Hurricane Sandy – Three Years of Change or Disaster Denial?
Hurricane Sandy was the deadliest and most destructive hurricane of the 2012 Atlantic hurricane season, and the second-costliest hurricane in United States history.
Classified as the eighteenth named storm, tenth hurricane and second major hurricane of the year, Sandy was a Category 3 storm at its peak intensity when it made landfall in Cuba. While it was a Category 2 storm off the coast of the Northeastern United States, the storm became the largest Atlantic hurricane on record (as measured by diameter, with winds spanning 1,100 miles (1,800 km). Estimates as of 2015 assessed damage to have been about $75 billion (2012 USD), a total surpassed only by Hurricane Katrina. At least 233 people were killed along the path of the storm in eight countries.
There are two main categories of disaster: those with notice and those with none.
For this event, the Eastern US had notice. At the time, about seven days out, Firestorm arranged webinars for our school and business audiences to discuss the modeled path of the storm and likely impacts. We invited experts from the Medical, Banking and Insurance industries, along with our own senior team and Expert Council members to discuss disaster scenarios, personal safety, and business survival and recovery strategies.
In the United States, Hurricane Sandy affected 24 states, including the entire eastern seaboard from Florida to Maine and west across the Appalachian Mountains to Michigan and Wisconsin, with particularly severe damage in New Jersey and New York. Its storm surge hit New York City on October 29, flooding streets, tunnels and subway lines and cutting power in and around the city.
Utilities and governments along the East Coast attempted to head off long-term power failures Sandy might cause. Power companies from the Southeast to New England alerted independent contractors to be ready to help repair storm damaged equipment quickly and asked employees to cancel vacations and work longer hours. Researchers from Johns Hopkins University, using a computer model built on power outage data from previous hurricanes, conservatively forecast that 10 million customers along the Eastern Seaboard would lose power from the storm.
Over 5,000 commercial airline flights scheduled for October 28 and October 29 were canceled by the afternoon of October 28 and Amtrak canceled some services through October 29 in preparation for the storm. In addition, the National Guard and U.S. Air Force put as many as 45,000 personnel in at least seven states on alert for possible duty in response to the preparations and aftermath of Sandy.
As we at Firestorm near our tenth anniversary, we see more proof every day of one of the original tenets we founded the company upon – that of every company in crisis experiencing 5 Common Failures in a Disaster or Crisis.
Prior to, during and after Sandy, we saw the failure to:
Control Critical Supply Chains:
Almost every transportation avenue felt the impact of Hurricane Sandy – from over-the-road transport to sea shipping, the supply chain impact was felt worldwide.
In anticipation of a disaster such as Hurricane Sandy, it is important to identify the internal and external dependencies of critical services or products. Firestorm research conducted in 2012 with more than 200 senior supply chain professionals showed that a company’s supply chain is the source of well over half of all business crises and disruptions and that number was on the increase. Suppliers are the largest source of these supply chain failures. Yet, many companies do not fully understand, track, or analyze the embedded risks that are inherent within their selection of suppliers.
The survey provided compelling evidence that the ability to view supply network activity is lacking. While 48% of survey respondents indicated that they have visibility into the “critical suppliers”, an additional 36% indicated that they either had no visibility or the tools used were limited to internal operations only. While 16% indicated they have visibility into all suppliers, there was evidence to suggest that these were related to Tier One suppliers and not to ‘full visibility’ throughout the entire supply chain. The fastest growing risk existed within the extended supply network (suppliers’ suppliers) globally. This risk represented then and now, a multi-tier escalating exposure.
It is clear that lack of appropriate visibility is a significant issue. The lack of meaningful visibility is one of the key causes for disruption, second only to natural disasters; the combination of lack of meaningful visibility and a natural disaster such as Sandy can be a business killer.
Hurricane Sandy underscored the traumatic impact of a major weather system on local and global supply chain operations in terms of direct damage costs and subsequent disruptions.
Train Employees for Work and Home:
“If I had taken the warnings more seriously we could have locked things down earlier — perhaps shipped out a segment of our team to our Minnesota office. Then we would have been covered if things were down for more than a week, and these employees would have had plenty of advance notice to get personal things organized.” David Roth, Forbes, 2012
Firestorm has found that across most companies, 95% of employees do not have a plan at home. If employees do not have a clear strategy for their families, an emergency or disaster can force them to choose between family and work. Family will always trump work.
During Sandy, actions from the authorities to close down mass transit, highways, bridges and tunnels impacted not only the transfer of goods and services, but significantly impeded the movement of key staff and support services. Employee loss of power at home impacted remote access / remote working abilities; those companies that had a plan to allow remote work and access through a VPN were unable to implement that plan, and those that had server storage on the East Coast were crippled further.
Medical care and contingencies for care became key issues for families and employees as well; in her excellent article for Stanford Medical, “Beyond Hurricane Heroics”, Dr. Sheri Fink well-describes the life and death decisions made by medical care providers in a long-term disaster; in essence, she explains that Sandy (and Katrina) “…demonstrated that America’s medical infrastructure remains extremely vulnerable to natural hazards, and there is an urgent need for preparing for disasters and responding to extreme triage scenarios like the ones faced by those hospitals…”in the eye of Sandy.
