Everyone knew it was coming. Weather forecasters and hurricane experts had predicted it for more than two weeks. A potentially catastrophic storm would hit islands in the Caribbean and there was little doubt that Puerto Rico would be among the hardest hit. And yet, it appeared that the island was ill prepared for the damage Hurricane Maria would inflict on Puerto Rico, its inhabitants and the critical infrastructure. Since they were warned of its approach, how could that be?
“You can’t prepare for a storm of that magnitude in two weeks,” explains Pinkerton Director Sam Stone. “You need to anticipate the potential of a storm and have a plan of action that you can then implement when required. And the main problem was too many businesses didn’t anticipate the possibility of a storm like Maria.”
A response plan is proactive
Puerto Rico is a prime, and current, example of what happens when critical infrastructure fails and there is no advance preparation. Systems break down. The reliability of having clean water, electricity, operational medical equipment, passable roads and available air travel is severely compromised. Unfortunately, it becomes very clear how many different ways people and businesses that are not prepared for such a catastrophe can be affected.
“Unfortunately, many companies did not have a disaster response plan in place,” says Stone. “And even if they did, they didn’t consider a situation where infrastructure would be impacted for weeks instead of hours or days. Getting gasoline to keep generators up and running became a major issue for companies with brick and mortar operations. Other issues stemmed from travel security, communications, and the inability to evacuate. Firms that didn’t have additional protection in place hours or days prior to the storm hitting were exposed.”
Though the name implies a reaction to a situation, a Disaster Response Plan actually is one that anticipates many scenarios that could severely impact a company’s operation. “Knowing what to do and when, training people on the plan, having the appropriate contracts in place, and being able to deploy resources quickly are critical components when internal and external infrastructure goes down” advises Stone.
Ad hoc reactions to disasters
“Whether it’s a natural disaster or a man-made situation, like an active shooter, anticipating the business impact and planning for contingencies makes a big difference,” Stone says. “In the case of a power outage, what is the company’s communication plan and does the company have resources it can deploy to help protect people and property? For example, if cell towers are ineffective, what resources does the company have in place to communicate to personnel? Is the plan tailored to the site and its unique geography and infrastructure? Are company personnel on the ground knowledgeable and empowered to execute communication contingency plans?”
As many companies found out during this year’s hurricane season, not knowing the answers to these basic questions can leave employees and assets at risk.
“A lot of the planning seemed to be ad hoc, just based on the current situation,” says Stone. “While Maria was unprecedented for Puerto Rico, companies that had a risk-based disaster response plan fared better than those who didn’t. And many didn’t take heed of past experiences to learn and prepare.”
Learning from the past
There may be no better example from the past that could have aided Florida, Texas and Puerto Rico in preparing for Hurricanes Harvey, Irma and Maria than the devastation, and loss of infrastructure, witnessed as a result of Hurricane Katrina in 2005. New Orleans and much of Southern Louisiana was crippled by the huge storm that knocked out power, damaged buildings, flooded entire neighborhoods and was one of the costliest natural disasters to ever hit the United States. “There was a lot to learn from Katrina and many companies in that region took those lessons to heart, putting in place plans to mitigate risks if a storm like that ever hit again,” says Stone.
Just weeks after Hurricane Katrina, Texas was faced with responding to Hurricane Rita. Texas government officials were proactive and issued an evacuation order. While that action anticipated the devastation the storm would bring, it did not take into account a new threat which came to fruition from massive scale gridlocked traffic.
When hurricane Harvey hit in Houston, local authorities seemed to take the wrong lesson from their experiences with Rita and an official evacuation order was not given. However, that resulted in many people staying in their homes and businesses, overwhelming rescue operations. A safer option would have been to evacuate based on a well-planned and anticipated route minimizing the potential for traffic congestion.
With Katrina, Rita and other storms in mind, a comprehensive disaster response plan would have incorporated lessons learned from previous disasters.
Financial concerns impact infrastructure protection planning
One might wonder after so many examples of devastating storms, terrorist attacks, and other incidents that impact infrastructure, why more companies are not better prepared. “In many cases, companies would prefer to accept the risk of a man-made or natural disaster instead of investing in emergency and security programs,” says Stone. “This is a short-sighted view of risk. Many times, it is costlier for a firm to incur harm from a foreseeable threat than it is to invest in emergency and security measures. But America is a litigious society and we are seeing more and more lawsuits that result from ineffective or non-existent security, even in cases of terrorism and mass shootings.”
As we noted in our last blog post “The Interconnectivity of Business Risk & the Impacts”, using a holistic approach to risk management allows companies to consider a lot more potential scenarios and create workable plans to mitigate those risks. Our newly updated Risk Wheel separates risks into four quadrants and then goes a level further by breaking those quadrants into nodes. In the case of hurricanes, they fall into the Hazard and Event Risks quadrant where Natural Disasters are a node. But looking at the Risk Wheel, one can see how a hurricane could impact several other quadrants and nodes, such as Operational and Physical Risks/Business Continuity and Technology and Information Risks/System Integrity. For companies in the path of Harvey, Maria and other hurricanes, these nodes were almost certainly impacted. For many, especially in Puerto Rico, they still are.
For companies in today’s connected world, being without key infrastructure for even a day can have a big impact. Stretch that out to several days, weeks and even months and the impact multiplies. Anticipating scenarios in which this could happen and creating a response plan that allocates resources can give companies the best chance for avoiding costs and recovering quickly when disaster hits. Let’s hope the events of the recent past can help companies mitigate the loss of life, assets, and resources in the future.
