Community-Based Mitigation Opportunities for Businesses
The following is a summary of my remarks at the Singapore Business Federation BCM Annual Conference held on January 6, 2016.
As an emergency and risk management consultant, I’ve spent the past 20 years working with companies, communities, and countries on a broad range of mitigation plans and strategies. And through all of this there's been a common thread regarding the value of mitigation – specifically whether or not the investment pays off.
Especially for low-likelihood, high-impact events like earthquakes, tsunamis, or terrorism, business managers often believe they don’t have the resources to spare, or lack the technical know-how to pull it off. The Multihazard Mitigation Council published a paper in the 1990’s that tried to counter concerns like these by claiming each dollar spent on hazard mitigation results in approximately four dollars saved in future recovery costs - and this was measured across all sectors and locations.
I tend towards the zealous with mitigation, yet even I am skeptical of this and other similarly broad-sweeping statistics on mitigation payoffs. The four-to-one argument and others like it tend to oversimplify a complex calculus, and in turn give skeptics good fodder. Obviously we can't assume an economy suffering an average $1 billion per year in disaster losses need only spend $250 million on hazard mitigation and “problem solved”.
The reality is, mitigation effectiveness is the result of skilled analysis and informed speculation, and the unfortunate truth is that poorly-planned or misguided measures can and often do waste money - or worse yet, cause greater harm. But with effective planning, and accurate analysis, targeted mitigation does save money, and in many cases much more than $4 dollars per dollar spent. The risk reduction efforts of Anheuser Busch at its brewery in Southern California are a perfect illustration of this point (bit.ly/1OBKtkg).
In 1971, the San Fernando Earthquake struck Southern California with a 6.5 Richter magnitude. Shaking intensity was high, and many businesses were damaged. Among these was Budweiser producer Anheuser Busch, which had a brewery producing 12 million barrels per year. Damage shut the facility down for several months, and during that time the company lost a fair amount of market share to competitors located outside the affected area. And in fact, the loss in revenue was greater than the cost of the repairs.
To get production up and running as soon as possible, the facility was brought back to its pre-disaster condition – but management recognized that vulnerability remained and that the bulk of financial risk was tied to interruption. Efforts were initiated to demarcate all critical facilities and equipment, and the cost of making them seismically-resilient was priced at $11 million. Management supported the changes, which amounted to just under one percent of the facility’s total replacement value.
In 1994, the Northridge Earthquake struck, and this time the epicenter was even closer to the brewery. This event remains one of the most expensive disasters in US history. All around the Anheuser Busch facility, there were destroyed and damaged buildings - but because of what they had done to protect their critical operations, none of their own essential facilities were damaged, and none of their employees were hurt or killed. They did experience a short break in production, but this was because municipal water had been knocked out for a few days.
Within a week, the facility was back to full production - and this time no market share was lost. An after-action found that the brewery would have incurred about $350 million in damages without the retrofits, and would have suffered about $400 million in lost revenue. That totals $750 million in saved expenses in this one event. So going back to the initial equation of dollars saved per dollar invested, we’re looking at a 68-fold return.
Another statistic we often hear is that 20 to 30 percent of businesses are affected by some disruption in any given year. Disasters are behind some of these – but the reality is that most are caused by small, localized events or accidents. Some are even self-inflicted. And almost all of them are preventable or at least they can be minimized through targeted mitigation.
Here in Singapore, we benefit from one of the most benign risk profiles when it comes to natural hazards – but that certainly doesn’t mean we can just let down our guard to hazard risk. All of life is affected by risk, and some things are just too difficult to imagine or predict. Just last month, in fact, a cement truck driver overshot the road while backing out of a job site, and the truck proceeded to roll down a hill and crash into the back of a preschool – thankfully at the end of the day after students and teachers had gone home.
Obviously, we shouldn’t expect that a preschool would have applied construction measures so strong as to protect against getting hit by a cement truck - and in fact the associated costs would have been wasteful in light of other risks and other needs.
But there were nonstructural measures in place, inclusive of planning which speculated one or more of the school’s five buildings might need to close for any number of reasons. There was no need to predict the cause with specificity – rather one only needed the foresight to understand there are many possible events that could result in the closure of a building (e.g., fire, water damage, insect infestation). And as a result of their planning, no customers were unexpectedly left without childcare. Without such measures, and in recognition of the immediacy of childcare needs for working parents, it is almost certain this event would have resulted in long-term revenue losses and perhaps a negative effect on reputation.
