2018 Annual Conference - Crisis Management 052318

LeadingAgeMichigan ~ 50th Anniversary Annual Conference & Solutions Expo

Crisis ManagementARE YOU READY FOR THE NEXT CRISIS?


Crisis Management ‐ Are you ready? Learning Objectives

1. Gain an understanding of potential crisis events that can adversely affect your organization and stakeholders

2. Obtain tools and resources to help your organization prepare, crisis event

3. Learn how to use risk analysis and mitigation strategies to enhance your crisis management policies and procedures


Crisis Management ‐ Are you ready? Justin Dailey

Assistant Vice PresidentAon Risk [email protected]‐913‐0206

Eric Dougal

Business DevelopmentAon Risk [email protected]‐336‐5516


Learning Objective #1GAIN AN UNDERSTANDING OF POTENTIAL CRISIS EVENTS THAT CAN ADVERSELY AFFECT YOUR ORGANIZATION AND STAKEHOLDERS


Crisis Management ‐ Are you ready? What are the potential crisis events that can adversely affect your organization?

Natural Technological Human‐causedNatural Hazards/Threats Is Your Organization at Risk? U.S. Natural Hazard Risk by State

Avalanche Animal Disease outbreak

Drought Earthquake

Epidemic Pandemic

Infectious disease Flood

Hurricane Landslide

Pandemic Tornado

Tsunami Volcanic eruption/activity

Wildfire Winter storm

Rank State HRS

1 FL 94.512 RI 79.673 LA 79.234 CA 75.565 MA 72.127 CT 69.048 OK 66.829 SC 66.3810 DE 65.38

Source: CoreLogic, 2014


Are You Prepared, Today?



Natural Technological Human‐causedTechnology Hazards/Threats

Airplane crash Dam FailureLevee failure Mine accidentHazardous materials release Power failureRadiological release Train derailmentUrban conflagration



Natural Technological Human‐causedHuman Caused Hazards/ThreatsBiological attack Chemical attackCyber incident Explosives attackRadiological attack SabotageLive shooter Workplace violence

Did we miss any threats/hazards?


Cyber Risk ‐what’s the risk portrait? 29.3 million patient health records compromised HIPAA data breaches since 2009

138% increase in the number of healthcare records breached since 2012

Cloud computing has grown to $235 Billion industry◦ 91% of the data centers that have experienced an outage in the last 24 months

Standard protection◦ Firewalls◦ Filters◦ Passwords◦ Encryption◦ Clean desk policies◦ Secured record disposal and protection

◦ External drives controls / protection (incl: laptops)

Standard protection◦ Administrative policies on confidential materials◦ Organizations need

◦ to understand IT Security exposures

◦ Identify vulnerabilities

◦ Hazards

◦ Triggers


Cyber Risk ‐what’s the risk portrait? Best practices◦ Include data breach in your Business Continuity/Operational planning process as a hazard/threat◦ Control/mitigation tactics to consider

◦ Employee training

◦ Data management

◦ Management accountability

◦ System monitoring

◦ Incident response planning

◦ Risk transfer


Active Shooter• In 2009, incidents spiked up, and have

remained there.

• Of the 84 events studied, 29 took place at schools and 31 took place at a business or retail location

• 80% of the events happened at one location. 20% involved multiple locations where the suspect moved on foot from one place to another.

• Another study, presented in part at the Society for Academic Emergency Medicine annual meeting in 2012 highlighted the following: 154 hospital related shootings were identified

over a 10 year period 91 (59%) occurred inside the hospital and 63

(41%) outside 40 States/235 injured or dead victims 91% male perpetrators ED environs were most common site 29% Parking lots 23% Patient Rooms 19%


https://www.fbi.gov/about/partnerships/office‐of‐partner‐engagement/active‐shooter‐incidents‐graphics


https://www.fbi.gov/about/partnerships/office‐of‐partner‐engagement/active‐shooter‐incidents‐graphics


THE RESEARCHTime of the incidents are in the early morning hours;

Each has a triggering event: argument, fights, anger, vengeance, jealousy, domestic related;

Suspects are consistently male;

Not clear if they all occur at non‐school sponsored events, but they all have a link to student access to university space;

Weapon of choice is a firearm

© Margolis Healy & Associates, LLC


Profile of an Active ShooterAn Active Shooter is an individual actively engaged in killing or attempting to kill people in a confined and populated area; in most cases, active shooters use firearms(s) and there is no pattern or method to their selection of victims.

