Businesses, manufacturing facilities, government installations and commercial properties spend billions of dollars each year on security measures. They install elaborate physical impediments to access such as fences, bollards and barricades. They put electronic access control systems in place. Sensitive facilities install X-ray and metal detection systems in their mailrooms and lobbies. Technology transforms ordinary fences into "smart" fences. Hundreds of millions are spent on security guards.
These security upgrades are extraordinarily useful in improving the security posture of a given location. However, one oft-overlooked solution is the simple and cost-effective measure of implementing a comprehensive emergency preparedness plan. Having a plan and drilling it on a regular basis is arguably the most important step in safeguarding the lives of employees, protecting property and providing for business continuity. Yet many businesses have plans that are inadequate or outdated, and a surprisingly high number have no plan at all.
Why Do We Do It?
The most important reason for having an emergency preparedness plan is that the stress induced by a crisis severely limits cognitive ability. In plain language, when people become frightened or anxious, their ability to process information and make judgments appropriate to the circumstances is severely degraded. This happens to everyone to some degree. By planning for emergencies, we can make our decisions while in a calm state, unaffected by stress.
Planning also allows us to call upon the knowledge and experience of other managers and staff in the organization to help us make the right decisions. In short, we are doing all the thinking about how to respond to any given emergency long before it actually happens. This will help save lives and property and limit the interruption to the organization.
Where Do We Start?
How do you begin to create an emergency response plan? Whether your company is doing it in-house or with the assistance of a security consulting firm, the starting point is the assessment of the facility to determine the likely level of risk it bears. Obviously a nuclear power plant has a different level of risk than a factory manufacturing leather goods. Factors such as location, type of business activity, size, number of employees and degree of facility control all bear upon the level of risk.
Once the risk assessment has been completed, the plan may be created. The plan must consider a wide variety of situations, everything from the mundane to the catastrophic. Many businesses are quite properly concerned with the threat posed by acts of terrorism. Those concerns are certainly valid and must be planned for. In general, however, the more common occurrences are those encountered virtually every day in many businesses and locations. So while we make contingency plans for the release of toxic chemicals, dirty bombs and suicide bombers, we must not forget to plan for the more frequent situations such as elevator entrapments, disgruntled employees, civil disturbances, strikes, fire and smoke.
To create a viable and comprehensive plan, representatives from management, security, engineering and maintenance, as well as supervisory personnel, must be included in all aspects of planning. Each department has a defined role and area of responsibility. Without the input of the respective departments, a plan cannot be created or managed. Further, the management of the plan must be done by a team rather than by individuals. This team must include representatives from each department.
Breaking It Down
A plan must have several components. First, it must clearly define what initial actions should be taken in response to every threat and incident identified in the assessment. For example, when the security desk in a commercial high-rise building receives a call from a tenant stating that they have just received a bomb threat or that they smell smoke, what steps need to be taken? Who is responsible for investigating the incident and verifying it as either an emerging or emergency situation? Who will make the determination as to whether the emergency action plan is to be implemented? Will tenants be notified? How and by whom? Who will contact the appropriate outside agency and coordinate the response? The plan must answer all these questions.
The plan should also clearly define emergency situations and establish the criteria for initiating an emergency protocol. Examples may include the verification of a fire alarm, receipt of credible information from law enforcement, phone threats, or suspicious objects in or near the facility. Other possible reasons to initiate protocols are natural disasters, industrial accidents and power outages.
In general, there should be latitude given to the emergency response team as to when to initiate the implementation of the plan. The team must weigh a number of factors in determining whether to relocate or evacuate away from an area deemed to be hazardous, not the least of which is the fact that people routinely get injured during evacuations. Sprained ankles, broken limbs and even heart attacks may occur when large numbers of individuals are moving down long stairwells. A decision to evacuate should be based upon sound and experienced judgement or the direction of a competent legal authority. Remember, in many municipalities building managers and security staff in commercial properties do not have the authority to order an evacuation. Such authority is reserved for first response or emergency management agencies designated by statute. Typically such a list includes the police and fire departments and the Department of Homeland Security with its state and local equivalents.
Direct Emergency Responses
In general, four actions may be taken in response to an emergency. They are:
- Full Evacuation
- Partial Evacuation
Full Evacuation. This measure is used to clear a building or facility in response to a potentially catastrophic or life-threatening situation. It often requires the order of competent legal authority.
Partial Evacuation. Used to evacuate people from the affected portion of a building. An example is the fire department ordering tenants to be evacuated during a fire on a particular floor as well as two floors above the fire and one floor below. Depending upon jurisdiction, this may require competent legal authority.
Relocation. Simply moving people away from a localized incident within a building or facility. An example would be directing people away from a suspicious package discovered in the lobby until police arrive. The responding agency would initially verify the danger and might then order either a full or partial evacuation. Relocation procedures typically do not require direction of a competent legal authority.
Shelter-in-Place. Numerous situations can occur that make it advisable for those inside a building to remain inside for their own protection. Unsealed procedures are necessary when the danger is unrelated to any toxic substance in the atmosphere. These procedures may be warranted if, for example, a strike taking place outside the building turns violent. Sealed procedures are used when there is a release (either intentional or accidental) of an airborne toxic chemical. Procedures call for sealing the building and turning off the HVAC system and any independent supplemental air intake units. Neither procedure requires the intervention of a competent legal authority.
The plan must clearly define evacuation routes and identify external assembly areas. Often a particular incident will require the use of a specific exit route or routes. Tenants and employees must be able to quickly identify a specific stairwell. For example, assume that a suspected truck bomb is parked on the north side of the building. The building has three stairwells and one of the three exits on the building's north side. During such a crisis, the exit on the north side would be deemed unsafe for use, and the occupants would be directed to use the other exits. This requires the stairwells to be clearly identified and, more important, that tenants or employees have a clear understanding of where each exit is located and the designation of each.
Keeping It Current
Once a plan has been formulated it must be validated through repetitive drill. During such drills, either live exercise or in tabletop format, plan weaknesses become evident. After the plan has been finalized, it must again be thoroughly and regularly drilled. Drills must be initially conducted on a scheduled basis until the plan becomes familiar to the occupants of the facility or building. Later, unscheduled drills should be implemented no less than four times per year. Drills should be repeated each time critical personnel are changed and should be conducted more frequently in high-risk areas.
The management team must continually upgrade the plan to account for changes in personnel and the structure of the facility. The personnel or management office must check the emergency plan each time an employee goes on leave, is transferred, quits or is terminated. The management office or security must be notified and must coordinate the replacement of the missing individual into the plan. Engineering and maintenance must check the emergency plan before they begin any construction or maintenance project that might interfere with the plan's implementation. Again, management or security must be notified and make necessary accommodations.
The best plan requires a clear channel of communication and redundant systems as well.
Commonly used methods of communication include
- Fire Alarm
- Public Address
- Telephone (Landline)
- Cell phone (In buildings with internal repeaters this can be quite effective)
- Runners (Face to face)
Built-in redundancy will make communications possible even under the most difficult circumstances. Special attention should be given to making sure that buildings with internal repeaters have the system tied into the emergency generator.
One of the most important aspects of any plan is the need to account for employees, tenants and visitors if there is a catastrophic event. In the case of commercial office buildings, each tenant must be responsible for accounting for their own personnel as well as their guests. Most building access systems keep track of individuals entering a building but do not track those persons when they leave. There are a number of solutions to this problem. One is to use electronic access control that does track users' entry and egress from the property; there are many systems available that offer this function. Another option is to use simple sign-in sheets in each office. Everyone signs in and everyone signs out. An alternative to the sign-in/sign-out sheet is an electronic visitor management system used in conjunction with access control.
Each tenant or company must have a primary and alternate meeting point where an accounting will be made. Subsequently, a tenant representative will provide that accounting to a member of the building or facility's emergency team.
Special needs individuals must be provided for as well. A list of all individuals requiring special assistance must be provided to security. However, arrangements for assisting those individuals must be made in-house. Building management is rarely, if ever, equipped to assist in the evacuation of people with conditions preventing them from using normal methods of egress.
Clearly there are a multitude of possibilities to consider in an emergency situation, and that makes it all the more important to have a comprehensive emergency response plan in place before disaster strikes.
About the author: David S. Katz is the president and CEO of Global Security Group Inc., a firm specializing in international security consulting, risk management, specialized training, protective services, investigations and counter-terrorism. He is also the program director of the Emergency Preparedness Planning Programs division of Diversified Security Solutions Inc. A former U.S. Federal Agent and instructor at the FBI/DEA academy at Quantico, Mr. Katz has prepared emergency action plans for more than 50 of the most prestigious commercial properties in New York City. He can be reached at firstname.lastname@example.org.