UK Resilience

Chapter 2 - Planning Principles

Introduction

Having made a comprehensive survey of your premises and organisation on the above lines, and taken action to correct any flaws found, the next step is to start to plan the response should the unthinkable happen. This plan is essential so that in an emergency you have a good idea of what you will do in the early stages of recovery. All experience tells us that what we do in the first few hours dictates just how well we will survive. In the emergency services this is referred to as the 'golden hour'.

But first, what is a good working definition of a disaster as it might affect your business? The impact of the disaster will depend on the scale of the affected organisation, but the following definition is applicable to most commercial and industrial organisations and local authorities:

A disaster is any unwanted significant incident which threatens personnel, buildings or the operational structure of an organisation which requires special measures to be taken to restore things back to normal.

This definition would be equally suited to a flood, fire, bomb threat, building collapse or contamination of a food product.

While it is impossible to predict every kind of possible incident that may threaten your organisation, it is relatively straight-forward to set out a basic plan which can be implemented to cover a wide range of possible actions. For example, part of the plan will cover evacuation procedures, but the principles will be generally applicable for fire, flooding, or bomb threat incidents, although procedures for fire and bomb threats may vary.

The basic principle of the plan is that it will provide a framework for you and your organisation to respond to any crisis, whether foreseen or unforeseen. Developing a library of plans for specific emergencies, and nothing more, runs the risk that the emergency which does occur is the one that was not foreseen, or that an anticipated emergency develops in ways that had not been foreseen, with the effect that the specific plans are of limited assistance or are even rendered useless. The starting point must be the development of flexible management arrangements for handling a crisis, whatever its cause. It therefore follows that the crisis management arrangements should align with normal management arrangements, not least because normal services will have to be maintained while the emergency is handled.

This integration of routine and emergency plans and procedures embraces a number of concepts, all of which need to be embodied into your organisation if they are to be truly effective. There are four main areas where this integration must take place.

First, the principal emphasis in the development of any plan must be on the response to the incident and not the cause of the incident. Thus the plan has to be flexible; it has to work on bank holiday weekends or in freezing weather conditions. It has to be clearly written and easily understood. All involved must clearly understand the part they have to play. It will need to be regularly tested against specific circumstances. This will require an assessment of the hazards faced by your organisation and consideration of the adequacy of the planned response in each case.

Second, any emergency management arrangements must be integrated into your organisation's structure. Emergency plans must build on routine arrangements and it is therefore essential for those who will be required to respond to any emergency to be involved in the planning process. This sounds like common sense. However all too often independent groups develop plans for an organisation which are only dusted off after the incident has occurred, by which time it is too late and that absolutely crucial immediate response during the first 'golden' hour is less than effective.

Third, the integration of the activities of different departments within your organisation. The overall response to a crisis will invariably need input from a number of different departments. Effective planning must integrate these contributions in order to achieve an efficient and timely response to an incident. Not to be aware of the contribution to be made by other sections within an organisation is a recipe for a muddled response.

Fourth, the vital need for you to look over the wall and co-ordinate arrangements with your neighbours and other authorities who might become involved, such as the Police or Fire Brigade. Do not forget the need to co-ordinate plans with other tenants in a multi-occupancy building (e.g. to ensure that different evacuation assembly points have been chosen). It is obvious that, to achieve a truly co-ordinated and effective response, you and your neighbours must know each others capabilities, such as the use of each others emergency equipment, temporary secure storage and so on.

Before finally starting to draft your plan you should define the functions which are critical or irreplaceable to the continuity of your business e.g. information on computer systems such as customer details, current order book information, supplier information, staff information, specialist tools and stock, manufacturing drawings, legal documents and so on. Essential equipment requirements need to be defined, such as PCs, desks, telephones and copiers (with potential suppliers) and off-site resources such as company cheque-books, stationery etc need to be listed. You will also need to identify the minimum staff needed to maintain a service to your customers whilst recovery from disaster is under way. Finally you will need to define the length of time you can afford for recovery to take place as this will shape your recovery plan, determining, for example, whether or not relocation of part or all of your facilities is needed.

Although all plans are different they will all have a number of features in common. The following checklist serves to act as an aide-memoir and will also be useful as a skeleton to help you if you have to draft a plan from first principles.

The Plan

The introduction to the plan should cover these points:

• The clear purpose of the plan, bearing in mind that it is better to allocate a definite time frame for the recovery of critical functions than to rely on a general statement of intent.
• A clear statement of support by senior management, which also requires all staff to read the plan biannually.
• A description of the premises, facilities and operations covered by the plan and an outline of activities or processes carried out in these premises.
• The main hazards faced by the business and the effect these hazards could have on the business.
• The structure of the crisis team(s) who are responsible for managing the recovery. Team Leaders should be nominated together with their administrative support, and each member, and in bigger organisations a nominated deputy, will normally have an identified function such as facilities, IT, rescue of pre-designated items of value, supplies, PR and so on. This information might be included in an Appendix to facilitate easier update when personnel change.

Senior Management

The need for a plan must be seen to have support at the highest level and a clear statement to this effect must be placed at the beginning of the plan. Without Board or similar support few line managers will respond enthusiastically to the diversion of resources, which is implicit in developing contingency plans and training to implement them.

