Unknown Threat & Vulnerability

     At  a recent training seminar in London I asked BC planners and risk managers what they did the day Buncefield blew up and released its toxic cloud. Nothing was the response, what could or should you have done I asked, “Don’t know” was the general response. I asked, “What effect to the property and occupants was likely if the toxic cloud had entered the ventilation system”, “Ah turn off the HVAC system” was the resounding response.

I asked whether a fan not turning was leak proof or if by turning of a positive pressure system might actually cause negative pressure and actually pull in the contamination. Thought processes were now engaged and it was quickly agreed that fumes or toxic residue may have caused extensive illness, absenteeism loss of productivity and possible litigation, most importantly all problems were needless because simple measures could have eliminated the  risks, if they had known or recognised the threat and vulnerability.

The next scenario was an anthrax letter opened in a busy office. “What response action would you follow”, was the question and the responses varied from locking the letter opener in the broom cupboard to evacuating the building and “shutting down the HVAC system” to prevent spread. The various responses were reviewed and discussed all of which exposed logic flaws which everyone agreed. The typical spread and dissipation was shown and true decontamination costs explained. Most importantly it was recognised just how futile and costly evacuation was especially when a hoax was confirmed as is usual.

Bird Flu and pandemic preparation was the next subject to be assessed and all present had plans in place to provide continuity in the expected disruptive period. Prophylactic care (medicinal drugs) was a major cornerstone of most plans and I asked if they had issued the product to be taken today as effectiveness relied on taking the product several days before exposure. Discussions ensued about effectiveness which has not been proven and indeed safety issues were news to some. Masks were seen as the most significant protection factor but evidence was produced relating to the SARS epidemic in 2003 which according to the Centre of Disease Control, state that masks provide absolutely no protection to the virus because of size and mask leakage factors. 
 
The importance of these three simple but significant threat issues was not what the delegates knew but they didn’t know what they didn’t know.

Knowledge in risk management or business continuity is usually the result of book learning written by those that have little or no actual experience at the coal face. This is often the case in terrorism and CBRN issues where ex police or military experts rely on their training which was designed to detect, arrest or kill the culprits and certainly not defend business or occupants without the need for significant training, equipment and the luxury of a command structure enforced by discipline.

One of the questions I asked delegates was “Who has first hand decision experience in any or all of the following disaster scenarios”:

• Fire
• Flooding
• Explosion
• Emergency relocation
• Shelter in Place for more than 4 hours
• Hazardous evacuation through a “Hot Zone”

The expected response was very few yet all had written plans for these situations but none were aware of the previous situations in there planning concept. Reliance on supplier’s information or commitments can be a serious mistake and the recognition that salespeople are rehearsed in answering every objection you raise and the bigger or profitable companies employ the best sales team who last week may have been selling beans.

The severe flooding in 2008 of Sheffield, Doncaster, Gloucester and Hull encompassed the complete range of business and premises. Sir Michael Pitt was engaged by the government to write a report as to why the response and recovery took over a year and why the response was fragmented. His report identified nationwide failures in contractors and insurers and strongly suggested they get together to work it out. This after Lewes, and Carlisle!

This of course did not address the failures of so many business’s and infrastructure. I was at one point asked to address the business fraternity in Doncaster on how to mitigate their loss and initiate recovery and restoration procedures. The venue was at the local council premises on behalf of the local chamber of commerce,  aided by local government, the presentation was cancelled because the venue was affected by a new flood.

Insurers ran out of loss adjusters and flew in motor claims personnel from Detroit and they didn’t have a clue. Contractors ran out of equipment and recovery sites were flooded too.

The conclusion is that hard questions should be put to perspective training or supply companies and that self defence and proactive resilience should replace  or support the concept of crisis response and reaction.