Active shooter situations are unpredictable and evolve quickly. Typically, the immediate deployment of law enforcement is required to stop the shooting and mitigate harm to victims.

Because active shooter situations are often over within 10 to 15 minutes, before law enforcement arrives on the scene, individuals must be prepared both mentally and physically to deal with an active shooter situation


Nursing Home IncidentMarch 29, 2009 In NC

Suspect, 45, kills seven elderly patients and one nurse

Estranged wife worked at nursing home

Shooting stopped after suspect was wounded by the police


Active Shooter Preparedness Create an Emergency Action Plan (EAP)

Perform training of staff

Conduct mock active shooter training exercises – seek local law enforcement assistance

Encourage law enforcement to train for an active shooter scenario at your location

For more information on creating an EAP contact the U.S. Department of Labor, Occupational Health and Safety Administration, www.osha.gov


Active Shooter Drill Gone WrongOctober 2014, Denver, CO

Female employee filed a complaint she was terrorized during an “active shooter drill”

She was told to enter an area where a man displayed a handgun and told her to go into an unoccupied room

She pleaded for her life

Facility routinely conducted safety, fire and natural disaster drills for its residents

The exercise was alarming to her when she learned it was a drill


Preventing Campus ViolenceThis law is settled OSHA

The Occupational Safety and Health Act of 1970 (OSH Act) was passed to prevent workers from being killed or seriously harmed at work. The law requires employers to provide their employees with working conditions that are free of known dangers.

29 states have explicit workplace violence laws


To Help Prevent Campus ViolenceThe following list in not to be construed as complete or is it meant to imply that by following any or all of the suggested steps, a campus can prevent an act of violence.

1. Implement pre‐employment screening and background checks.

2. Adopt a “Zero Tolerance” policy toward threats of violence applicable to everyone on campus. This means that no threat of violence or violent behavior will be ignored. The policy needs clear response and communications procedures.

3. Provide assistance programs for employees who need help in managing stress and transition assistance to employees leaving the university’s employment.

4. Survey staff and residents and ask them where they believe the campus and individuals are the most vulnerable.

5. Train staff and residents about warning signs and violence prevention.


To Help Prevent Campus Violence6. Train staff on how to minimize emotions when threatening situations arise.

7. Establish a formal reporting system for complaints of threats and threatening situations. Take immediate action to resolve any reported situations.

8. Create an Incident Response Team and notification system to respond to threatening or escalating situations before they turn into a crisis.

9. Never meet with a threatening staff member, resident, or family member.

10. Always maintain the usability of means of egress


Learning Objective #2OBTAIN TOOLS AND RESOURCES TO HELP YOUR ORGANIZATION PREPARE, CRISIS EVENT


Crisis planning processDoes your organization include…

Your community stakeholders• Residents & family members• Staff including family members

and family need• Vendors• Other stakeholders

• Police, fire, office of emergency preparedness

• Utilities

• local, state and federal authorities

Who else should be considered?

Does your organization’s planning process identify and consider all hazards and threats?

Scenario based (including analytics or probabilities)

Complexities to be clearly articulated in objectives for each hazard / threat• Speed of onset• Size of affected area

Scalable, flexible

Defines mission and supporting goals

Does your plan identify?

Proper local, state federal authorities and statutes

Leverage knowledge of various resources to help clarify the hazard or threat (i.e.: private and public sector resources)

Previous/current organizational agreements or mutual aid agreements (i.e.: sheltering, dietary, transportation, medical care needs, etc.)

Direct key responsibilities (who, what to do, and why)


Planning phase characteristicsStrategic

The long term “how”• How the organization wants to

meet its emergency management responsibilities for the long term

• Establishes planning priorities– Senior management – Board of Directors

Operational Defines roles and responsibilities, actions, etc. for• Management

• Departments

• Staff

• Emergency services and vendors

Tactical Managing personnel, equipment and resources that support a hazard/threat

Desktop or gap analysis testing or a hazard/threat tactic allows management to pre‐identify personnel, equipment, training, etc. gaps• Gaps

– Mutual aid– Technical assistance– Procurement– Policy updates– Contingency leasing


Planning approachesScenario based planning

Create a scenario for each hazard/threat• Test the frequency/severity to develop course of action

• Primarily used for hazard/threat

Function based planning Identifies common functions that must be delivered/performed by your organization• Basic services

– Medical care– Housing and care

• Helps define functions that need to be performed with support from internal and external parties, vendors, departments, etc.

