Len's News, Notes, and Stuff

It’s Only Ridiculous Until You Experience The Real Deal: BCP & Emergency Management Exercises

Designing and undertaking exercises are critical to the development and validation of business continuity plans and emergency management plans. They are also critical to the training & familiarization that your organization’s people will need in order to respond as effectively as possible when the time comes. Yet, exercises often aren’t taken seriously by management or by participants. Think of the most basic form of exercise in the field: fire drills. Do people take them seriously? Usually not. Would they take it more seriously if you told them that sometimes evacuations are not just for fires but also for bomb threats or other incidents outside the building but close enough to be threats? Usually not.

The most common reaction to exercises is, “Yeah, but this is just a fictitious scenario. It won’t really happen.”

Imagine designing a business continuity exercise or an emergency management exercise that included all of the following elements as injects or scenarios:

• earthquake
• tornado
• power outage
• chemical spill
• disease outbreak
• riots with teargas deployed

You probably wouldn’t be taken very seriously. Yet, that was precisely the list of scenarios that happened during the G8 & G20 Summits in Toronto.

We first activated and staffed up our Emergency Operations Centre on Monday June 21 because police intelligence had told us to expect protests to start by then. Nothing happened. The next day, still nothing happened. The third day, still nada.  Thursday, however, brought us an earthquake during the day and a tornado during the evening.  As a result of the tornado, some key facilities lost power and had to run on backup generators. A second generator had to be shipped in and hooked up at 4am in the morning, but still some services were knocked out for the next day.  On Friday, there was a highway incident that involved a chemical spill and some of our folks have responsibilities in such instances. Plus, there were reports of possible disease outbreaks in some of our areas of responsibility. By Saturday, there were riots in the city and police deployed teargas near our facilities.

I had actually designed and conducted an exercise with our people about a month prior.  I had deliberately loaded on a number of different scenarios including chemical spills, disease outbreaks, and denial of access to facilities.  There were other scenarios that produced mass casualties or which led to service degradation or disruption. I wanted to stress the system a little and see how well our plans, processes and procedures would hold up. They held up well, but I got feedback telling me I may have been a little excessive.

People sang a different tune after this past week, though. They told me that the exercise was good preparation for the real deal because the real deal stressed the system just as badly as the exercise had, but it was for real.

I have personally been in a building that had a major fire raging on one of its floors. In fact, I came close to dying from smoke inhalation in the evacuation stairwell that evening. I know from firsthand experience that fire drills need to be taken seriously – lives can depend on them.

I have been through an emergency operations centre activation where we had to coordinate elements to respond to all 6 of the scenarios I’ve listed above. Not just one of them, but all of them, and within the span of about 3 days. I know from firsthand experience that exercises that stress the system need to be taken seriously – things can be just as bad or worse when they really happen.

The It-Can’t-Happen-Here mentality is dangerous, particularly in the fields of business continuity and emergency management. However absurd it sounds, I assure you there is a possibility it can happen. There’s a chance that absolutely nothing will happen and you will have been over-prepared. If that’s what happens, so be it. Yet, it would be (to put it lightly) very bad to be underprepared if something seriously really does occur.

Would you be taken seriously if you suggested that your organization would experience an earthquake, have to deal with the effects of a tornado and its resultant power outages, respond to a chemical spill, respond to multiple possible disease outbreaks, and deal with rioting in the city with police deploying tear gas right near your facilities? If you think that you wouldn’t be, consider what my organization went through during the G8/G20 Summits last week.

Something like that only seems ridiculous until you’ve been through the real deal and seen it happen.