Over the past several years, many businesses have experienced an increasing number of threats to their ability to continue operations, weather an emergency, and remain profitable. From the unprecedented shutdowns during COVID-19 to natural disasters like hurricanes and wildfires to manmade threats like social unrest and cybercrime, businesses need a clear and effective emergency plan that will allow for continuity with minimal disruption.

While many organizations embrace the importance of having an emergency plan, they often too quickly dive head-first into formulating it. Believing that they know their organization well, they often forgo an essential preplanning step — the assessment of their current situation and the discovery process that identifies major risks, any gaps in preparedness, and all the resources available for an emergency response. This assessment is necessary to create a realistic and effective plan that is simple enough to execute well. 

Without an assessment, it sometimes seems easiest to start building a plan from someone else’s template. However, using a template that may not quite fit the nature and mission of your organization or the types of risk it faces is a recipe for creating something that looks good on paper but is not helpful on the ground when disaster strikes.

A proper discovery process is essential for a robust emergency plan

The most effective approach to emergency planning starts with an assessment that allows the organization's decision-makers to understand the business's current situation. The assessment examines the risks, resources, and external stakeholders around which the emergency plan should be formulated. Without this step, developing a realistic emergency plan that can be successfully implemented in an unfolding emergency is virtually impossible. 

A good starting point for the assessment is identifying significant risks and understanding their potential impact on your organization. Potential risks can be broadly put into the following buckets:

• Risks dictated by the geographic location of your premises: Is your organization situated in a place likely to be hit by a Nor’easter or a hurricane? Is there a significant chance of flooding? What about earthquakes?
• Risks dictated by the nature of your operations: Are there flammable chemicals on the premises? Do your operations require toxic materials or generate toxic waste that will significantly damage human health or the environment if a spill occurs? Is your business heavily reliant on either raw materials or sales to foreign countries and therefore has exposure to geopolitical risks (like, for example, embargoes or punitive tariffs)? 
• Risks due to reliance on third parties: Is your business susceptible to supply-chain interruptions, sudden price fluctuations in raw materials, or transportation disruptions?
• Risks relating to physical security: Is there a likelihood that an active shooter will disrupt your operations? Is there a likelihood of having to contend with other manmade physical threats with the potential of serious harm, such as significant theft, vandalism, or rioting that prevents your workforce from reaching your premises? 
• Risks relating to cybersecurity: How will your operations be impacted if your whole network is shut down by ransomware? Or if you have a significant data breach and theft of confidential business information — or employee and/or customer sensitive information?
• Reputational/brand risks: What happens if there is a safety recall? Or if there’s a growing number of negative reviews for a newly launched bet-the-company product or service?

Next, consider the organization’s resources. Creating an inventory of all your resources before formulating an emergency plan helps reduce the tendency for magical thinking, where the same resource is available for multiple functions. It also helps identify gaps in preparedness, allowing the organization to address them before they become a catastrophic failure during an emergency.

Some of the resources you may already have are:

• People. What expertise do you have on-hand to handle the potential emergencies identified in the step above? Who can take the lead in crisis communications? Who can be responsible for reaching out and coordinating with emergency services? Who will hold down the fort on the operational side while the emergency is handled?
• Time. How long can operations be disrupted without catastrophic consequences? For example, can your plant shut down for two weeks without losing customers?
• Money. How much damage can be mitigated by the reserves you have on hand or by the insurance already purchased? Is it prudent to buy additional insurance, or are some aspects of the business over-insured and the resources can be used differently?
• Physical equipment. Anything that can be used in the type of emergency identified in the step above should be included in this inventory – anything from buses to ladders.

Finally, consider the external stakeholders who can either help your organization in the emergency, take advantage of the emergency for their own benefit, or be impacted by the emergency themselves. While emergency services and FEMA are obvious entries on this list, others to consider include:

• Banks or other financial institutions holding a loan to your organization.
• Supply-chain participants, from vendors to transportation companies to your organization’s agents and sellers.
• Competitors who can benefit from your organization’s downtime. 
• Companies who can mitigate some of the aspects of the emergency, from food delivery companies to HVAC repair providers.

Going through a thorough assessment creates an opportunity for the decision-makers to see the full picture of the organization and undertake emergency planning with all the information they need already assembled. Moreover, a memorialized assessment preserves institutional knowledge that does not disappear with personnel turnover — the next person to take on the position will not be starting from scratch. Thus, even though the assessment may be a labor-intensive step, it helps ensure that the resulting emergency plan will be of great value and will be easier to execute in a true emergency. 

If you are considering updating your emergency plan and would like to do a preplanning assessment, we can help. Contact Daniel Pascale to discuss the best approaches to conducting a comprehensive and useful assessment of your organization’s risks, resources, and external stakeholders.

COSECURE, an ancillary business unit of Cozen O'Connor, is a national consulting firm dedicated to building safer workplaces, communities, and schools through risk identification and mitigation. We tailor our services to meet the needs of our largest Fortune 100 companies, hospitals, universities, K-12 schools, and government entities as well as small businesses and home offices, bringing unmatched safety, security, and legal value and expertise to our partners so they can achieve more. Learn more about us →