of the
shootings, to Cho, or to troubled students in general were viewed in the
wake of the tragedy as verbal grenades.
Many of you may remember
where you were when you heard the news. Just like you will always
remember where you were on the morning of September 11, 2001. Yet April
16, 2007 could very well be more significant as the analysis and the
investigation continues.
Sadly, we know how this story turned out:
On April 16, 2007, Seung-Hui Cho shot two people to death in a Virginia
Tech dormitory, then chained the doors to a classroom building shut and
methodically killed 30 more before committing suicide. It was the worst school shooting in American history.
Who
knew what when? The litigation is ongoing and some still are seeking
the truth. Proving the truth will require substantial analysis of tens
of thousands of documents, e-mail messages, hand written notes,
depositions, medical records and school work. Yet when it gets boiled
down to the facts and the issues, "Continuity of Operations" protocols,
practice and preparedness will be at the core of the matter.
Does
your organization have facilities where an all hazards approach is
talked about and is continuously aware of the threats to life and
property along with the economic implications of any business
disruption? If you have people and property in California the answer is
yes. Earthquakes, brush fires and now even the lack of government
resources are existing risk factors.
If you have people and
property in or near symbolic locations such as New York City's Wall
Street, Washington, DC's Capitol, or the St. Louis Arch then your
organization should have heightened situational awareness and crisis
management mechanisms already in place. The whole State of Florida,
North & South Carolina, Louisiana, Texas and others who know the
aftermath of Hurricane Katrina/Harvey are sensitized to the requirements
for effective preparedness.
So what is the difference in an
event such as the "Active Shooter" scenario on your campus or the
catastrophe sent by "Mother Nature"?
The answer is the accuracy
in predicting the event itself. All the preparedness for either event
starts with the mind set that it will happen.
Only one can be prevented, preempted or neutralized before it can cause harm...
