These are not the worst disasters you will see

1
These are not the worst disasters you will see

• 9/11. Katrina. Virginia Tech.

The worst disaster you will see is the one that
happens to you or your business
2
Every Crisis is a Human Crisis

• The success of your organization relies on the
  preparedness of
• people

3
Disaster Exposure
Almost 2/3 of companies that suffered a disaster
experienced lost business
4
Five Most Common Failures
5
Action Items

• Predict. Plan. Perform.
• Identify Involve
• Critical Suppliers
• Critical Functions
• Critical Employees
• What If Exercises
• Establish How To
• Monitor
• Communicate

6
Lessons Learned

Virginia Tech was the definitive episode of
Violence in the Workplace
7
Timing
8
Northern Illinois University
9
Predictable Surprises

• Almost every disaster, incident of
  school/workplace violence and act of terrorism
  was preceded by warning signals.

10
Crisis Management First Response

• Pastoral setting
• Physically-intact campus
• Traumatized community
• Media circus
• 324 Media outlets
• 140 Satellite trucks
• 4 million by major network in first week

11
Crisis Communications Response

• Transparency
• Framing messages
• Controlled accessibility
• Established call center to broker access and
  provide information
• Signage on campus buildings when classes resumed
• Metrics
• Timeline

12
Crisis Management The Media
13
Timeline

• Initial shootings in West Amber-Johnston Hall
• Lovers triangle
• Absence of students to interview
• Immediate arrest of suspect
• Boyfriend left in a hurry
• Guns found in truck
• Norris Hall response
• Nine minutes from entry to end of shootings

14
The First 24 Hours
15
Why We Discount Risk

• Time alters our perception of risk
• It cant happen here.
• It cant happen to me.
• It wont be so bad.
• Im smarter and better prepared.

16
Disaster Denial
There cannot be a crisis next week. My schedule
is already full. Henry Kissinger
17
Why Continuity Planning?

• Public Law 110-53, Title IX
• Business environment at greater risk
• Natural disasters
• Pandemic threat
• Terrorism
• Economy at risk
• Governance requirements
• Disclosure issues
• Regulatory guidelines
• Sarbanes-Oxley
• Looming litigation

18
Statistics of Failure
OF BUSINESSES WILL LOSE TO
OF THEIR SHAREHOLDER VALUE IN 5 YEARS AS A
RESULT OF A DISASTER OR CRISIS. OF
CONTINUITY PLANS HAVE NEVER BEEN TESTED.
DISASTERS OCCUR ANNUALLY IN THE U.S.
OF BUSINESSES STRUCK BY A DISASTER NEVER
REOPEN, AND OF THOSE THAT REOPEN CLOSE
IN TWO YEARS.
83
20
30
80
70,000
40
25
19
Opportunity Timeline
Prepare and Plan
Monitor and Take Action
Manage and Mitigate
Return to Normal
Pre
IMMINENT
During
Recovery
20
Disaster Denial
21
Why Now?

• Business environment is less forgiving
• Risk management is usually internal, but external
  risks have not been addressed
• Systemic risks have not been a focus how to
  survive a major industry-wide event

22
Vulnerabilities
Earthquakes

Extreme Heat Fires Floods Global Warming
Hazardous Materials Hurricanes Landslides
Multi-Hazard Nuclear
Pandemic
Tornadoes
Terrorism
Power Outages
Thunderstorms Wildfires Winter Storms
Workplace Violence Dam Safety Earthquakes
Tsunamis
Fires
Extreme Heat Floods Global Warming
Hazardous Materials Hurricanes
Nuclear Pandemic
Terrorism
Power Outages
Landslides
Wildfires
Thunderstorms Tsunamis
Volcanoes Winter
Storms Earthquakes Fires
Global Warming
Landslides
Tornadoes
Floods
Hurricanes
Pandemic Power Outages
Thunderstorms
Terrorism
Nuclear
23
Vulnerability Analysis
Impact
Awareness Contingency Planning
Corporate Governance Preaction Plan
Normal operations
Certainty
24
The Disaster Environment
DISASTER
Stake holders
Work School
Your Company/ Clients
Customers
Family Friends
Critical Suppliers
Employees
DISASTER
25
In/Out/Across Analysis
26
Associated Legal Issues

• Workplace violence legal issues can be divided
  into two broad categories.
• The first arises from the legal responsibility of
  an employer to safeguard against preventable harm
  to employees, customers, and anyone else visiting
  a workplace in other words, the duty to prevent
  violence.
• The second has to do with an employers
  obligation to respect employee rights during any
  investigative or disciplinary process stemming
  from an incident involving workplace violence or
  a threat of violence that is, the duty to
  appropriately manage incidents or threats that
  have occurred.

