Disaster Due Diligence

Disaster = no cash flow

• Disasters are seen as the effect of hazards on vulnerable areas (Quarantelli 1998)

9/11, Hurricane Katrina, the shootings at Virginia Tech - These are not the worst disasters that an organization will ever see.  The worst disaster is the one that threatens the viability of their organization directly.

The 9/11 Commission stated that “Preparedness is not a luxury. It is a cost of doing business.”

Disaster Due diligence™ is the analysis of a corporation’s ability to perform when faced with a crisis or disaster. All corporations face internal and external vulnerabilities. Disaster Due Diligence™ is the first step of a comprehensive Enterprise Risk Management Program. Disaster Due Diligence™ must be performed annually. 

The value of a company is a direct function of its ability to sustain revenue generation and profitability. This conclusion may seem obvious. However, most corporations lack compliance programs to assure shareholders, employees, and clients that the corporation can continue to perform in the face of known identifiable vulnerabilities.

The Red Cross forecasts 70,000 disasters annually in the US alone. Government statistics show 40% of small to medium size corporations never reopen after a disaster and 25% fail within 2 years. Of the global 1000 companies, 83% will lose 20% to 30% of their value in any 5 year period as a result of a disaster or crisis.

Everything is foreseeable. Anyone can be found accountable.

If directors and officers neglect to prevent or mitigate foreseeable disasters or prepare for those that are not preventable, the business-judgment rule will not shield them. They are exposed to liability if they fail to act in good faith and exercise due care.  

A plan alone does not guarantee that an organization has everything in place. Crisis and consequence management are part and parcel of responsible corporate governance. It is a liability issue, and one that may not seem foreseeable, much less fair. The Port Authority of New York and the landlord of the World Trade Center were found to be twice as liable as the terrorists responsible for the bombing in 1993. The court held that the Port Authority should have foreseen the possibility.

Continuity planning is a strategic governance issue. Proper disaster planning requires that an organization Predict the vulnerability, Plan the response, and Perform when the event occurs.  The Predict phase will classify the critical vulnerabilities, identify key emergency personnel, ascertain critical decisions, analyze gaps, identify infrastructure and supply chain needs, and define communications requirements. The Plan phase will develop the strategy, construct the plan, and involve the appropriate personnel to assure their buy-in and commitment. The Perform phase will establish protocols for implementation, community involvement, communications, test exercises, audits, reviews, updates, and compliance. A well designed and executed plan can transform a crisis. Often, plans are not updated to reflect ongoing changes within organizations, thus creating unforeseen vulnerabilities.

Disaster Due Diligence™ and sound governance demand that organizations develop, maintain, and test comprehensive business continuity plans since:

Disaster Due Diligence™ is necessary.  If Disaster Due Diligence™ is not performed: 

• Investments can be impaired;
• Strategic investors can be brought into the issues more directly than they want;
• Compliance requirements may not be addressed;
• Investments would be based on luck, not strategic plans.