CSO Podcast Transcript: Business Continuity and Disaster Recovery Planning with James Lee Witt
CSO Podcast Transcript: Business Continuity and Disaster Recovery Planning with James Lee Witt
The National Oceanographic Atmospheric Administration predicts an active hurricane season this year. CSO talks with James Lee Witt, CEO of James Lee Witt and Associates and former FEMA director, under President Clinton. The renowned disaster management expert (he oversaw more than 350 disasters during his FEMA tenure) speaks with CSO about how businesses should prepare for hurricanes and other disasters, and tells why no company can afford to be without a business continuity plan.
Interviewed by Diann Daniel — June 15, 2006
Click here to listen to the podcast
Diann Daniel: Hello and welcome to Business Continuity and Disaster Recovery Planning, a conversation with James Lee Witt. I'm your host, Diann Daniel, Senior Copy Editor at CSO Magazine. Hurricane season began June 1st and runs through November 30th, and the NOAA predicts a very active season. I spoke with Witt about how businesses should prepare for hurricanes and other disasters, and whether anyone's exempt from planning. Witt has over 25 years of disaster management experience, and was appointed Director of FEMA in 1993 by President Clinton. He served as Director until 2001. Witt is currently CEO and Chairman of James Lee Witt Associates, where he provides disaster recovery and mitigation management services to states and local governments, educational institutions, the international community, and corporations.
Diann Daniel: Hurricane season is upon us, and I'm curious what business executives and particularly security executives should be doing to prepare.
James Lee Witt: The first thing I would recommend doing is to make sure that you have the insurance coverage that you need, whether it's for wind or whether it's flood insurance if your business is in a 100-year flood plain. Second, I would make sure that every single employee within my business understood that if we had to evacuate, where would we go, where would we reconvene our business so that we could continue to operate. Then, make sure that I had the capability to send out alert notifications or warnings to all my employees, particularly if it was on a weekend or if employees were traveling, and with a message of what was going on, what they needed to do.
What would you propose that system would be?
There's several different systems out there. I would look at the one that would not only potentially give voice data but also information data. A lot of times you can do it through a software program on your computer. Some programs you could do it over cell phones. I would look at the different technologies that suited my company the best and work on that. We tend to forget that every dollar we invest in prevention or preparedness could potentially save you three to five dollars in future losses, but the business interruption side of it, it could be even higher than that. I would also check with any of my suppliers that would be in a position of not being able to make those deliveries. I would make sure that any of my customers, suppliers, all understood what my plan was, what I would need to do, how I would do it, and then ask for them do likewise to make sure that the supply chain wasn't broken.
Hearing you say it like this, it sounds like a very simple thing, but communication can be very difficult. Do you have any tips on making that communication easier and more readily available?
I think the best thing to do, first of all, is to develop your business continuity plan, and make sure that every person within that business understands it and is trained on it, so that you have that database set up, you have that information set up, and you have the people trained to be able to implement that plan if it's needed. Then you can utilize the technology to be able to help with the implementation plan. Then I would exercise that plan. I know we're in hurricane season but it's still not too late to start planning.
Why do you think that there are still businesses that don't do that, or people who aren't preparing even though they live in areas where this is of concern?
You know, it's interesting. Some of the corporations that we work for, and what concerns me so much, is that the lower management level and staff level really want to do something to really put in place so that their livelihood as well as their jobs and business will still be there and still working. The biggest problem that I have seen so far is getting the buy-in and the support from the upper management level, because when you're in business, time is of the essence, and every day is full of meetings and conference calls, and this is one of the most important things that a CEO or a manager can do to help make sure that their business is still there and is still running and the jobs are still there for the employees and their families. Back when I was Director of FEMA, we did a survey of small businesses after disasters, and we found that 20 to 25 percent of those businesses that were affected by a catastrophic event never reopened. You lost your tax base, you lost jobs, and then five years later, some of these businesses went as high as 65 percent that never made it after a disaster.
