Improving Your Business Continuity with ICS

Over the years, I’ve observed that many businesses put forth valiant efforts toward developing the strategies, objectives, and tactics that make up their business continuity plans.  I believe businesses can greatly improve the overall effectiveness of their business continuity efforts by looking beyond the boundaries of “business continuity” and incorporating some of the best practices found in emergency management.

Back 1995, I first came to appreciate just how important this concept is.  I was involved with a corporate response to the Oklahoma City bombing of the Alfred P. Murrah Federal Building in downtown Oklahoma City on April 19.  We had plans in place for essential business functions but had never addressed the impact public sector responses would have on our response and recoverability.   For the first week following the blast, an entire eight-block radius was closed to the general public. Since it was considered a crime scene, security was very tight in the area which made it very difficult for recovery teams to try and assess the damage.  With the extremely tight security measures in place, getting workers into and out of the area was a challenge and took several hours for each employee. 

Having a better understanding how public safety (police, fire, EMS, and Emergency Management) will respond to an incident can greatly effect how a company might approach their own response and recovery – and vice versa.  Today, the best practice followed by first responders in any response is the Incident Command System commonly referred to as ICS.

For those not familiar with ICS, it’s a standardized, on-scene, all-hazards incident management concept supported by the Federal Emergency Management Agency (FEMA; www.training.fema.gov/EMIWeb/IS/ICSResource ).  ICS enables a coordinated response among various entities using common processes for planning and managing resources.  ICS also allows for the integration of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure.

ICS was developed in the 1970s following a series of catastrophic fires in California. Property damage ran into the millions, and many people died or were injured.  Those tasked with determining the causes of these disasters studied the case histories and discovered that response problems could rarely be attributed to lack of resources or failure of tactics.  Rather, After-action reports from ineffective incident responses find that response problems are far more likely to result from inadequate management than from any other single cause.  Without ICS, incident responses typically result in:

  • Lack of accountability, including unclear chains of command and supervision.
  • Poor communication, due to both inefficient uses of available communications systems and conflicting codes and terminology.
  • Lack of an orderly, systematic planning process.
  • No common, flexible, predesigned management structure that enabled those in-charge to delegate responsibilities and manage workloads efficiently.
  • No predefined methods to integrate interagency requirements into the management structure and planning process effectively.

In the past, about the only driver for businesses to include ICS was with respect to hazardous materials thanks to the Occupational Safety & Health Administration (OSHA;  www.osha.gov/SLTC/etools/ics )  standards (29 CFR 1910.120 App C).  Thankfully that’s changed.  Today, we have more encouragement from (not all inclusive):

  • National Fire Protection Association ( NFPA; http://www.nfpa.org ) with the NFPA 1600 “Standard for Disaster/ Emergency Management and Business Continuity”
  • FEMA’s  “Voluntary Private Sector Preparedness Accreditation and Certification Program” (PS-PREP; www.fema.gov/privatesector/preparedness ) and,
  • Professional Practices of the Disaster Recovery Institute International (DRII; www.drii.org ) include two touch points for the inclusion of emergency management considerations, although actual inclusion and implementation will vary greatly among businesses.  Specifically, the two Professional Practices are:
  1. Emergency Response and Operations – Identify an organizations’ readiness to respond to an emergency in a coordinated, timely and effective manner.  Develop and implement procedures for initial response and stabilization of situations until the arrival of authorities having jurisdiction (if/when), and
  2. Coordination with External Agencies – Establish applicable procedures and policies for coordinating continuity and restoration activities with external agencies (local, regional, national, emergency responders, defense, etc.) while ensuring compliance with applicable statutes and regulations.

I recently instructed an “ICS-300 Intermediate ICS for Expanding Incidents” class.  The class was structured purposefully to include both public “responders” and corporate business continuity planners.  At the end of the three-day class, those from the corporate world felt the class was eye-opening and extremely helpful to them.   They mentioned that they thought the use of ICS will be valuable to their companys in that it:

  • defines a  pre-determined  structure which in turn will help avoid the loss of time as people jockey for position and power
  • provides the company with a standard process to be used for escalation, all the way up to their Corporate Headquarters
  • will serve as a foundation onto which solid working relationships can be built with community responders
  • would also drive common terminology across different offices including those in other countries.
  • Improves overall communication and effectiveness 

TIP:  In spite of the technology available today, truly effective response and recovery requires good people.  Train and educate your employees.  An organization is only as good as its people.  Design an effective business continuity/emergency management training model and ensure your employees have the training and tools to do their jobs – either in the office, on the road or at home.

 If you or someone from your company would like to learn more about how ICS specifically, or training in general, can improve your business continuity efforts, please feel free to contact me.

Advertisements

So, what do you think?

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: