These are not the worst disasters you will see

2. 9/11. Katrina. Virginia Tech. The worst disaster you will see is the one that happens to you or your business These are not the worst disasters you will see

3. Every Crisis is a Human Crisis The success of your organization relies on the preparedness of people

4. Disaster Exposure Almost 2/3 of companies that suffered a disaster experienced lost business

5. Five Most Common Failures

6. Action Items Predict. Plan. Perform. • Identify & Involve • Critical Suppliers • Critical Functions • Critical Employees • What If Exercises • Establish How To: • Monitor • Communicate

7. Lessons Learned Virginia Tech was the definitive episode of Violence in the Workplace

8. Timing

9. Northern Illinois University

10. “Predictable Surprises” Almost every disaster, incident of school/workplace violence and act of terrorism was preceded by warning signals.

11. Crisis Management: First Response • Pastoral setting: • Physically-intact campus • Traumatized community • Media circus • 324 Media outlets • 140 Satellite trucks • $4 million by major network in first week

12. Crisis Communications Response • Transparency • Framing messages • Controlled accessibility • Established call center to broker access and provide information • Signage on campus buildings when classes resumed • Metrics • Timeline

13. Crisis Management: The Media

14. Timeline • Initial shootings in West Amber-Johnston Hall • Lovers’ triangle • Absence of students to interview • Immediate arrest of ‘suspect’ • Boyfriend left “in a hurry” • Guns found in truck • Norris Hall response • Nine minutes from entry to end of shootings

15. The First 24 Hours WRONG

16. Why We Discount Risk • Time alters our perception of risk • It can’t happen here. • It can’t happen to me. • It won’t be so bad. • I’m smarter and better prepared.

17. Disaster Denial “There cannot be a crisis next week. My schedule is already full.” Henry Kissinger

18. Why Continuity Planning? • Public Law 110-53, Title IX • Business environment at greater risk • Natural disasters • Pandemic threat • Terrorism • Economy at risk • Governance requirements • Disclosure issues • Regulatory guidelines • Sarbanes-Oxley • Looming litigation

19. Statistics of Failure 83% 20% 30% OF BUSINESSES WILL LOSE TOOF THEIR SHAREHOLDER VALUE IN 5 YEARS AS A RESULT OF A DISASTER OR CRISIS. OF CONTINUITY PLANS HAVE NEVER BEEN TESTED. DISASTERS OCCUR ANNUALLY IN THE U.S. OF BUSINESSES STRUCK BY A DISASTER NEVER REOPEN, AND OF THOSE THAT REOPEN CLOSE IN TWO YEARS. 80% 70,000+ 40% 25%

20. Opportunity Timeline Prepare and Plan Monitor and Take Action Manage and Mitigate Return to ‘Normal’ • Pre • IMMINENT • During • Recovery

21. Disaster Denial

22. Why Now? • Business environment is less forgiving • Risk management is usually internal, but external risks have not been addressed • Systemic risks have not been a focus – how to survive a major industry-wide event

23. Vulnerabilities Earthquakes Extreme Heat Fires Floods Global Warming Hazardous Materials Hurricanes Landslides Multi-Hazard Nuclear Pandemic Tornadoes Terrorism Power Outages Thunderstorms WildfiresWinter Storms Workplace Violence Dam Safety Earthquakes Tsunamis Fires Extreme Heat Floods Global Warming Hazardous MaterialsHurricanesNuclear Pandemic Terrorism Power Outages Landslides Wildfires Thunderstorms Tsunamis Volcanoes Winter Storms Earthquakes Fires Global Warming Landslides Tornadoes Floods Hurricanes Pandemic Power Outages Thunderstorms Terrorism Nuclear

24. Vulnerability Analysis Impact Awareness & Contingency Planning Corporate Governance & Preaction Plan Normal operations Certainty

25. The Disaster Environment DISASTER Stake holders Work & School Your Company/ Clients Customers Family & Friends Critical Suppliers Employees DISASTER

26. In/Out/Across Analysis

27. Liabilities

28. It’s More Than an IT Issue • Systems do not protect people • Servers cannot initiate action • Networks will not be held accountable • No people → No recovery Every Crisis is a Human Crisis. Every Crisis is a Human Crisis.

29. Rule 1, 2, 3 Disasters result in high absenteeism: Train 3 employees for each critical task

30. Crisis Communications

31. What Constitutes a Pandemic?

32. Modes of Transmission • Contact Transmission Direct Contact Indirect Contact • Droplet Transmission • Airborne Transmission P 1 P 2 P 1 P 3 P 1 P 2 P 2 P 1

33. Odyssey of SARS Transmission 3 hour Flight; Hong Kong to Beijing, March 15, 2003 18 Cases 4 Deaths Index Case Crew Member Probable Case

34. The 9/11 Commission “Preparedness is not a luxury; it is a cost of doing business.”

35. Update: What’s Changed • Public Law 110-53, Title IX • Situation in Mexico • Bio-terrorism • Workplace Violence

36. Public Law 110-53, Title IX In the “Implementing the Recommendations of the 9/11 Commission Act of 2007” (the 9/11 Act), Congress mandated the Department of Homeland Security (DHS) to provide “voluntary”preparedness certification and “develop guidance or recommendations and identify best practices to assist or foster action by the private sector” across a wide range of business continuity practices.

