The obvious next question: What is this going to cost? In preparedness planning, costs generally include time and dollars. It takes time for key staff to participate in the planning process. It requires time for senior management to make decisions. There's also the time needed to develop and conduct exercises and drills. Dollars are spent on overtime and backfill to allow staff to participate in preparedness exercises. Dollars will be spent for a consultant, should you choose to hire one. While larger organizations may more easily absorb the fiscal requirement, in most organizations the senior management team has limited time available to develop and approve emergency preparedness policies and procedures. Most have, at the most, an hour or two every other week to review and approve policy decisions. When your courting of senior management for their resources is successful, you will still need to decipher how you are going to apportion time requirements for the planning process.
Develop groups and teams
In emergency preparedness planning, there are generally three "tiers" of involvement. The uppermost tier includes senior-level management. This group establishes priorities and prescribes policy prior to an incident and, in the event of an incident, prioritizes resources and makes any necessary policy decisions. The middle tier, comprised of corporate staff representing functional areas, is the core planning and implementation group. Prior to an emergency it develops protocols and procedures and, in the event of an emergency, manages information and resources. The third tier includes "action" teams, comprised of departmental or site-specific staff. Their emergency preparation involves specific emergency protocol preparation; in the event of an emergency they are the organization's "first responders." If we were to liken this model to a professional football team, the first group would be the owner(s), who set priorities (win!) and provide resources ($$); the second group the coaches, who develop plays and strategy; and the third group the players, who execute the plan.
With this general concept, we can develop groups and teams. Perhaps we call the top group the "Crisis Management Group." This would be the steering group that consists of the organizations' most senior members and who are charged with the task of approving emergency preparedness policies within the company. Meetings with this group are usually informational and require decision making. The middle group might be called the "Emergency Preparedness Planning Team" and is tasked with the requirement to conduct the planning for the organization. Its product is a corporate emergency preparedness plan. The third group, the "Emergency Action Team" is generally an execution team that takes direction from the planning team and develops specific response protocols within its functional area. Its products are site-specific emergency action plans.
The corporate security director, along with the risk manager and perhaps the vice president for operations, can sketch out the initial groups and teams. As the planning process ensues, modifications to the group and team structure are likely to be made.
At this point, we have gained the "buy in" and resources from the senior management, developed our initial groups and teams, and are ready for our first meeting. With whom? What are the topics? Are we ready to begin the actual planning? Not quite yet. We first need to establish goals and objectives and develop the process schedule.
Set goals and objectives
Normally, the Emergency Preparedness Planning Team (the middle tier) identifies program goals and objectives and the Crisis Management Group reviews, modifies and approves. Examples of program goals are:
- Develop and coordinate comprehensive emergency preparedness plan
- Create corporate emergency preparedness strategy
- Improve corporate staff and employee emergency preparedness awareness
- Coordinate corporate emergency preparedness procedures with first-responding agencies
At the same time, the planning group may want to outline characteristics of the final plan. Examples are:
- Comprehensive - addresses all hazards
- Validated through exercises
- Understandable - written in language understood by all employees
- Portable - can be easily carried during an emergency
Once program goals and objectives are approved, they can be provided to the Emergency Action Team.
Develop program schedule
If you ask corporate security directors when they would like their emergency preparedness plan completed, many will answer, "yesterday." Depending on the size and scope of the program, the initial process to develop an emergency preparedness plan can take anywhere from a few months to over a year. Follow-on program sustainment (continued validation, modification and practice) is indefinite. How much planning can the organization absorb? Two types of planning processes may be used.