Source ASIS Workplace Violence Prevention and
Response Guideline, 9/2005
27
OSHA STATE STATUTES

• Employer owes a general duty to protect
  employees against recognized hazards that are
  likely to cause serious injury or death.
  Workplace violence has been identified as one of
  those hazards, and both federal and state OSHA
  agencies have issued citations to employers under
  the Acts general duty clause for failure to
  protect employees against workplace violence
• Employers obligation to maintain a safe place to
  work also arises from the legal principles that
  exist in most states under common law. Legal
  principles most commonly discussed in litigated
  cases involving workplace violence include

• A collection of negligence theories, including
  negligent hiring (the failure to properly screen
  job applicants, particularly for sensitive
  positions involving a high degree of interaction
  with the public) negligent supervision (the
  failure to supervise employees and to discipline
  violators of anti-violence rules)
• Negligent retention (the failure to terminate
  employees who have engaged in behavior in
  violation of company policies).
• Premises liability (the duty of a property owner
  to take responsible steps to guard against
  reasonably foreseeable violence)
• Respondeat superior (an employers indirect
  liability for the wrongful acts of an employee
  committed within the course and scope of
  employment)
• Sexual and other forms of harassment prohibited
  under discrimination laws (when threats or
  violence are motivated by a victims protected
  status)

28
Company Responsibility

• OSHA
• Section 5(a)(1) of the OSH Act, often referred to
  as the General Duty Clause, requires employers to
  "furnish to each of his employees employment and
  a place of employment which are free from
  recognized hazards that are causing or are likely
  to cause death or serious physical harm to his
  employees".
• Section 5(a)(2) requires employers to "comply
  with occupational safety and health standards
  promulgated under this Act".

29
What Constitutes Workplace Violence?

• Any physical assault, threatening behavior, or
  verbal abuse occurring in the work setting. It
  includes, but is not limited to
• Psychological
• Intimidating presence
• Harassment (being followed, sworn at, or shouted
  at)
• Obscene phone calls
• Threats
• Physical
• Beatings
• Rapes
• Shootings
• Stabbings
• Suicides

30
Spectrum
Source ASIS Workplace Violence Prevention and
Response Guideline, 9/2005
31
Warning Signs

• Perception
• Possible attributes of a perpetrator
• Blames others and documents others whom they
  believe to be the cause of their problems
• Fascinated with past violent criminals
• Files many complaints/grievances
• Inflexible-difficulty coping with change
• Loner personality
• Makes condition threats (If I dont get what I
  want..)
• Makes intimidating comments about weapons
• Makes veiled or indirect threats
• Obsession with police/military
• Paranoid
• Sense of hopelessness
• Takes criticism poorly

32
20 Steps to Conduct More Effective Workplace
Investigations

1. Prior to a specific incident, give consideration
   to the overall investigatory process and to
   identifying and/or training individuals who will
   be qualified to conduct an investigation.
2. Make a list of potential witnesses identifying
   and/or obtaining relevant policies, documents and
   other materials and developing preliminary
   questions to be asked
3. Give consideration to involving legal counsel in
   developing an overall strategy and/or providing
   assistance throughout the decision-making process
4. Conduct the investigation in a prompt manner

33
20 Steps to Conduct More Effective Workplace
Investigations

1. Recognize that the interview will have a
   substantial impact on the outcome of a case
2. Interview anyone who has potential information
   that may be relevant to the case
3. Who was involved, what happened, when did the
   incident occur, where did it occur, why did it
   happen, and how did it take place
4. Document the entire process

34
20 Steps to Conduct More Effective Workplace
Investigations

1. Avoid promises of confidentiality throughout the
   process. Instead, management should explain that
   information will be shared only on a need-to-know
   basis
2. Advise each witness not to discuss the interview
   or related matters with others
3. Communicate to those interviewed that there will
   be no retaliation for registering a complaint or
   for participating in an investigation
4. Communicate to those interviewed that there will
   be no retaliation for registering a complaint or
   for participating in an investigation

35
20 Steps to Conduct More Effective Workplace
Investigations

1. Begin the interview with broad, open-ended
   questions that require more than yes or no
   responses and give witnesses an opportunity to
   describe events
2. Encourage those who are included in the
   investigation to provide relevant information at
   any time prior to the point that a decision is
   reached
3. If disciplinary or other corrective action is
   taken, administer it in a timely manner after all
   related factors are taken into consideration
4. Review a number of factors in deciding whether
   discipline is appropriate

36
20 Steps to Conduct More Effective Workplace
Investigations

• If discipline is administered or other action
  taken, management should have the employee sign a
  statement or letter of discipline as
  acknowledgment of receipt
• If the investigation is inconclusive, consider
  whether there are non-disciplinary steps that
  should be taken, such as re-communicating the
  organizations policy
• At the conclusion of the investigation, prepare a
  written report that documents steps followed,
  information obtained, decisions reached, any
  actions taken, and other pertinent information
• Treat all parties with dignity and respect
  throughout the investigatory process

