Embracing disaster with contingency planning
Risk Management; New York; May 2001; Yuko Mitome; Karen D Speer;

Volume: 

48

Issue: 

5

Start Page: 

18-20+

ISSN: 

00355593

Subject Terms: 

Contingency planning
Guidelines
Advantages
Loss control
Books
Catastrophes

Classification Codes: 

9190: United States
2310: Planning
9150: Guidelines
3300: Risk management

Geographic Names: 

United States
US

Abstract:
Control in a crisis is an elusive, but vital, quality. Without it, a business is left to the mercy of the catastrophe - in whatever shape it arrives. But with an effective contingency plan in place, the job can be made a lot easier. Contingency plans are alternative plans that can be put into effect if certain key events do not occur as expected, as defined by Dr. Fred David in his book, Concepts of Strategic Management. Or, as Lester Digman explains in Strategic Management: Concepts, Processes, Decisions, contingency plans are preparations that are considered if situations arise that were not included in the strategic plan. Benefits of creating a contingency plan are discussed, and guidelines for implementing a successful contingency plan are presented.

Full Text:

Copyright Risk Management Society Publishing, Inc. May 2001

"I sat in my chair, saying, `It's going to stop,'" says Roberta Martoza, risk manager for Seattle-based Amazon.com, as she describes her experience during the February earthquake. "Then the second wave hit. `Under the desk,' I said." She and the two staff members she was meeting with crawled under her desk.

"It is progressively getting worse, it is lasting forever. I'm under my desk, under a window, and I'm thinking, `The glass is going to break and I'm going to get cut.' Then it occurs to me, `I'm in a nineteen-thirties brick building.' I almost started panicking, then stopped myself. `You're doing all the right things. The building's been retrofitted. All you need is to be in control.'"

Control in a crisis is an elusive, but vital, quality. Without it, a business is left to the mercy of the catastrophe-in whatever shape it arrives. But with an effective contingency plan in place, the job can be made a lot easier.

Take Amazon.com, for example. Moments after the earthquake, employees were gathered outside the building, away from any possible danger. Jeff Bezos, the company's founder, was calming the crowd down and explaining what everyone would have to do. A water main was shutdown to cut off a cascading waterfall near the elevators. Structural engineers on staff were going through the building to assess the damage. All customer service calls were routed to an alternate location in West Virginia. The previously contracted clean-up crew was contacted. And just over twenty-four hours later, everything was cleaned up and it was business as usual at Amazon.com.

Defining Contingency

No matter how carefully a firm formulates, implements and evaluates their strategies, unforeseen events can make a planned strategy obsolete in no time. The seriousness of the circumstance and its impact on an organization is in many cases directly related to how prepared an organization is in advance.

[Illustration]

Enlarge 200%

 

Enlarge 400%

Contingency plans are alternative plans that can be put into effect if certain key events do not occur as expected, as defined by Dr. Fred David in his book, Concepts of Strategic Management, (Prentice Hall, 1998). Or, as Lester Digman explains in Strategic Management: Concepts, Processes, Decisions (Dame Publications, 1998), contingency plans are preparations that are considered if situations arise that were not included in the strategic plan. Whether tornadoes, hurricanes, war, death of a CEO or increases and decreases in demand and sales, the more unpredictable and disorderly the environment is, the more likely it is that companies will have to rely on these alternative courses of action.

In a global business environment fraught with dynamic change, the question remains: Why is the ability to plan for uncertain future events not considered a key element of strategic management in more companies?

Benefits of Contingency Planning

Digman describes four benefits of contingency planning in Strategic Management.

1. Contingency planning helps firms get into a better position to cope with unexpected developments. It allows firms to avoid the shock of complete surprise. Amazon.com had implemented a safety program just nine months prior to the earthquake. Safety marshals were thus ready to evacuate each floor, and because their employees' well-being was automatically taken care of, management could move on to other problems.

2. Contingency planning also reduces indecision, uncertainty and delays when something unusual happens. Operations can halt or at least be impaired during emergencies. Thinking ahead and preparing for events that may follow a tragedy allow a company to remain in forward motion.

For example, Thomas Rogan, a consultant with the managing general agency MacNeil Group in Ft. Lauderdale, Florida, points out the impressive 1992 recovery of the American Bankers Insurance Company (ABIC) after Hurricane Andrew. A preappointed senior executive took charge, relocating the entire organization of several thousand employees to a new building. Employees volunteered, working nights and weekends to set up the office. Data was transferred from an offsite hot site. And ABIC was back in business in a little over a week.

