"Emergency response is a product of preparedness."
- The 9/11 Commission Report
If one asks the question, "What is the first step in the process to develop an emergency preparedness plan?," many will answer "threat assessment" and cite the need for vulnerability and risk evaluations. In truth, the planning process must begin well before a risk assessment is performed. This article provides an overview of the emergency preparedness planning process.
Building the Foundation:
Gain program priority
The first step in any organizational process, whether it is preparedness planning or developing a new product, is to gain the support of the "stakeholders" of the organization. In most cases, the stakeholders are senior management who have the budgetary authority. In other cases, stakeholders may be clients, constituents or stockholders who signal priorities via their consumption or voting patterns. In either case, it is the stakeholders who will ultimately set (or cue) preferences and dedicate resources. Even before an emergency preparedness planning process is developed, a strategy to get emergency preparedness on the agenda and past the initial discussions must be devised.
In our second article, we discussed the requirement to articulate specific needs prior to hiring an emergency preparedness planner. The same principle applies to garnering program support from corporate leadership.
The first step is to conduct a needs (or requirements) assessment. What does your organization need? A response plan? A preparedness strategy? A continuity plan? An existing plan review? Why have you chosen to undertake this process? Local regulations? Client concerns? Because it's the "right thing to do?" How do you plan on accomplishing the program? In house? With a facilitator? What do you see as the final product? A corporate preparedness plan? Increased employee confidence and awareness? Improved client cooperation? While the initial needs assessment can be general, (as it will likely become more cogent as the process ensues), there must be initial answers to the questions of what, why and by whom. The "how" is the process itself.
But how does the corporate security director get the attention of the senior management? Certainly, and especially in today's world, there is sufficient sensitivity to the need for emergency preparedness. Many discussions, which often follow a seminar on emergency preparedness or a real-world incident, tend to fade away after a few weeks as organizations tend to return to the status quo of solving the daily dilemmas. Often, it is not the issue of getting the issue on the leadership's agenda, rather it is the challenge of sustaining the interest in emergency preparedness. Understandably, many senior company officials do not understand the elements of emergency preparedness. Because the organization has completed a risk assessment and has a physical security plan in place, they feel little need to provide any further attention to emergency preparedness. In far too many cases, the corporate emperors remain unclothed.
How do you maintain the topic of emergency preparedness on the corporate agenda? A "rhetorical question" technique, in the form of a quiz asking simple but unanswerable questions, might work. For example, "If we have a suspicious package incident, where does the corporate leadership gather?" Another technique might be the "customer concern" approach. Here, perceptions generated by clients, tenants, and/or the constituent stakeholder population are posed: "You know, sir, some of the tenants/employees have been asking me about this year's corporate emergency preparedness program and where they fit in. I'm comfortable with the immediate security aspects of our plan, but would like to talk more about a broader all-hazards corporate strategy." Whatever your strategy to get their attention, the most important part of the process has just begun: there is still sufficient work to be done to articulate the organization's needs and procure appropriate resources.
The obvious next question: What is this going to cost? In preparedness planning, costs generally include time and dollars. It takes time for key staff to participate in the planning process. It requires time for senior management to make decisions. There's also the time needed to develop and conduct exercises and drills. Dollars are spent on overtime and backfill to allow staff to participate in preparedness exercises. Dollars will be spent for a consultant, should you choose to hire one. While larger organizations may more easily absorb the fiscal requirement, in most organizations the senior management team has limited time available to develop and approve emergency preparedness policies and procedures. Most have, at the most, an hour or two every other week to review and approve policy decisions. When your courting of senior management for their resources is successful, you will still need to decipher how you are going to apportion time requirements for the planning process.
Develop groups and teams
In emergency preparedness planning, there are generally three "tiers" of involvement. The uppermost tier includes senior-level management. This group establishes priorities and prescribes policy prior to an incident and, in the event of an incident, prioritizes resources and makes any necessary policy decisions. The middle tier, comprised of corporate staff representing functional areas, is the core planning and implementation group. Prior to an emergency it develops protocols and procedures and, in the event of an emergency, manages information and resources. The third tier includes "action" teams, comprised of departmental or site-specific staff. Their emergency preparation involves specific emergency protocol preparation; in the event of an emergency they are the organization's "first responders." If we were to liken this model to a professional football team, the first group would be the owner(s), who set priorities (win!) and provide resources ($$); the second group the coaches, who develop plays and strategy; and the third group the players, who execute the plan.
With this general concept, we can develop groups and teams. Perhaps we call the top group the "Crisis Management Group." This would be the steering group that consists of the organizations' most senior members and who are charged with the task of approving emergency preparedness policies within the company. Meetings with this group are usually informational and require decision making. The middle group might be called the "Emergency Preparedness Planning Team" and is tasked with the requirement to conduct the planning for the organization. Its product is a corporate emergency preparedness plan. The third group, the "Emergency Action Team" is generally an execution team that takes direction from the planning team and develops specific response protocols within its functional area. Its products are site-specific emergency action plans.
The corporate security director, along with the risk manager and perhaps the vice president for operations, can sketch out the initial groups and teams. As the planning process ensues, modifications to the group and team structure are likely to be made.
At this point, we have gained the "buy in" and resources from the senior management, developed our initial groups and teams, and are ready for our first meeting. With whom? What are the topics? Are we ready to begin the actual planning? Not quite yet. We first need to establish goals and objectives and develop the process schedule.
