Implementing an Effective Crisis Management & Recovery Plan “The Monash University Experience”

1. Implementing an Effective Crisis Management & Recovery Plan “The Monash University Experience” Prepared & presented by Russell Gammie, Monash University Security Manager & Crisis Team Coordinator to TEFMA Workshop QUT Gardens Point, 23 June 2008

2. Crisis Management & Recovery Planning – The Monash Experience An Overview • What is a CMR Plan & why is it necessary? • Essential elements for implementing the CMR Plan • Monash University’s approach to CMR planning • The plan in action - “October 2002 campus shooting” • Lessons learned • Where to from here at Monash

3. Why CMRP is important? • Good Corporate Governance • Business Success & Continuity • Common Law ‘Duty of Care’ (Civil Actions)Various State Legislation (Acts/Regs) • OHS, Dangerous Goods, Building Control Act, • Crimes Act (Conduct endangering life (negligently) • Australian Standards 3745/2002 • Provide leadership/inspire confidence/coordinated responses • How surprised do you really want to be? Crisis Management & Recovery Planning – The Monash Experience

4. Important Definitions • Crisis- is an adverse incident, or series of events that have the potential to seriously damage an organisation’s people, operations and/or reputation • Crisis Management is the development of a system to minimise the impact of a crisis on an organisations people, operations and/or reputation and to assist an organisation to recover from such an event • Emergency- is a sudden, unexpected event that requires an immediate response from internal or external emergency services • Emergency Management – the development of an effective incident response system focused on controlling the event • Evacuation Plans • OHS Procedures • Standard Operating Procedures Crisis Management & Recovery Planning – The Monash Experience

5. Misconceptions on crisis management!! Most organisational crises result from natural events (storms etc.) or from industrial accidents (fires, explosions etc.) which occur suddenly. • 75% of organisational crises are caused by management actions and slow-burning events such as fraud, executive dismissal, sexual harassment, misleading advertising etc The nature of organisational crises has remained relatively constant over time. • There has been a dramatic increase over the last 10 years in the number of organisational crises precipitated by class action lawsuits, sexual harassment and fraud. Heavy manufacturing is the most crisis prone industry Banking, stockbroking and insurance industries top the list of industries that have experienced the most crises over the last decade Crisis Management & Recovery Planning – The Monash Experience

6. Human resource management • enterprise bargaining disputes • unfair dismissals/litigation • Personnel • loss of key personnel • industrial relations • theft, misappropriation • Operational • Poor service delivery • Unsafe practices • planning and scheduling conflicts • Resource failure • Financial • audit risk • bad debts • cash/fund management shortfall • exchange rate movements • fines/judgment orders • fraud • inaccurate accounting and/or reporting • inadequate costing systems (leading to unsustainable pricing) • inadequate insurance • inventory risks • negligence • utilities interruption • Disasters which affect senior and key staff • accidents (for example, building, vehicle, aeroplane, train) Crisis Management & Recovery Planning – The Monash Experience

7. Natural and man-made disaster • arson • attack by deranged persons • community exposure to pollution • electrical 'spikes' • epidemic • espionage • fire • flooding • industrial accidents • lightning strikes • power cuts • sabotage/vandalism • staff exposure to long-term hazards and pollution • water cuts • Political • changes in government • community expectations • legislative changes • Economic cycle/marketing • competition • undetected changes in market/customer demands • Contractual/legal • breach of contract • director and officer liability • errors and omissions • limitation of liability • product liability • public liability • statutory breaches • Business activity by-products • client service • computer breakdown • contingency planning/business resumption • occupational injury, illness, physical security, property loss Crisis Management & Recovery Planning – The Monash Experience

8. Benefits of CMR Planning Preparedness Recovery • Individual & group CMR responsibilities • Resources available • Communications • Action Plans • Known Model • Internal/External Confidence Crisis Management & Recovery Planning – The Monash Experience

9. Evolution of Crisis Management Planning at Monash • Initially identified during Y2K risk management planning projects. • Received strong support at VC, DVC and VCG. • Proposal to develop & implement a University wide CMRP presented University Council in June 2001. • Unanimous support (particularly from council members with banking and finance experience). • A&RM Office developed a project plan and tenders were sought from external experts in this area to co-source the project. Crisis Management & Recovery Planning – The Monash Experience