3. A firm with a contingency plan is more likely to respond rationally to an unplanned situation than a firm without a backup plan. Firms that have played through possible crises and their reactions to those events avoid panic and damage to the firm and its operations when the real time comes. Rogan recounts a lesson in rationality that the MacNeil Group experienced during the last major storm in Florida. "People tend to get full of adrenaline, and they work very, very hard and long, long hours," he says. "We had to put in some restrictions-`You cannot work over this and you must take time off'-because it would otherwise just wear people out.'"

4. Contingency planning forces managers to think in terms of possible outcomes, rather than just the most likely outcome. The business may seem covered, but has every aspect been examined? "For example, company X says, `We house your server. We're backing you up. You're fine,'" says Paul Hulsebusch, vice president of catastrophic operations at GAB Robins, in Parsippany, New Jersey. "But did anyone ever look at the backup organization to identify if they had a contingency plan if something happened to them?" The contingency planning process allows managers to brainstorm and come up with many possible outcomes, preparing for the worst.

Considerations

When creating contingency plans, organizations should keep in mind what they are trying to maintain within the organization-de term in ing what events would have an effect on the business and would require contingency planning procedures. In Concepts of Strategic Management, David outlines common questions that companies should consider when creating contingency planning:

* If a new technological advancement makes our new product obsolete sooner than expected, what actions should our firm take?

[Photograph]

Enlarge 200%

 

Enlarge 400%

* If demand for our product exceeds plans, what actions should our firm take to meet the higher demand?

* If certain disasters occur, such as loss of computer capabilities, a hostile takeover attempt, loss of patent protection or destruction of manufacturing facilities due to earthquakes, tornadoes or hurricanes, what actions should our firm take?

* If our sales objectives are not reached, what actions should our firm take to avoid profit losses?

* If a major competitor withdraws from a particular market, what actions should our firm take?

Whether they pose an opportunity or a threat for a company, addressing these issues allows an organization to react quickly and effectively.

Involved

The preparation of focused and practical contingency plans requires the help of all those involved in an organization. Managers as well as employees should take part in identifying the key processes and operations that are necessary to ensure long-term organizational survival.

When Martoza was developing the new safety awareness program for Amazon.com nine months ago, she involved the safety wardens. "A lot of them noticed improvements that needed to be made." She also learned from the earthquake the importance of taking stock of employee ability. She discovered that one employee was a former government worker who knew how to tag buildings; another was an ex-emergency medical technician. "People were coming forward who had skills that I was amazed with," she says. Martoza realized soon after the event how useful it would be to have a listing of which staff members possess such abilities.

Employees and managers also know best which resources they need to perform their jobs and the possible steps they would take in order to replace these resources if a catastrophe were to occur. Involving them ahead of time in the planning stage could be a critical ingredient in keeping the organization operating if normal activities and facilities become unavailable or impaired during a disaster.

"When we put our disaster recovery plan together, we arranged to have secondary vendors," says Tom Cochran, president and owner of Cochran and Co., a managing general agent operating in the northwest United States. "Otherwise, if these vendors have had no contact with you, and now they're swamped [after a disaster hits the area], you're not going to get served."

"The misnomer is, `It's free until you use it,"' Martoza says regarding the prearrangement she made with BMS Catastrophe. "If we had any water or smoke, we needed to get it cleaned up immediately. We needed a company that specialized in doing that to come in quickly. Since we prenegotiated a contract, we were first on the list."

Depending on the number of contingent events that a firm chooses to identify, the necessary time required to successfully prepare and evaluate a contingency plan may vary. The process could require months and even years of ongoing planning. But if the planning process becomes too intensive, the plan itself may not work, according to Hulsebusch. "It actually restricts you a little bit," he says. "I've seen failures where somebody has responded to a disaster, and they've spent so much of their time putting together a response and recovery plan, and so much of their time administering that plan, that they actually fall short in getting things done."

The key, Hulsebusch says, is keeping things flexible so that the plan "gets things started." This requires continuous updating and evaluating, as conditions change, including personnel, technology or essential business operations. A coordinated team with members from different departments can address this by interacting with employees and keeping up with the changes that may need to be considered in a previously planned contingency.

The planning process can be frustrating, expensive and overwhelming. The low probability associated with certain events impedes the planning process. Determining where to draw the line on the likelihood of an event occurring is one of the most important and most difficult aspects of the process.

The Seven-Step Process

A straightforward approach to contingency planning was proposed by Robert Linneman and Rajan Chandran, who described a seven-step process in Managerial Planning.

1. Identify both beneficial and unfavorable events. Whether considering higher-than-forecasted interest rates or the death of a key executive in the organization, this is when the firm brainstorms about the worst-case scenarios, including events that may not be immediately obvious.