Set goals and objectives
Normally, the Emergency Preparedness Planning Team (the middle tier) identifies program goals and objectives and the Crisis Management Group reviews, modifies and approves. Examples of program goals are:
- Develop and coordinate comprehensive emergency preparedness plan
- Create corporate emergency preparedness strategy
- Improve corporate staff and employee emergency preparedness awareness
- Coordinate corporate emergency preparedness procedures with first-responding agencies
At the same time, the planning group may want to outline characteristics of the final plan. Examples are:
- Comprehensive - addresses all hazards
- Validated through exercises
- Understandable - written in language understood by all employees
- Portable - can be easily carried during an emergency
Once program goals and objectives are approved, they can be provided to the Emergency Action Team.
Develop program schedule
If you ask corporate security directors when they would like their emergency preparedness plan completed, many will answer, "yesterday." Depending on the size and scope of the program, the initial process to develop an emergency preparedness plan can take anywhere from a few months to over a year. Follow-on program sustainment (continued validation, modification and practice) is indefinite. How much planning can the organization absorb? Two types of planning processes may be used.
Sequential Process
Sequential planning programs, where corporate-level policies and protocols are established first, followed by development of action team procedures, take longer but allow the organization to focus on one level of planning at a time.
This process would follow this order:
1. Build program foundation
2. Corporate-level planning and policy approval
3. Corporate emergency preparedness plan
4. Action team planning
5. Site-specific emergency action plan
Parallel Process
Parallel planning programs, where all three tiers of planning are working simultaneously, may produce a plan faster, but require more inter-team coordination. You accomplish the same steps as listed above, but they can be worked on by different groups simultaneously, and then fed through the groups for approval.
Regardless of the process chosen, meeting frequency must be established. How often and how long? The Crisis Management Group may only be able to get together monthly and for no more than 90 minutes. Generally, these meetings have the purpose of informing senior management of program progress and gaining policy approval. Information presented must be concise, structured, clearly articulate decisions and approvals required.
The Emergency Preparedness Planning and Emergency Action Teams, by necessity, must meet more frequently, for a few hours or so. Assuming there will be information gathering/preparation required by team members outside of the meetings, these teams might meet every other week.
The importance of "program momentum" cannot be overstated. Meetings must be continued, even if principal team members cannot attend. It is desirable to identify alternate team members, who participate when principles are unavailable. Programs which lose their momentum quickly lose interest.
Conduct Planning
The program foundation in place, planning can begin in earnest. Planning meetings, rehearsals and validation exercises are the core elements of the actual planning process. Periodic sessions with the Crisis Management Group are scheduled throughout the process. An example schedule of the process might look like this:
1. Build program foundation
2. Program overview meeting with groups and teams
3. Planning workshop #1
4. Planning workshop #2
5. Crisis management group update
6. Exercise #1 (tabletop)
7. Publish draft plan
8. Planning workshop #3
9. Exercise #2 (walk-through rehearsal)
10. Crisis management group update
11. Publish final plan
12. Information session with clients
It is important that each planning workshop, update and exercise have specific goals to be accomplished. For example, planning workshop #1 goals might be risk/hazard assessment and Department of Homeland Security Threat Advisory System and corresponding corporate actions. Workshop #2 might address communications protocols, communications strategies, and interaction with external agencies. If goals are not accomplished during a particular meeting, they are carried over to the next session. [The first article in this series, "Emergency Preparedness Planning Guidelines" lists those preparedness plan topics which should be covered in the process].
At the end of the initial planning process, it is wise to conduct an information seminar with key stakeholders and clients that have not been involved in the planning process. This session outlines key elements of the preparedness plan and opens avenues for coordination of client plans with the corporation's plan. As the process continues beyond the initial planning program, opportunities for clients to participate in the process may be available.
Sustaining Your Preparedness
While a football team spends much of the off-season developing its plans, it spends most of its season practicing. While the risks are greater and the possible outcomes more catastrophic, most organizations still spend too little time rehearsing their plans. Plans are often placed on the shelf and thus quickly lose their currency. Developing a program which sustains emergency preparedness is as important as is the initial planning process. How much practice can a company absorb? Well, certainly, a company committed to emergency preparedness can conduct exercises, rehearsals or drills more frequently than every six months or, in some cases annually. Sustaining a preparedness program does not have to involve a full-scale evacuation drill or a comprehensive mass casualty exercise. It can involve simple drills and rehearsals ranging from activating the emergency contact call list on a weekend to having individual departments meeting for lunch at their outside meeting point. Keys to a successful sustainment program are senior management interest, focus, regularity, and ingenuity.
Conclusion
This article has outlined the very basic ingredients of an emergency preparedness planning program. Obviously, development of a program is much more of a daunting task than can be detailed in these few pages. Program preparation, staff participation and resoluteness are key elements of a successful program. Nevertheless, it is a task that must be undertaken if an organization desires to ensure a viable emergency preparedness program.
About the author: Walter F. Ulmer III is president of Remlu, Inc. a veteran-owned small business dedicated to emergency preparedness planning and exercise development and delivery. He holds a bachelors degree in engineering from the United States Military Academy at West Point and a master of science in administration from Central Michigan University. He has over 25 years national and international planning and exercise development experience, ranging from the planning of military operations to developing preparedness plans for private corporations. He has developed emergency plans for military facilities, local jurisdictions, health departments, colleges and universities, high-rise buildings, and security service companies. He is currently an adjunct instructor for the National Emergency Response and Rescue Training Center and in this capacity presents emergency preparedness planning seminars to senior emergency management officials and elected officials throughout the United States. He is also a member of the Building Owners and Managers Association (BOMA) New York City Hi-Rise Emergency Action Planning Task Force.