Capabilities based planning Answer questions – “does the organization have…”• Plans

• People

• Supplies

• Vendors

• Shelter site and transportation

• Communication process

• Leadership– Mix of

◦ Scenario

◦ Function


Key areas of planningConsider the following key areas when planning for any specific hazard or threat◦ Prevention◦ Protection◦ Response◦ Recovery◦ Mitigation


Who is your internal team? Who is on your EP Team?

Mandatory Team Members

vs.

Select/Volunteer Team of Dedicated Staff


Key areas of planningPrevention

Natural? Technological? Human caused?

What hazards/threats can you control/prevent?

Protection

Mitigates eliminates hazards/threats to people, property and environment

Occurs before, during or after an event

Sheltering Agreements• How many?

• Host agreements

Security

Response

Actions taken • Save lives

• Meet basic human needs

• Reduce/mitigate loss of property/environment

Recovery

How are you going to return to operational?

Always think worst case scenario

Mutual Aid agreements

Support from local authorities/ vendors • Fuel, water, food, debris removal,

permitting

• Include local authorities and public/ family members in recovery process

Do you have a formal “recovery response team?”

What if you have limited support from outside sources?


Key areas of planningMitigation

Limit or control impact of hazard or threat

Long term emphasis• Examples

Comply with or exceed National Flood Insurance Program flood plain management regulations

Apply building codes

– Flood‐proofing– Seismic design– Wind bracing– Retrofit your facility to withstand

o Wind

o Seismic activity

– Promote open space/wet lands to reduce flood exposure– Build shelters (i.e.: wind/tornado safe rooms)

Importance of an onsite response team to mitigate damage


Lesson Learned ‐ FloodGreater risk awareness is needed, especially as flood hazard maps have proved their value as reliable indicators of where damage is likely to occur.

Ensure flood plans are set up in a phased/escalated manner with defined actions at certain trigger points (water level heights at particular gauge points). ◦ Assign actions to individuals within the organization are to be defined for each of these various trigger points/hazard levels.

◦ Physical barriers such as levees and flood walls can help but do not offer complete security◦ Other means of protection should be considered, such as flood water retention areas along rivers

Monitoring should be conducted at a sufficient distance to allow sufficient warning time. ◦ The flood contingency plan should consider the potential time of arrival of the flood to the site


Lesson Learned ‐ FloodFlood plans should address:◦ Flood preparation steps taken to reduce exposure to plant, stock, test back up emergency generators◦ Flood mitigation prevention of flood waters entering the site◦ Identify key resources required to restore and return site back to operations◦ Account for potential loss of power and denial of access.◦ Account for no or limited water supply and natural gas; inoperable sewerage systems; no food and supply deliveries

It is essential to regularly test the contingency plan internally as well as with local emergency response authorities ◦ Consider improving flood resilience prior to rebuilding structures


Crisis CommunicationInclude the contact information for basic utility and support services in the Business Continuity Plan (BCP) contact list. ◦ Electrical power, water, sewer, gas, emergency, telecommunications, and transportation.

◦ In addition to the main switchboard numbers, include a listing of direct and mobile phone numbers for your contacts and othermeans of contacting, such as texting.

◦ Maintain contact information for key customers, suppliers and, depending on your business situation, contact information for your suppliers’ suppliers

◦ Media outlet contact information to publicize recovery efforts, business operational status, and in some cases, contacting your employees


Crisis CommunicationDocument succession‐of‐responsibility by critical emergency and decision‐making functions with contact information. ◦ Regional crisis events have demonstrated that during a crisis a company cannot count on the availability of current leadership.

◦ Consequently, viable alternatives for critical functions are essential.

Include individuals who have unique, indispensable knowledge for the continuity or recovery of the business. ◦ The people who know the nuances of equipment startup or shutdown at a specific location may be more critical to recovery operations than anyone in management.


Crisis CommunicationEstablish a robust communication capability that enables the company to broadcast and receive the latest news and information to interested parties and individuals.◦ Redundancy is the key◦ Building a crisis communication capability may include:

◦ Satellite phones strategically placed within the organization

◦ A web site with Business Continuity Plan access and bulletin boards for posting messages

◦ Established text messaging, social media communication channels and/or mass e‐mail capabilities where individuals can relay messages

◦ A centralized number to call outside the affected and a website for instructions and updates


Most Importantly – Your WebsiteWhen bad news or an emergency strikes an organization, its website is the first place the outside world turns to for information.