Source Barbara Richman, Philadelphia Business
Journal September 26, 2008
37
Current Trends

• Difficult to assess the full gamut of workplace
  violence costs
• Companies are often unlikely to report incidents
• Minimize public scrutiny
• Protect proprietary information
• Protect information that might expose
  imperfections in safety procedures, operations
  and employee practices
• The Bureau of Labor Statistics reported that
  during the 1990s, on average, 19 people were
  murdered at work each week or close to 1,000
  people on an annual basis. Bureau of Labor
  Statistics www.BLS.gov
• Likewise they reported that so far in the 21st
  century, workplace homicides have averaged 603
  annually a 13 increase in incidents occurred
  from 2006 to 2007. U.S. Department of Labor,
  Bureau of Labor Statistics, Census of Fatal
  Occupational Injuries, 2000-2007
• NIOSH reports the estimated cost for a workplace
  homicide is 850,000 per incident. National
  Institute for Occupational Safety and Health
  www.cdc.gov/niosh/

38
Combating Workplace Violence
Predict
Understand the Magnitude and Effects
Perform
Plan
Identify Possible Aggressors Victims
Implement Viable Solutions
39
Liabilities
40
Its More Than an IT Issue

• Systems do not protect people
• Servers cannot initiate action
• Networks will not be held accountable
• No people ? No recovery

Every Crisis is a Human Crisis.
Every Crisis is a Human Crisis.
41
Rule 1, 2, 3
Disasters result in high absenteeism Train 3
employees for each critical task
42
Crisis Communications
43
What Constitutes a Pandemic?
44
Modes of Transmission

• Contact Transmission
• Direct Contact
• Indirect Contact
• Droplet Transmission
• Airborne Transmission

P 1
45
Odyssey of SARS Transmission
3 hour Flight Hong Kong to Beijing, March 15,
2003 18 Cases 4 Deaths
Crew Member
Probable Case
46
The 9/11 Commission
Preparedness is not a luxury it is a cost of
doing business.
47
Update Whats Changed

• Public Law 110-53, Title IX
• Situation in Mexico
• Bio-terrorism
• Workplace Violence

48
Public Law 110-53, Title IX

• In the Implementing the Recommendations of the
  9/11 Commission Act of 2007 (the 9/11 Act),
  Congress mandated the Department of Homeland
  Security (DHS) to provide voluntary
  preparedness certification and develop guidance
  or recommendations and identify best practices to
  assist or foster action by the private sector
  across a wide range of business continuity
  practices.

49
Mexico Will the Violence Spill Over to the U.S?

• U.S. security no match for Mexican drug cartels

The Obama administration announced this week it
is sending hundreds of federal agents and
crime-fighting equipment to the Mexican border to
try to make sure violence from Mexican drug
cartels doesn't spill over into the U.S. CNN,
March 27,2009
50
Bio-Terrorism

• Bio-terrorism Al Qaida and the Plague

The story began with a Jan. 6
report in
the Algerian newspaper Echorouk that a

number of terrorists had died of the plague in
one of
al-Qaida
training camps in Tizi Ouzou. Another

Algerian newspaper
En-Nahar,


affirmed that 50

terrorists have
been diagnosed with the plague, 40 of whom have
already died.
51
Workplace Violence On the Rise?

• Businesses are bracing for more crimes committed
  by both external and internal perpetrators in a
  rough economy
• The worry is that poor market conditions will
  result in more burglaries, and
• Company layoffs could increase cases of
  embezzlement, theft and workplace violence by
  disgruntled workers
• Domestic violence is moving to the workplace

52
What Constitutes Workplace Violence?

• Any physical assault, threatening behavior, or
  verbal abuse occurring the work setting. It
  includes, but is not limited to
• Psychological
• Intimidating presence
• Harassment (being followed, sworn at, or shouted
  at)
• Obscene phone calls
• Threats
• Physical
• Beatings
• Rapes
• Shootings
• Stabbings
• Suicides

53
Current Environment

• 70 of workplaces have no formal workplace
  violence program, despite findings that there are
  thousands threats of violence every workday
• 43 of those threatened and 24 of those attacked
  at work do not report the incident
• Workplace violence myth most incidents come out
  of the blue.
• These incidents dont just happen spontaneously.
  People work through a processthere is a pathway
  that people will pursue toward ultimately
  committing violence.

