“With every mistake, we must surely be learning.” ~ George Harrison (While My Guitar Gently Weeps)
The 2017 Atlantic hurricane season is becoming one of the most active seasons on record, thanks to a stretch of long-lived, destructive hurricanes over the past five weeks. It was the first time in history that we had two simultaneous Category 5 hurricanes in the Atlantic Basin. 2017 was also the first time that two Category 4 storms hit the Continental US in the same season. We also had three concurrent hurricanes churning (on two different occasions). Harvey and Irma were devastating storms. Harvey and Jose had longer than usual life spans. As I write this, hurricane Maria is taking direct aim at Puerto Rico.
I heard three very interesting quotes on the news after hurricane Irma ripped through the Caribbean and Florida.
“I wasn’t prepared for this.”
“We lost everything.”
“There is NO WAY we could have been prepared for this.”
These quotes outline a very common problem: Limited preparation. I don’t think that companies are necessarily ‘unprepared’ as much as they are “under prepared”. And in a way, that can be worse – because it produces a false sense of security.
I don’t mean to sound calloused or insensitive to their plight. I recognize that there are several reasons why companies aren’t fully prepared for a natural disaster. They could have staff limitations, a lack of internal expertise, budget constraints, poor decision making or simply a lack of planning. But I want to callout one particular reason for some organizations’ lack of preparation: Complacency.
It’s easy to get complacent. It happens in our relationships, our diet and exercise routine and other areas of our day to day life. When an aspect of our life becomes routine, we can become complacent. But why become complacent about preparing for a major natural disaster, particularly when there is so much on the line? I think there are two main reasons.
- Preparation has become routine. I have some friends who work for a company in the Caribbean. They survived Hurricane Ivan in 2004. Since then, their company’s facilities and infrastructure have undergone major upgrades. They have a hurricane readiness manual and they run hurricane drills every year. It’s been 13 years since the last major hurricane and, as devastating as Ivan was, they tend to forget that ‘the next big storm’ could be just around the corner. The truth is, this company got pretty good at preparing for hurricane season. But somewhere along the line, instead of continuing their diligent preparation, it all became so routine that they got complacent. Gaps in the plan went unaddressed and became action items year after year. They started taking shortcuts in their exercises, instead of executing the major steps that they would take when their island was under a hurricane watch, they started doing theoretical drills. As their infrastructure grew, questions started to come up about their ability to prepare quickly enough, and whether they have enough space to store everything. They are beginning to realize that there are resource constraints due to their expansion. They’ve started making assumptions, and, as a result, they have increased their risk and decreased their preparedness. In this particular case, I believe they KNOW what to do, but I have questions about whether or not they will still be able to do everything in time.
- They have limited imagination as to what could go wrong. After the big storms that we just experienced, some people seemed genuinely surprised that the hurricane destroyed their homes and businesses. The wind was blowing over 130 miles per hour by the time Irma hit Florida. The storm dropped between eight and 16 inches of rain in some spots. But they said, ‘there is no way we could have prepared for this’ like it was the first time they’d ever seen a hurricane, even though hurricane Andrew brought 145 mph winds and eight inches of rain in 1992. If you live in an area prone to hurricanes, floods, tornadoes or other natural disasters – you must prepare for the worst-case scenario – total destruction. Gaps occur when reality exceeds the planning team’s imagination. What if a cruise ship only provided life jackets to children because they couldn’t imagine adults not being able to swim? As ridiculous as that is, it’s what we do if we fail to plan for the worst. That means getting the necessary insurance, lining up alternate work space, developing disaster recovery solutions, completing your business continuity and crisis management planning. The problem isn’t that we CAN’T prepare, it’s that we DON’T prepare well enough.
So, What’s the Solution?
I’ll admit that the struggle is real. I’ll concede that planning for the worst is difficult. It’s an expensive, uphill battle as you try to convince those around you of the necessity of being thorough and diligent. Here are a couple of thoughts on how to approach the problem.
- Use a risk based model. The decision to develop and implement a solid crisis management plan must not be emotionally driven. If you decide to implement a solution because you were scared by a storm, you are not as likely to complete your task as you are if you’ve analyzed the situation and made a solid business decision to move forward. If you do business in an area that is prone to hurricanes – evaluate your risk based on probability and impact. Then, treat the associated risks accordingly: Eliminate the risks that you can. Mitigate those that you must. Accept those that you can live with. Build your plans around this approach. Develop specific checklists associated with various stages of a hurricane, including how to respond to a direct hit.
- Stay diligent. Exercise the plans annually prior to hurricane season. Don’t cut corners. Exercise the plan just as you would if it was a real storm. Revisit the risk analysis every couple of years and update your strategies (and plans) accordingly.
Learn from your mistakes and the mistakes of others. Don’t limit your imagination. Don’t fall into the trap of complacency. There is simply too much at stake.
Senior crisis management and business continuity consultant with cybersecurity response and crisis communications experience in a leadership role, spanning twenty years.
Proven track record in developing and implementing crisis management, business continuity and cybersecurity response protocols, and establishing mature business continuity programs and effective governance models.
Quick to build relationships and achieve results working collaboratively with business leaders and executives.
Extensive experience in the development and execution of tabletop and operational exercises with a focus on measurable results that lead to overall improvement of plans and programs.
Feel free to contact Mark to see how he can help your organization be well prepared: [email protected] or on Twitter @mhoffman_cbcp