Mitigation is a matter of reducing impacts, or reducing likelihood of impact, so that core objectives can still be met – and this doesn’t have to mean paying for an expensive engineering project. It does require intimate knowledge of operational processes, some foresight - and a little imagination never hurts. The fact that as many as 25 percent of businesses impacted by disasters never reopen, or that they fail within a year, is lost on too many businesses that either don’t believe they’ll ever be affected or that the solution is out of their reach. But isolate those businesses with no continuity plans in place and failure rates for SMEs jump to as much as 90 percent in some instances (and as high as 60 percent for larger businesses).
We can focus our mitigation strategies by considering the difference between entities that survive disruption and those that fail. We should start with what makes us vulnerable. I offer the following six factors as being of particular significance:
Overdependence on Insurance Underinsurance is certainly a problem – but let’s set the bar high and assume any business that appreciates continuity planning also has at a minimum addressed its risk transfer needs. In no manner would I dispute the vital role of insurance; rather the question is whether we accurately appreciate the limits of its protection. A business can easily be affected or even fail due to any number of indirect impacts that aren’t typically covered by traditional insurance policies. What good is a check that covers repairs if you’ve lost all of your customers? In planning we can't forget that insurance does nothing to reduce event likelihood, nor does it lessen the actual physical or operational impacts or sway public opinion. It’d be fair to assume that the 270-plus US-registered business owners who named their companies after the Egyptian goddess Isis appreciate this fact. Insurance will cover the occasional smashed window or spray-painted storefront, but it will do little to salvage a reputation (http://dailym.ai/1O62e9T).
Supply chain complexity and rigidity The world is becoming ever more globalized, and virtually all businesses depend on regional and global trade in some regard. Businesses need to know how to adjust for upstream or downstream breaks before the next earthquake, super-typhoon, or tsunami strikes. Many of the companies that cut production for weeks, or even months following the 2011 Tohoku earthquake and tsunami never actually felt any strong shaking – and in fact, many weren’t even located in Japan. But the loss of their suppliers nonetheless forced a break in their production. When you rely on one supplier for something that can bottleneck operations, and that supplier is hit by a disaster – you share their misfortune.
Overconfidence in infrastructure reliability All infrastructure is vulnerable, especially networked systems like electricity and water. But at the same time it’s easy for a business to assess and understand infrastructure requirements. Where they are critical, redundancies must be in place. One of the most amazing cases of mass business continuity happened in 2012 when India was hit by the two largest blackouts in history. About 750 million customers (three-quarters of a billion!) were affected. But unlike the 2003 blackouts in the United States and Canada, the economic impacts were limited because the Indian businesses expected blackouts - and those that required uninterrupted power had redundant systems in place.
Facility structural vulnerability Structural vulnerability can be the result of either materials or design, or because of a change in the environment into or onto which the structure was built. Each beam and each bucket of concrete raised above the ground amounts to stored energy – and buildings once completed are the sum of all this stored energy. Under the right conditions, they release it and collapse, and this phenomenon is not reserved for any country or region - all countries suffer collapses. Obviously it happens less frequently where there are strong codes and adequate enforcement, but there are no guarantees. Natural hazards are the most common cause of structural failure, but other reasons also merit consideration. A lost component of the story about the Rana Plaza garment factory collapse in Bangladesh is that it was constructed according to code for its intended use. The problem is, that intended use was office space and not manufacturing. When it was informally converted to a factory - one piece of equipment at a time across months and years –stress eventually exceeded carrying capacity and dramatic failure resulted.
Siting of operations or facilities This isn’t just a matter of keeping structures out of the floodplain, or avoiding the coast. It’s also a matter of geographic concentration, and location in relation to other dependent factors like transportation and infrastructure, for example. Larger companies tend to disperse operations across great geographic distances, and facilities outside the affected can make up for an interruption in any of the others. But smaller companies, even when they have multiple facilities, tend to exist in smaller geographic circles, and their customers are also typically concentrated. Even if they aren’t directly impacted, SMEs can lose revenue if many or all of their customers are.
Staff vulnerability It is on this sixth and last factor I wish to place the greatest emphasis. Helping employees to become more disaster prepared is one of the most cost-effective ways a business can increase its resilience. Of course it is important that employees are able to do what the BCP asks them to, but that point is moot if they can’t personally deal with the disaster. The company Microchip’s experience during the 2011 Thai floods shows just how influential employee resilience can be to enterprise resilience. When the flood happened, Microchip’s facilities didn’t have any direct damages - but a good number of their employees lived in the flooded areas. Well before the floods, management had recognized a weakness in employee vulnerability and found ways to address it. When the flood came, they were able to launch their own response, and in turn, avoid a shutdown. The three main actions they took to mitigate staff vulnerability were:
They formed an employee-staffed “Evacuation team,” whose members were trained and equipped to rescue stranded colleagues and their families from flooded areas
They set up onsite temporary housing (equipped with basic commodities like food, water, and clothing) for displaced employees so that their families were able to be cared for, thereby allowing employees to return to work without having to worry about them excessively; and
They promoted a culture that encouraged staff to help co-workers clean up their flooded houses, which in turn helped everyone get back to work faster.