Dark Site—should be in place now not at crisis!◦ Positions the organization to be the primary source of crisis information◦ Transparent behavior demonstrates that you are in control and take your responsibilities seriously◦ Information that promotes clear understanding of the situation


Crisis CommunicationUpdate the contact list ◦ Every three months or when organizational changes have been made and test it◦ To make sure numbers for outside the organization are up‐to‐date and reach the intended individuals, call the numbers


ResourcesFederal Emergency Management Administration (FEMA)http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf

Threat assessmenthttp://www.fema.gov/media‐library‐data/8ca0a9e54dc8b037a55b402b2a269e94/CPG201_htirag_2nd_edition.pdf

Plan analysis toolhttp://www.fema.gov/pdf/about/divisions/npd/CPG_101_v2_past.pdf

Protecting your businesshttp://www.fema.gov/protecting‐your‐businesses

Federal Emergency Management Administration (FEMA) via Ready.gov http://www.ready.gov/sites/default/files/documents/files/sampleplan.pdfhttp://www.ready.gov/business


ResourcesCenters for Disease Control (CDC)http://www.cdc.gov/niosh/topics/emres/business.htmlhttp://www.cdc.gov/vhf/ebola/

Emergency preparednesshttp://emergency.cdc.gov/disasters/http://www.esf‐8‐university.org/

Pandemic http://www.cdc.gov/flu/pandemic‐resources/

Public health emergencyhttp://www.phe.gov/preparedness/Pages/default.aspx


ResourcesOSHA

Evacuation plans and procedures etoolhttps://www.osha.gov/SLTC/etools/evacuation/index.html

Workplace emergencies fact sheethttps://www.osha.gov/OshDoc/data_General_Facts/factsheet‐workplaceevergencies.pdf

American Red Crosshttp://www.redcross.org/prepare/disaster


ResourcesAmerican Nurses Associationhttp://nursingworld.org/MainMenuCategories/WorkplaceSafety/Healthy‐Work‐Environment/DPR/TheLawEthicsofDisasterResponse/AdaptingStandardsofCare.pdf

Peers/association resourceshttp://www.leadingage.org/Disaster_Resources.aspx


Active Shooter ResourcesU.S. Department of Labor, OSHA Materials addressing workplace violencehttp://www.osha.gov/SLTC/workplaceviolence/index.html

Department of Labor: OSHAViolence in The Workplace: State Plan Standards & Resources http://www.osha.gov/dcsp/osp/work_violence.html

The Canadian Centre for Occupational Health and Safety (CCOHS) Extensive list of warning signshttp://www.ccohs.ca/oshanswers/psychosocial/violence_warning_signs.html

Wayne State University “What Is Disruptive, Threatening, Or Violent Behavior” www.clas.wayne.edu/multimedia/usercontent/File/Deans%20Office/disruptive_behavior.pdf

San Diego State University “Violence‐Free Workplace Policy” http://bfa.sdsu.edu/ps/pdf/Policies/ViolenceFreePolicy.pdf


U.S. Department of Health and Human Services

U.S. Department of Homeland Security

U.S. Department of Justice

Federal Bureau of Investigation

Federal Emergency Management Agency

Additional Resources


Learning Objective #3LEARN HOW TO USE RISK ANALYSIS AND MITIGATION STRATEGIES TO ENHANCE YOUR CRISIS MANAGEMENT POLICIES AND PROCEDURES


Risk AnalysisFEMA’s Threat and Hazard Identification and Risk Assessment (THIRA) guide


Risk Analysis

http://www.fema.gov/media‐library‐data/8ca0a9e54dc8b037a55b402b2a269e94/CPG201_htirag_2nd_edition.pdf




Strategic Risk, Resilience



SummaryEstablish a formal process and policy

Identify the hazard/threat

Qualify/quantify the hazard/threat (frequency/severity)

Prioritize the hazard/threat

Develop and implement operational/tactical plan for each credible hazards/threat

Train

Test/monitor for gaps

Review and apply improvements


Questions?


Thank You!

Documents

2018 Annual Conference - Crisis Management 052318