Implementation

It must be made clear when emergency plans are to be implemented and who has the authority to implement them. This authority is not necessarily related to seniority or status. Often the decision to put emergency procedures into effect will have to be taken outside normal working hours. If a flood takes place at 3.00am on a Sunday morning security personnel should not have to ring up the Chief Executive to seek permission to call out a plumber! Thus the plan must clearly indicate under what circumstances it should be implemented. Key points for inclusion here are:

• When and how to implement the plan.
• The persons responsible for initiating its implementation.
• The delegation of authority for specific functions e.g. removal of specified items to a pre-planned place of safety or calling out pre-arranged specialist support or authority to spend up to an increased financial limit.
• Call out lists of key personnel, which must of course be kept up to date.
• The designation of either an on-site office or an off-site focus, such as a hotel or another business, with appropriate communication facilities (telephones, fax etc) to act as a focus for the management of the response to a disaster and recovery from it.

Call Out and Check Off Lists

Call out lists, giving names, positions in the organisation and contact telephone numbers, form a key part of all plans and are critical to their success, particularly during the crucial early stages of the response. It is essential that such lists are updated regularly, at least quarterly, and preferably monthly, and they must recognise the likely availability of staff at nights and weekends as well as the problems associated with answering machines. Those individuals with key roles to play, such as the Recovery Teams, should be supplied with simple check-off cards of the actions they must take on being told of the incident. These cards should be readily available at all times - in cars, at home and in the office. Taking the correct action during the early stages of the response is absolutely crucial, and check-off cards can usefully list the actions which you would expect to be taken in, say, the first three hours of the response, the next twelve hours etc.

Damage Minimisation

The plan should set out the means and resources to be used to minimise damage to premises and equipment. There is a common law duty to minimise loss and this requirement is often invoked under a contract of insurance. It therefore follows that expense controls should not be abandoned in the anxiety to make the business operational again. The plan should specify the location of salvage equipment and detail the names and telephone numbers of those trained in its use. Details of likely sources of assistance should be included, including wherever possible both office and home telephone numbers. For example:

• Experts in the salvage of documents and computer data.
• Smoke residue removal experts.
• Plant hire contractors for pumps, generators or heating equipment.
• Experts in decontamination (if appropriate).
• Points of contact for all the utilities (gas, electricity, telephones, water) and local authority engineering services.
• Points of contact for any national authorities which might be involved, such as the Environment Agency if rivers might be polluted as a result of the incident.
• Transport and removal companies.
• Building contractors, architects, and structural engineers.
• Property Agents (for emergency co-ordination) Computer equipment supplies Suppliers of office furniture and equipment Appropriate insurance companies.
• Caterers - staff will need to be fed.

Evacuation or Containment

If the fire alarm sounds in your own premises everyone should immediately evacuate the building to a pre-allocated point and the fire brigade called through the 999 (112) facility. There will also be other occasions when evacuation of premises may be required, such as following a spreading neighbouring fire or flooding. Conversely it may be necessary to keep everyone in a particular building whilst a problem is resolved, such as a bomb threat where the location of the bomb is uncertain. Particular points to bear in mind for an evacuation plan are:

Identification of the people who are authorised to initiate the evacuation plan at times other than after the sounding of the fire alarm, when evacuation must go ahead without authorisation.

• Designated sites where evacuated personnel are to muster.
• There should be one near by (for Fire) and one distant (to cater for police cordons).
• Ideally both should be under cover, not only for comfort but also to facilitate communications.
• Designated personnel to control evacuation and to co-ordinate with the emergency services.
• Designated tasks for individuals if they can undertake them safely prior to evacuation e.g.:
  • Calling the Fire Brigade via a 999 call.
  • Turning off utilities.
  • Custody of specific items.
  • Security of premises.
  • Transfer of telephone callers to pre-designated location, preferably by pre-arrangement with the telephone company.
  • Provision of focal point for contact by the emergency services and others.
  • Identification of Manager/Security Officer to brief the emergency services on arrival.
  • Checking that premises have been evacuated.
  • First aid fire-fighting, if safe to do so.

If there is a need to contain people within a building, particularly in the event of an external bomb threat, plans are needed to prepare for this. They should include:

• Designation of a safe area where people should congregate, away from windows and the danger of flying glass.
• The area should be structurally surveyed to ensure that it is blast resistant.
• Provision of telephone facilities in the safe area.
• Availability of toilet facilities and drinking water.
• Availability of special facilities if old people, children or animals may be involved.
• Location of First Aid facilities with list of staff who are qualified "First Aiders".

If there is a bomb threat the Home Office publication "Protecting People and Property" provides excellent guidance to managers and security officers.

Relocation

This part of the plan should cover the arrangements which may be needed if the business has to be relocated to other premises. It should include any pre-planning undertaken in acquiring an alternate location as well as details of sources of assistance which may be needed. There are several ways the requirement for alternative accommodation can be met:

Introduce a 'buddy system'. This can function particularly well where two businesses (who may even be competitors) agree to reciprocal facilities in the event of disaster befalling either of them. The arrangements can apply to premises, staff or equipment's.

Purchase/lease alternative accommodation and equip that to the required level; IT and communications equipment requirements are particularly important aspects to consider. However this option is expensive and is usually only resorted to by those companies who have specialist requirements and who need to resume the fee-earning part of their business within a very few hours of the incident.

Purchase/lease alternative accommodation in partnership with another company with similar needs. Such arrangements have become popular in the City of London.

Enter into an arrangement with a specialist business continuity facilities company. This has the advantage of providing a facility without any of the administrative problems. It is not a cheap solution but is popular and cost effective in comparison with purchase/lease options above.

Rely on the market place to produce the required space and resources. This solution is often preferred by those businesses who do not have to re-establish the business process in a short time. This option is often accompanied by 'work at home' schemes or by reciprocal arrangements with another company in a similar business.