So with these vulnerabilities in mind, how might we achieve more from our mitigation efforts? First note that each of the above-mentioned stories highlights the fact that hazard risk rarely stops at the fence. And in fact, when it comes to disasters, businesses are much more vulnerable to what happens away from the facility, out in the community. There’s a growing movement to increase private sector involvement in community-wide resilience – and this is more than just what we think of as CSR. Community vulnerability is collective, and likewise your ability to operate and succeed in a disaster is dependent on the community’s ability to operate and succeed.
For a business, this starts by making sure employees are resilient not just at work, but also when they go home. In the 1970’s, the US Government built a facility called Mount Weather to serve as the backup site in case Washington DC was somehow impacted. Ultimately, the effort failed, and why it failed is a perfect lesson for why businesses need to think about household preparedness. The problem was that the offsite facility was only designed to accommodate critical staff, and not their families. When the time came to run a full-scale test, not many people showed up because it turns out we aren’t willing to leave our families behind in a disaster (http://ti.me/1OBMsVC).
BCPs should never assume all employees will report to work in a disaster, but companies can increase the chance that more do by supporting all of them in their efforts to become disaster resilient. This is a common them that comes up time and time again in my work in disaster impacted countries, and with disaster-impacted companies - and there’s a trend in more forward thinking businesses taking action to address this entrenched vulnerability. It’s actually pretty basic stuff, and employees typically welcome the chance to become better prepared.
Another straightforward way to increase community resilience is to demand resilience from partners and suppliers. Don’t engage with businesses that can’t show it. Resilience should be a selling-point, because after all, their failure can easily translate to your failure. Mentorship is an outgrowth of this, and big businesses are best positioned to do it. A recent survey showed only 13% of APEC SMEs have a business continuity plan, and almost half don’t even know what one is. In practice we’ve seen that the best way to change this is through business-to-business support.
Next, and perhaps the most ambitious approach to resilience, is area-wide business continuity management. Area-wide BCM brings all the right stakeholders together, and makes mitigation an integrated community effort. It might include businesses, local government, elected officials, infrastructure owners and operators, and even community organizations or neighborhood associations. Information is shared by all partners before and after disasters, and everyone learns from each-others’ lessons.
In the 1990s, the US Federal Emergency Management Agency (FEMA) supported an area-wide BCM program called Project Impact. Project Impact provided guidance and a little funding to jump-start the process – but the ensuing public-private partnerships took it from there. Project Impact communities, which are actually in several countries now, find that the private sector involvement makes all the difference in allowing the whole community to bounce back faster, and everyone benefits as a result.
And finally, businesses should consider direct engagement with their local emergency management or civil protection. Whether through public-private-partnerships, or something more informal, this is almost always a win for both sides. Last March while in Japan for the UN World Conference on Disaster Risk Reduction (WCDRR) in Sendai, and visited home improvement company Sekisui House’s “Disaster-Proof Factory” facility.
As you’d expect from its name, the facility is seismically-secure. On top of that, staff have been trained in AED use, first aid, and search and rescue. But Sekisui House also implemented backup power systems that supply electricity not only to the factory, but to 300 households in the community for up to a week. Furthermore, they worked with local first responders to enable the factory, which is the largest employer in the community, to serve as a disaster shelter. And what really stands out is that they entered into a partnership with the local government to house the town’s backup site for the emergency operations center in case the primary site was damaged or destroyed, as well as to allow emergency responders to conduct disaster exercises right on the facility grounds.
On the one hand, this strengthens the town’s response capacity, but it also allows the company to be closer to response coordination mechanisms, which ultimately impacts the success of its own recovery. The experience with Sekisui House isn’t an isolated one, and in fact I’ve found similar examples in just about every country. There’s little businesses stand to lose in building relationships like these, because in the end everyone benefits.
I believe the takeaways from all of this are:
Know what makes you vulnerable, including how you will be affected by what goes on ‘outside your fence’ – and understand that many of these outside vulnerabilities may be difficult to manage through structural means.
Recognize that insurance is vital, but needs to be part of a comprehensive mitigation program that also protects continuity.
Support your employees’ resilience so they’re less likely to be overwhelmed by their own impacts when disasters happen.
Recognize the inter-connectedness of all parts of the community, so you can seek out ways to build community-wide resilience through area-BCP or other collaborative efforts.