"Hurricanes get the major press," says Don DeMarco, global director for IBM Business Continuity and Recovery Services based in Sterling Forest, New York. "They cause people to sit back and wonder if their protection is there. But things like information security and performance issues in the e-business frame are far more important when compared to the probability of a lightening storm taking out your Web site."

Companies may also fail to realize the extent to which their liability extends. "Take the chemical industry," says Hulsebusch. "They understand their exposure where they have big manufacturing plants, but they don't look at where they have pipelines or where they are shipping product. For example, if they have a product at a railhead that they are liable for and they have a release somewhere, what happens? People tend to get complacent with thinking they've got the big pieces covered, and actually, the hardest part is responding to some of those unique, smaller needs."

2. Specify trigger points. Trigger points are the instances when a risk should be reviewed and when the contingent actions should be activated. Calculate when risk events are likely to occur, expanding the definition of disaster.

"What's a disaster?" asks Hulsebusch. "To a small business owner, it's the person that's supposed to open up in the morning not showing up. To the conglomerate, it's having a great fire loss in a large complex. People tend to focus on the physical and not the incidental damages. They don't understand that when they can't make widgets, their customers are going to find someone else that can."

[Photograph]

Enlarge 200%

 

Enlarge 400%

3. Assess the impact and estimate the potential benefit or harm. Consider the occurrence of the critical event and the actions that should follow in order to offset or deal with the present situation.

For example, during Hurricane Floyd in 1999, DeMarco was in Florida trying to get home. "When I got on 1-4 [heading to Tampa Bay] it was a logjam of people with pillows and dogs," he says. "These are companies' employees. Just because the businesses' systems have been reconstituted doesn't mean that the people you need to run them are there. They're boarding up the windows. Or in Canada [during the recent ice storms], they were stoking the fire because their families were cold and the power was out." There needs to be an understanding of how the technical aspects of the business link with its people, he says.

4. Develop contingency plans. Contingency plans should be compatible with the firm's current strategy and at the same time be economically feasible. Plans should be kept simple so they can be easily referred to and understood by anyone in the organization. Clear communication is vital in this step because the contingency plan is implemented during a time of distraction.

"People tend to plan sometimes and lose sight of goals and objectives," says Hulsebusch. "They can set those when they write the plan, but they have to be adjusted the day a disaster occurs."

It is also important that organizations anticipate the likelihood of operational inefficiencies and associated added costs during this time. Although a firm may think that it has considered every aspect of the contingency, things rarely work out as expected. Harold Anderson, president of Kenneth I. Toby, a managing general agency in Seattle, calmly handled some unexpected needs during the recent earthquake. "You never know how anybody is going to take [a disaster]," he says. "I spent a good thirty minutes under a desk talking to two employees who were absolutely hysterical. The only thing you could do was get under the desk with them, and sit there and talk and try to get them calmed down."

5. Assess the counterimpact. Estimate how much each plan will capitalize on or reduce the associated situation. Doing so will help relate a quantifiable value to each contingency plan and will assist in strengthening the planning process. This will bring to the surface items that may have been left out in prior planning of contingencies.

A major cruise line, for example, contracted with IBM to provide scripts for its customer service line if the cruise line system was to go down. During a hurricane, customers were routed to an IBM location and IBM staff answered the calls. "So at least they didn't lose the sell," says DeMarco. "They calculated this to be anywhere from eight to ten million dollars worth of revenue protection because they know that when a client calls them, and they go on a cruise, they tend to come back."

6. Determine and monitor early warning signals. Develop advanced action plans to take advantage of the available lead time.

Of course, relying solely on specific measures does may not always lead you to make the right decision. For example, many companies in New York City went into disaster mode when the blizzard-that-was-not was strolling up the eastern seaboard this past March. Sometimes, though, being a little cautious cannot hurt. "If the storm goes around you, and nothing happens, it's an expense you've incurred and it's just a preventive measure," says Rogan. "But if you don't and the storm does hit . . ."

7. Communicate and rehearse. Once a contingency program has been developed, it is then important to inform all members of the organization of their roles and responsibilities in the plan. "A lot of the time you find risk management working within a vacuum," says Hulsebusch. "Does the plan actually get communicated out so the recovery effort extends throughout the organization?"

"[Also,] if you don't have a way to communicate," says Cochran, "you're cut off. [Although] with e-mail now, it becomes much easier. When the earthquake was going on, we couldn't call through [to Seattle] because everybody was calling. But we were able to e-mail back and forth."

Individual departments and operating units should also practice exercise drills dealing with the backup plans. This could assist in identifying any unknown shortcomings within the contingency program in time to make the necessary changes.

[Photograph]

Enlarge 200%

 

Enlarge 400%

In the End

Too often, a good business contingency plan is not top-of-the-mind until after a problem occurs.