10. Obtaining the ‘buy-in’ of senior management • Engage ‘most senior’ university staff • Enlist direct participation • Risk identification/minimisation • Training Their direct interest and action effects the strength of the CMR planning and outcomes Crisis Management & Recovery Planning – The Monash Experience

11. Monash University’s approach to CMR planning • Established a CMR management model • Developed communication protocols • Created CMR Teams all campuses • Identified and resourced CMR facilities/equipment • CMR Manual • Risk Analysis and Mitigation plans • Action plan for threats and responses • Crisis classification • Mobilisation • Maintaining currency/adequacy of CMR arrangements • Training • Testing Crisis Management & Recovery Planning – The Monash Experience

12. CMR Team Berwick CMR Team Caulfield CMR Team Gippsland CMR Team Parkville CMR Team Peninsula CMR Team Malaysia CMR Team South Africa CMR Team Team Leader Crisis Team Coordinator Emergency Services Coordinator OHSE Coordinator Business Recovery/Support Services Coordinator Support Group Coordinator IT/Control Room Coordinator Switchboard/Call Centre Coordinator Human Resources Coordinator Public Spokesperson Media Coordinator/Internal Communications Coordinator Internal Communications Coordinator Advisor to Crisis Team

13. CMR Manual • Hard copy & On-Line • Contacts • Nominated CMR facilities • Crisis Classifications • Mobilisation Process • Team Roles • Threats and Responses • Communication Strategy • Recovery Strategy • Associated Forms Crisis Management & Recovery Planning – The Monash Experience

14. Annual CMR Program • CMR Program assigned to Security • CMR Program Coordinator (full time) • Operational Budget $60K • Maintain currency • Training all campuses • Exercise all campuses • Audits • Each campus • Program audit to university council Crisis Management & Recovery Planning – The Monash Experience

15. Two shot dead, five wounded at Monash UniThe Melbourne AgeOctober 21 2002 · Two shot dead in tutorial room· Two students crash tackle gunman· Shooter of Asian appearance, armed with handguns· Dead both of Asian appearance· Classes cancelled· Police make arrest· Helpline phone numbers: 03 9545 6961 and 03 9545 6579 Two people are dead and five injured after a man armed with a number of handguns opened fire on a room of students at Monash University's Clayton campus today. Police say the man, aged in his mid-30s, was tackled by several people in the room. Crisis Management & Recovery Planning – The Monash Experience

16. The October 2002 shooting on Clayton campus • At approximately 11am on 21 October 2002, a fourth year honours student armed with a number of handguns opened fire on his classmates in an econometrics tutorial room on the 6th floor of the Robert Menzies Building at Clayton Campus. • Two students died instantly in the attack and another 5 people were wounded before staff and students in the room disarmed the gunman. • It was estimated that there were approximately 2000 people in the Menzies Building at the time of the shootings. • Three of the wounded students fled the building and ran into the adjacent Student Centre building to seek medical attention. Crisis Management & Recovery Planning – The Monash Experience

17. The October 2002 shooting on Clayton campus (continued) • Within 10 minutes of the shootings the Vice-Chancellor mobilised the Corporate CMR Team. • Police and the media already on campus. • The Police established their crisis command centre at the crime scene and sealed off the Menzies Building. • Police liaison with CMR Team established. • Perpetrator arrested, injured removed my emergency services, no access to crime scene. • Responsibility for managing the rest of the University’s people, operations and reputation lay squarely with the Corporate Crisis Team over several days. • Recovery lasting over many months. Crisis Management & Recovery Planning – The Monash Experience

18. Lessons learnt • Any plan is better than no plan • Ensuring the CMR Team is intimate with the University’s CMR arrangements. • The need for back up contingencies • Enormous number of decisions/actions during and after crisis. (Beyond the capacity of one person). • Huge number of internal & external stakeholders. • Crisis plans need to be tested regularly and where relevant, emergency services personnel invited to attend as observers at crisis simulations • Plans can quickly become out of date Crisis Management & Recovery Planning – The Monash Experience

19. Lessons learnt (continued) • Crisis control room requires essential communication and support resources. • Plan must be available to key Operational areas such as, IT, switchboard, student counseling, security, marketing etc. • Need to establish an effective message strategy at the earliest • Establish effective communication channels with Police/others. • VC should have the public spokesperson role on the crisis team with a senior DVC having the team leader role • All decisions of the crisis team should be logged Crisis Management & Recovery Planning – The Monash Experience

20. Russell Gammie • Monash University • (03) 9905 1316 • Russell.gammie@adm.monash.edu.au