Those are some concrete numbers. Why wouldn't CEOs be paying attention to this and getting their disaster recovery plans in place?
Some have and some have hired risk managers, but not all. I think it's really important that if you are a business, and if you supply a service or a product, it's really important that you put in place the planning effort and the training effort and the exercising effort to be able to maintain consistency and to maintain a viable business if something does happen. I've seen it so many times. When Katrina really hit Louisiana, one of the big law firms there, they had an office in Baton Rouge, and their plan was to move everyone to Baton Rouge. They did, and they found out that first of all, they did not have enough IT support for it; they did not have enough room to support all the other employees coming in there; and it was a terrible, terrible situation for them.
It's important to deal with planning now, whether it's in a earthquake-risk state or a hurricane-risk state. Discovery Channel has hired us to look at their emergency planning and business continuity planning for all of their offices, which is huge. They see that need to be in business, they need to still be up and running in 80 countries. Even the bricklayer's union, we did a business continuity plan for them. Back during Hurricane Fran in North Carolina, GE has a plant there. They had gone in and retrofitted their plant for hurricane resistance, and after the hurricane went through, their plant was still OK, but there was no employees to come back to work the next two days because they were taking care of their families and their home. Anheuser-Busch in California, in Pasadena, before the Northridge earthquake, spent 25 million dollars to retrofit their plant for an earthquake, and they were back open and operating two days after the earthquake making canned water for victims in the community. They said that 25 million probably saved them 150 million. There's a lot of different ways you can approach this, but I think the most important thing is to sit down and to look at your risk and develop a plan in not only how to minimize that risk, but a plan of operations after an event.
It sounds like from some of the things that you're saying that it's really important to make that plan as concrete as possible. You have enough accommodations for people if that's what you've decided to do, for example. Can you recommend to listeners particular questions that they might ask themselves as they're sitting down to make these disaster recovery plans?
The most important thing that they can ask is What is our risk? Is it from hurricanes or is it from floods? Is it the storm surge or is it the wind? And then the most important thing, What have we done to protect our company against those perils? Then you develop an employee plan with that continuity plan, so that employees will know what to do after an event, or before an event. The most important thing, I've suggested this many times, is that every business should make sure that they help their employees to develop a family plan for their families, because if they know their family is safe and they know there's a plan in place for their family...There's many times you'll see employees at work, you'll see the children at school, and what if there is an event that you're separated? What do you do? The family plan, you can reach out and say, OK, we developed a plan. If you're at school, we're at work, and there's an event, we're separated, call Aunt Bessie in Michigan, so everybody will have a contact place that they can call to know that they're OK and where they're at, potentially if you're evacuated and get separated, which happened in Katrina. Some of those families were, just in the last few months, were reunited. An employer helps its employees to develop a family plan.
If you have a catastrophic event and you need to go back in to check your business, you need to work with your local government's fire, emergency management, police, and you need to meet with the fire chief, the police chief, and you say, "OK, here's our plan. Now, then, can we get credentials to allow us back in here to check on our company and our business?"
What does that mean exactly?
If you have a credential, a badge, that would, because a lot of times if an event happens and they cordon off and close the streets and won't allow you in, if you have a credential or a badge that you've put together with the fire and the police and emergency management, then after it's safe to go back in, you can go back in and check on your business and help maybe get it up and running again. It's very important. Chicago has done this. It's called Chicago First. It's building that public-private partnership with public safety and emergency management and the corporations and businesses.
Do you think that there's any difference between the approach that perhaps small businesses take to disaster recovery, and large businesses? Do you think one versus the other is better at this, or more aware?
I think it's probably a mix. I think some of the small businesses that's been through these events understand it and some of the bigger companies that's been through an event would understand it more, but I've had people over the years say, we're not going to be hit by any type of thing, and lo and behold, they do get hit. It's really important to do that planning and that mitigating before something does happen, because it'll not only help save your business and employees and save lives, it'll be very rewarding in the outcome of it.