This common sentiment has lingered in the risk management field. "It wasn't an awful lot of years ago that this was an unheard of practice," says Hulsebusch. Although the year 2000 scare brought contingency planning its fifteen minutes of fame, the largely nonevent seems to have deflated the sudden corporate interest. And even with the attention it brought information technology departments, DeMarco insists that there are still contingency-bashful companies out there, led by executives with little understanding of information-based risks.

Of course, who would not drag their feet over the prospect of implementing a comprehensive analysis and response system? It is a daunting task.

The importance of contingency planning, according to David, however, is not limited to just resurrection from gloom. By utilizing contingency planning, he writes in Concepts of Strategic Management, organizations can minimize threats while at the same time capitalize on opportunities, thus improving their overall competitive position.

As part of the strategy evaluation procedure, contingency plans should be developed to assist the company in forecasting and attempting to predict the occurrence of future events, both good and bad, that could have profound effects on the organization. As business strategies are selected, and others are discarded, companies can use these alternatives as contingency plans in the event that the chosen strategy does not work.

The greatest challenge in contingency planning may be attaining the crucial support and initiative of top management. Many risk managers find this hard to come by until a disturbing event strikes. Perhaps these executives should take a lesson from some of their elite colleagues.

Bill Gates was at the Westin Hotel in Seattle on February 28, demonstrating Microsoft's new Windows XP system to a group of computer professionals when the earthquake struck. As the audience rushed in loud panic for the doors, beneath swaying chandeliers and falling ceiling tiles, the chief executive officer calmly walked off the stage. "Were you scared?" asked an audience member. "No," replied Gates, unperturbed for his own safety or any immediate peril to his technological empire. Every executive should feel this secure in his or her company's preparedness when disaster strikes.

[Sidebar]
Contingent Prep List

[Sidebar]
Every disaster brings unique dilemmas-an earthquake in California causes problems that are different from the problems caused by a flood in North Carolina, a fire in Missouri, or a major telecommunications outage in New York City. Still, there are basic preparations that can help minimize the impact of virtually any disaster.
1. Keep Flexibility in Mind

[Sidebar]
Regardless of the disaster you are preparing for, first determine what is important. Differentiate mission critical from merely important, and plan accordingly.
2. Build a Plan

[Sidebar]
Plan for a disaster that addresses everything in your business, from computers to customer service phone banks to paper-based assets. Every critical function that keeps your business in business must be recovered and maintained.
3. Test Your Plan

[Sidebar]
This is a common shortcoming of many well-meaning businesses. The only way you can gauge effectiveness and trouble-shoot weak spots is to regularly test the plan.
4. Put Your People First

[Sidebar]
Do not lose sight of the human element. Although the survival of the business is at stake, your employees may be facing their own personal tragedies. Include programs to help employees in your business recovery plan (medical care, financial assistance, stress relief). Unless their families and personal property are safe, your employees will not be focused on recovering the business.
5. Back Up Your Data

[Sidebar]
Your computerized data is critical to your business. Make sure you back up important information such as customer lists, inventory, orders and employee data so you can continue your business without interruption

[Sidebar]
6. Consider a Generator

[Sidebar]
The high winds of hurricanes can knock out power. Can you get by without power for an extended period of time? Do you have an alternate power supply to run missioncritical data on your computers and, if you are a manufacturing facility, to run your assembly line?
7. The Basic Necessities

[Sidebar]
Did you know that if your facility does not have running water, OSHA regulations say you cannot open for business? Make sure you have water and toilet facilities available for employees involved with your recovery. And do not forget to provide food for those employees as well.
8. Consider a Back Up Facility

[Sidebar]
Whether you have a large glass house or a single server, if your information is vital to the life of your company and your facility is flooded, where do you go? If you have chosen a backup facility for your mission-critical activities and have it ready to go, you will be better prepared to run your business without your customers noticing an interruption.
9. Anticipate Communications Problems

[Sidebar]
Natural disruptions such as hurricanes can bring down phone and power lines. If you do not have access to mobile phones and two-way radios, you might not be able to communicate with key personnel or the outside world.
10. Build a Partner Network

[Sidebar]
Some disasters cause damage that is widespread. If it brought you down, it may also have knocked out your business partners as well. This includes your bank and key suppliers. Working together can put everyone back on their feet faster.

[Sidebar]
Source: SunGard Business Continuity and Internet Services

[Sidebar]
"People tend to get complacent with thinking they've got the big pieces covered, and actually, the hard part is responding to some of those unique, smaller needs."

[Sidebar]
Although the year 2000 scare brought contingency planning its fifteen minutes of fame, the largely nonevent seems to have deflated the sudden corporate interest.