Training and planning must take place for long-term disaster scenarios, and this starts with essentials: food, water, shelter (consider those out-of-town employees or visitors and guests that are stranded in a disaster area), and access to medical care.
Even the smallest of creature comforts can make a difference. During Superstorm Sandy, Firestorm Associate, New Jersey resident and mom of two, Pam Mancuso, explained how, as coffee drinkers, planning ahead helped during the extended power outage: “One of the things we learned during Sandy is to make lots of coffee ahead of time, keep it in a pitcher in the fridge, and then take out what we needed to reheat on our gas stove top. A warm cup of coffee was a must in the morning, especially when facing another day with transportation issue s and without power. We also did all of our laundry ahead of time – feeling clean at work made a big difference.”
Every crisis is a human crisis. The Firestorm founders published “Disaster Ready People for a Disaster Ready America,” to guide individuals in developing their own preparedness plan at home. The fundamental building block to having employees perform at work is for them to know their families are safe.
Identify and Monitor all Threats and Risks:
“In the week leading up to Sandy, I didn’t encounter a single person who was worried about the storm or even believed the meteorologists. The superstorm ended up affecting 24 states, and left coworkers of mine stranded on the 7th floor when waves of water rushed into the lobby of our office. Thousands of my fellow Hoboken residents had to be rescued by the National Guard because the water was so high that they couldn’t safely leave their homes.” Rosanne Salvatore in The Bustle
In our business, the greatest competitor we face is Denial.
For any business, no matter how large or small, a formal risk assessment is needed to properly understand a company’s very specific risks and how those risks could be better addressed through additional controls. The analysis also results in the identification of specific enhancements for leadership requirements, decision processes, command and control operations, emergency response, employee procedures, streamlined communication techniques and facility and equipment upgrades.
Knowing the threats an organization will face enables it to manage the results and respond to those threats, both natural and man made.
Conduct Exercises and Update Plans:
After Sandy, thousands of business found that current continuity plans were not scalable and did not effectively position leaders to communicate their expectations for the maintenance of ongoing operations. They had plans but those plans had not been thoroughly tested.
Recently, Firestorm conducted a “virtual tabletop exercise” with more than 300 companies in attendance. We simulated a minor natural disaster with hundreds of teams across the country. The results were unanimous in that all participating companies found either a gap in their existing plans, or contingencies they had overlooked altogether.
Our participating teams also realized that plans must contain options for levels of operations, and a framework for such levels. Disaster plans should establish clear chains of decision-making and empower employees in the field to take action, especially is leadership is unavailable, or worse yet, missing. Last, continuity plans and disaster response plans should be synchronized to avoid overlap or gaps in capabilities.
Sandy brought to light the need for short-, medium- and longer-term business continuity plans. Companies need different disaster recovery strategies for events of different durations, and must train, test and update these plans.
Training converts written plans into actionable ones. By test exercising plans and their procedures, the problems or weaknesses identified will stimulate appropriate changes.
Develop a Crisis Communications Plan:
Providing accurate and timely information to employees and other stakeholders is essential to the crisis communications process. Identifying and prioritizing target audiences and then identifying channels of communications must be established beforehand for effective internal and external communications. Plans must consider alternate communications sources: newsletters, social media, email, text messaging, and 1-800 lines. A plan must include predetermined stand-by messages and tactics such as prepared templates, ready-to-use news releases, media statements, social media messaging, fact sheets, and backgrounds.
Essentially, the most critical component of any emergency plan is based on the ability of an organization to communicate to their targeted recipients in a timely and effective manner.
Effective communications is a crucial element in emergency/crisis management and should assume a central role in disaster preparedness. Proper communications establishes confidence in the ability of an organization to deal with a crisis and to bring about a satisfactory conclusion.
Disasters, risks and threats are increasingly a global concern. As Sandy clearly demonstrated, disasters and actions in one region can have an immediate impact on risks in another. Despite growing understanding and acceptance of the importance of risk mitigation and increased disaster response capacities, disasters and in particular the identification, monitoring, and management continue to pose challenges to most organizations.
The best time to respond to a disaster is before it happens. Every physical area in the world is or will be subject to some type of disaster or hazard. Even though an area has never been damaged before, there is no guarantee that it will not happen tomorrow. It is a governance responsibility to identify the kinds of hazards – and their impact – that could affect your company both internally and externally, before they occur.
The starting point for reducing disaster risk and for promoting a culture of disaster resilience lies in the assessment of the threats and vulnerabilities that most businesses face. Let that be the lesson we learn from not just Hurricane Sandy, but from every disaster. The time to act is before now; before the crisis or disaster has a lasting impact on your family, your community, your employees and ultimately, your business.
Images: www.emergencyresponseplanning.com, aosis.org and open forum respectively