I would think that it even can help make the workforce more cohesive, just knowing that those plans are out there.
You know what else it would do? If you do this and you do the training and you exercise your plan, it will build a closer teamwork within the company. I've seen it. It's amazing what it will do. It'll even, particularly in a larger company, it'll bring people together that normally don't even associate. It builds relationships; it builds a team effort. We went into one company that was a pretty large company, and meet with them, and they wanted to look at developing an emergency plan and a business continuity plan and a security plan. What was interesting, we went in, there was no security coordinator. We sat down with the upper managers, supervisors, and said, "Well, what kind of plan have you got in place now?" And one of the supervisors said, "Well, we had a kind of an exercise, but I had my assistant Bill sit in my place." That won't get it. You've got to participate in it so that you'll know what to do. Every company, particularly from the CEO down into upper management needs to have a relocation plan. Then they need to participate in making sure that, because they are the leaders of the company, they need to know what they're doing because if you don't, then CNN sticks a microphone in front of you and says, "Well, what did you do, what happened here?" You need to know. You need to understand it and plan for it.
Do you have any thoughts on risk assessment of different businesses or different even departments within a business as needing a disaster recovery plan? Do you think that some departments or companies absolutely need this and some can get away without having it, or at least paying as much attention to it?
The thing of it is, the risk that we face today, whether it's a terrorist risk or whether it's a natural hazard, you can plan and prepare for an all-hazard concept, which I would suggest. Knowing what risk you have, whether it's hurricane or floods or other natural disasters or tornadoes, whatever it may be, it's important to gather the information that you would need to put together something that would fit each company or a business, depending on the size and the amount of the employees you have, which you can do. There's all kinds of information but there's also people that's available to do it for you and help you through it. We worked with PEPCO Connective Power Company, and when Isabel came through, they were getting beat up really bad about their services to get power back on and so forth. We worked with them, looked at their company from inside out all the way from New Jersey to Washington, D.C., and made a hundred and something recommendations of things that they needed to implement to provide better services to their customers, met with their board and their CEO. They implemented those recommendations, and they are far better prepared today, and they're proud of it. We did training and exercise and evaluated it for them, and they're ranked right up there in the top of the best-prepared utility companies now.
What does some of that training and exercises look like?
First of all, we took the recommendations and we helped them in their operations center, helping to design and fulfill the roles and responsibilities of each of those positions, whether it was staffing up for answering calls from customers coming in about power outages, to responding with utilizing communications to other power companies coming in to help put power back up.
So literally practicing some of these things?
Absolutely. Develop a scenario, OK, we've got this happening, we got 20,000 customers out of power, how are we going to get them back on? And you go through that process, who makes the decision to do what. You train them and you exercise them on this.
Do you see a difference, or have you seen a difference, between companies where maybe the disaster recovery plan is a bit more abstract, like if this happens, this is what we'll do, maybe just people talk about it versus the actual carrying out as if it were happening in real life?
I think probably the state of Illinois, in Chicago probably, has developed the best private-public partner concept, particularly Chicago First working with the city and private sector. They have done the credentialing, they have brought the private sector in to the table, they sat them down and just really developed a very good concept of how they both could help each other. I think it's important. What are you going to do if you need ice? What are you going to do if you need water? What are you going to do if you need a generator? Just all the kind of things that might help you get through the first five days. That's all part of that planning process.
But those are very concrete things, ice, generator, I mean, the generator one seems pretty obvious but there might be things that a person or a business would need in those first few days that they hadn't thought about. What would you recommend to them, how to think about this so that they do come up with these concrete things that they might need?
I would look at what resources and capability do I have within the company, and then I would look at what resources I would need to help my company to survive outside of the company. Then, if I needed to, I would look at having pre-event contracts set up to provide those resources and capability to my company and employees. The thing of it is, you can do a pre-event contract, you can take bids on it or you can take companies that you're associated with and partner with them, but you can do a pre-event contract that does not cost you anything until you use the service. Then I would work with the state or local government that my company was in, and I would say, here's my plan, here are the resources that we have, that we would have even available to help if we survive an event, but here's the type of resources that we may need to maintain our company and its employees, and these are the pre-event contracts we've put in place. I would partner with them and make sure that it was consistent with their plan, as well, particularly evacuation planning.