37. Mexico: Will the Violence Spill Over to the U.S? U.S. security no match for Mexican drug cartels The Obama administration announced this week it is sending hundreds of federal agents and crime-fighting equipment to the Mexican border to try to make sure violence from Mexican drug cartels doesn't spill over into the U.S. –CNN, March 27,2009

38. Bio-Terrorism Bio-terrorism – Al Qaida and the Plague The story began with a Jan. 6 report in the Algerian newspaper Echorouk that a number of terrorists had died of the plague in one of al-Qaida training camps in TiziOuzou. Another Algerian newspaper En-Nahar, affirmed that 50 terrorists have been diagnosed with the plague, 40 of whom have already died.

39. Workplace Violence: On the Rise? • Businesses are bracing for more crimes committed by both external and internal perpetrators in a rough economy: • The worry is that poor market conditions will result in more burglaries, and • Company layoffs could increase cases of embezzlement, theft and workplace violence by disgruntled workers • Domestic violence is moving to the workplace

40. What Constitutes Workplace Violence? Any physical assault, threatening behavior, or verbal abuse occurring the work setting. It includes, but is not limited to: • Psychological • Intimidating presence • Harassment (being followed, sworn at, or shouted at) • Obscene phone calls • Threats • Physical • Beatings • Rapes • Shootings • Stabbings • Suicides

41. Current Environment • 70% of workplaces have no formal workplace violence program, despite findings that there are thousands threats of violence every workday • 43% of those threatened and 24% of those attacked at work do not report the incident • Workplace violence myth: most incidents come out of the blue. • “These incidents don’t just happen spontaneously. People work through a process—there is a pathway that people will pursue toward ultimately committing violence.“ Source: JohnLane, VP of Crisis and Security Consulting Control Risks ASIS 54th Seminar, 2008

42. OSHA & STATE STATUTES • A collection of negligence theories, including negligent hiring (the failure to properly screen job applicants, particularly for sensitive positions involving a high degree of interaction with the public); negligent supervision (the failure to supervise employees and to discipline violators of anti-violence rules) • Negligent retention (the failure to terminate employees who have engaged in behavior in violation of company policies). • Premises liability (the duty of a property owner to take responsible steps to guard against reasonably foreseeable violence) • Respondeat superior (an employer’s indirect liability for the wrongful acts of an employee committed within the course and scope of employment) • Sexual and other forms of harassment prohibited under discrimination laws (when threats or violence are motivated by a victim’s protected status); and • Employer owes a ‘‘general duty’’ to protect employees against ‘‘recognized hazards’’ that are likely to cause serious injury or death. Workplace violence has been identified as one of those hazards, and both federal and state OSHA agencies have issued citations to employers under the Act’s general duty clause for failure to protect employees against workplace violence • Employer’s obligation to maintain a safe place to work also arises from the legal principles that exist in most states under common law. Legal principles most commonly discussed in litigated cases involving workplace violence include:

43. Company Responsibility OSHA • section 5(a)(1) of the OSH Act, often referred to as the General Duty Clause, requires employers to "furnish to each of their employees employment and a place of employment which are free from recognized hazards that are causing or are likely to cause death or serious physical harm to his employees". • section 5(a)(2) requires employers to "comply with occupational safety and health standards promulgated under this Act".

44. Background Statistics • 1970’s-present: incidents of workplace violence have tripled • Major contributors include: • Aggressive employees • Domestic violence brought into the workplace • Employers not taking recurring threats seriously • Ethnic differences among workers • Negligent hiring, supervision, or retention of aggressive employees • Substance abuse L • Layoffs and company downsizing • Poor handling of employee termination • Estimated cost to business $120 billion

45. Actions • Recognize behavior • What to do/who to call • How to deal with potentially violent individuals • Individual responsibility in following procedures; • Get to cover • Flee • Defend yourself • Utilize available communications • Procedures training • Front desk, reception, panic alarm training • Practice all protocols/procedures

46. During the event • People need to know how to protect themselves and others • The drive to connect and reconnect is great; plan on families and others coming to the scene • Prepare for communication among crisis responders, develop plan for working with media, etc

47. After the critical event is resolved • A catastrophic event is often the first of many crises that will be faced • Recovery is a non-linear process that leads to a new normal • Individuals will need to reconcile to a new worldview that accepts the awareness of vulnerability • Connection, communication, and perceived intentions of others become acutely significant

48. “Predictable Surprises” Almost every disaster, incident of school/workplace violence and act of terrorism was preceded by warning signals.

49. Disaster Ready People for a Disaster Ready America What Me Worry? • I don’t know what to do • It will take too much time • I can’t afford it • What’s the point

50. Disaster Due Diligence Newsletter