Source John Lane, VP of Crisis and Security
Consulting Control Risks ASIS 54th Seminar, 2008
54
OSHA STATE STATUTES

• Employer owes a general duty to protect
  employees against recognized hazards that are
  likely to cause serious injury or death.
  Workplace violence has been identified as one of
  those hazards, and both federal and state OSHA
  agencies have issued citations to employers under
  the Acts general duty clause for failure to
  protect employees against workplace violence
• Employers obligation to maintain a safe place to
  work also arises from the legal principles that
  exist in most states under common law. Legal
  principles most commonly discussed in litigated
  cases involving workplace violence include

• A collection of negligence theories, including
  negligent hiring (the failure to properly screen
  job applicants, particularly for sensitive
  positions involving a high degree of interaction
  with the public) negligent supervision (the
  failure to supervise employees and to discipline
  violators of anti-violence rules)
• Negligent retention (the failure to terminate
  employees who have engaged in behavior in
  violation of company policies).
• Premises liability (the duty of a property owner
  to take responsible steps to guard against
  reasonably foreseeable violence)
• Respondeat superior (an employers indirect
  liability for the wrongful acts of an employee
  committed within the course and scope of
  employment)
• Sexual and other forms of harassment prohibited
  under discrimination laws (when threats or
  violence are motivated by a victims protected
  status) and

55
Company Responsibility

• OSHA
• section 5(a)(1) of the OSH Act, often referred to
  as the General Duty Clause, requires employers to
  "furnish to each of their employees employment
  and a place of employment which are free from
  recognized hazards that are causing or are likely
  to cause death or serious physical harm to his
  employees".
• section 5(a)(2) requires employers to "comply
  with occupational safety and health standards
  promulgated under this Act".

56
Background Statistics

• 1970s-present incidents of workplace violence
  have tripled
• Major contributors include
• Aggressive employees
• Domestic violence brought into the workplace
• Employers not taking recurring threats seriously
• Ethnic differences among workers
• Negligent hiring, supervision, or retention of
  aggressive employees
• Substance abuse

L

• Layoffs and company downsizing

• Poor handling of employee termination

• Estimated cost to business 120 billion

57
Actions

• Recognize behavior
• What to do/who to call
• How to deal with potentially violent individuals
• Individual responsibility in following
  procedures
• Get to cover
• Flee
• Defend yourself
• Utilize available communications
• Procedures training
• Front desk, reception, panic alarm training
• Practice all protocols/procedures

58
During the event

• People need to know how to protect themselves and
  others
• The drive to connect and reconnect is great plan
  on families and others coming to the scene
• Prepare for communication among crisis
  responders, develop plan for working with media,
  etc

59
After the critical event is resolved

• A catastrophic event is often the first of many
  crises that will be faced
• Recovery is a non-linear process that leads to a
  new normal
• Individuals will need to reconcile to a new
  worldview that accepts the awareness of
  vulnerability
• Connection, communication, and perceived
  intentions of others become acutely significant

60
Predictable Surprises

• Almost every disaster, incident of
  school/workplace violence and act of terrorism
  was preceded by warning signals.

61
Disaster Ready People for a Disaster Ready
America

• What Me Worry?
• I dont know what to do
• It will take too much time
• I cant afford it
• Whats the point

62
Disaster Due Diligence Newsletter
63
this countrys emergency management focus

• Tends toward response and recovery during and
  after a disaster.
•  
• Firestorm remains focused on establishing
  nation-wide readiness before disaster strikes.
•  
• Goal Build strong Disaster Ready People and
  Disaster Ready Businesses.

64
Firestorm Solutions, LLC.

• Firestorms Predict. Plan. Perform. model
  optimizes client outcomes in a disaster
• Predict. Vulnerability analysis and threat
  assessment
• Plan. Business continuity, pandemic, security
  and crisis communications planning
• Perform. Crisis management and mitigation

65
Unique Capabilities

• Unparalleled Knowledge Base
• In-house team of legal, risk management, human
  resources, technology, engineering, security and
  research professionals
• Expert Council
• Planning , Training Exercises
• Enterprise Risk Management (ERM), Business
  Continuity Plan (BCP), Continuity of Operations
  Plan (COOP), Emergency Response Plan, Disaster
  Recovery Plan, Crisis Communications Plan, Crisis
  Management Plan, Incident Red Flag Plan (identity
  Protection), Title IX DHS Certification,
  Security, Workplace Violence, and Pandemic Plan.
• Crisis Management Response Services
• 24/7 crisis response, including onsite deployment
  of crisis incident response team
• Threat assessment

66
Expert Council

• Brings subject matter knowledge and expertise to
  Firestorm clients
• Generates unique insights and develops the best
  solutions to complex problems
• Provides an independent perspective and produces
  faster, more accurate results
• Utilizes specialists from various disciplines,
  professions and industries

67
Disaster Due Diligence
A recent study of 1200 CFOs in 79 countries
indicated 62 of businesses with over 5
billion in revenue encountered a major risk
event 42 of these businesses were not prepared
68
Disaster Due Diligence

• If you had to respond now,
• are you ready?

Predict. Plan. Perform.
69
Questions and Answers