I met with the western governors in Phoenix a few months ago, and the governors said, what should we plan on doing? I said the first thing you should do, you should look at every state agency, your National Guard, and you need to make sure that you have the resource capability within your state, and if you don't you should do the pre-event contracts to be able to provide those other resources. I think it's going to be important that we all look at that in this world today, because you cannot always rely on the Federal government to supply all that capability.
What advice would you give to CSOs or security executives in general: If the CEO or the board is not paying attention to disaster recovery or perhaps think they are in an area where they don't need to worry about it, what should the CSO or security executive say to those people to help them understand or help them change their minds, that yes, we do need this?
I would get a very credible source that had a credibility to sit down with them and say, look, here are your risks, this is what you've done to minimize that risk, here's some things that could probably help you. I would do my very best to ask for an outside independent review of what you have in place and what capability you have, and then go from there. It's really important that our businesses across the country do this and plan for it. It's so important. The business community is our jobs, they're our tax base. It's everything that supports a community.
Look at Louisiana. The parishes down there, Saint Bernard Parish, I was down there not long ago, they have a 70,000 population. They had one drugstore open, and they only had five businesses, and it's been nine months. It's really important. It doesn't make any difference if you don't feel like you're not in a high-risk area, but it's really important. Even if power went off, it's important that you have a plan that would address that. What happened, I think it was in Des Moines, Iowa in the '93 flood, the water treatment plant got inundated with flood water. When it got inundated with flood water, they had to shut the sewer treatment plant down. We had to provide 200, I think it was 250 port-a-potties, we had to provide water and ice, and the business communities shut down and I think it was, they said it cost, that community shut down, for the time period it was, it cost 250 million dollars in revenue. It may be a small thing that can create a very large economic loss for our business.
It's just really important to identify that risk or potential risk and then develop something that you can implement to minimize the effectiveness on your company. Then you get into the security side of it. If technology and communications capability and having a database set up that would help you through an event, particularly if it was a security risk, is very important. One of the things that we've been doing and have done working with Global Options Group in New York, we've been able to combine four different companies that they have acquired, us too, and to provide a more comprehensive service that is not only for the Fortune 1000 corporations but it also includes emergency preparedness recovery, crisis management, security consulting, business intelligence, all the things that we feel like it's going to be important for companies not only here but around the world. There's a lot of capability out there and I would just encourage every single business and company to look at this, because it can happen. Look at how many stores Wal-Mart in Louisiana that were affected. Wal-Mart hired a Director of Emergency Management and a risk manager for Wal-Mart just to do that, and Wal-Mart had their act together and they were actually providing resources to the state.
As far as hurricanes go, since we are in hurricane season, what besides the communication and insurance are specific things that people need to think about that they might not know?
I think one of the things that's important is that, know who you can depend on, not only within the company but outside the company. That's why I said that it's really important that you know who your police and fire chief or sheriff or emergency management director within the community that you live and work and have a business in. It's important that you partner with them, absolutely critical. You'd be amazed at how many of them would welcome the opportunity to work with the private sector to be able to do that. Basically, if you can take care of yourself and your employees, then it's not a burden on the response capability.
So would you say this even for, say, a small restaurant or a little boutique or a medium-sized business? Does it not matter what you're talking about, any business?
It doesn't. It should be any business, it shouldn't make any difference if it's one employee or 100 employees or 1,000, they need to plan to minimize and mitigate any potential risk that they may have.
And identify, depending on region of the country or even if you're talking to specifically hurricane, what your specific risks are.
Absolutely.
Thank you so much for joining me today.
All right, well I appreciate it.
|
