Volume 15 (2021-22)

Each volume of Journal of Business Continuity & Emergency Planning consists of four 100-page issues both in print and online. Articles scheduled for Volume 15 are available to view on the 'Forthcoming content' page.

The articles and case studies confirmed for Volume 15 are listed below:

Volume 15 Number 3

  • Editorial
    Lyndon Bird, Editor, Journal of Business Continuity & Emergency Planning
  • The impact of remote workers on crisis, risk and business continuity management
    Andreas Rodman, Chief Innovation Officer & Co-Founder, Safeture

    Since the outbreak of COVID-19, the number of employees working from home has increased exponentially. This paper discusses how this shift to remote working has affected enterprise risk management, business continuity management and crisis management over the last couple of years, along with tips, software tools and processes to help manage this impact. The paper also identifies the key functionality required from pertinent software tools, discusses the effects and primary issues associated with such tools, and provides examples of how these tools have been implemented in practice.
    Keywords: remote workers, employee location, trend, crisis management, business impact analysis, risk assessment

  • Soft skills in a hard world: Why emergency management and business continuity leaders must update their professional toolbox
    Michael Gladstone, Director of Emergency Management & Planning, WeWork and Shaun Brown, Global Incident Manager, Bloomberg

    In today’s rapidly changing threat environment, especially amid the COVID-19 pandemic, the roles of emergency management (EM) and business continuity (BC) professionals are continuously evolving. Today’s EM/BC professional has become more mission-critical than ever, with their position placed under a spotlight as companies of all sizes prepare themselves for the next unknown, but inevitable, crisis. A common problem, however, is that many professionals with the requisite hard skills lack a light touch when it comes to communicating the goals they are striving to achieve. This paper discusses the importance of soft skills for the crisis management guru. The paper lays out which of the multitude of soft skills are the most critical, outlining ways for EM/BC professionals to build, utilise and maintain their soft skills, with case studies that exemplify the use or misuse of such skills.
    Keywords: communication, hard skills, relationships, soft skills

  • Evolving corporate crisis response coordination for maximum resilience
    Ashley Goosman, Business Continuity & Crisis Management Manager, Liberty Mutual Insurance

    Crisis management in large organisations should evolve response structures to prepare better for real-time, enterprise-wide events, and boost overall resilience. This paper proposes that organisations shift from an incident command structure to a more agile approach that reflects changes in business operations. This paper describes the evolution in Liberty Mutual Insurance’s US operations practice from a more traditional emergency response team structure to an agile one that seeks to unify crisis teams globally and cross-functionally. The paper concludes that the adoption of a collaborative methodology across disciplines fundamentally increases organisational resilience.
    Keywords: business continuity, business continuity management, crisis management, organisational resilience, operational resilience, resilience, crisis response, crisis team

  • Factors that affect mass fatality management and crisis standards of care: Lessons from the El Paso COVID-19 surge
    Dee Grimm, CEO and President, Tenebo Enterprises and Consulting

    This paper examines the substantial spike in fatalities that occurred in El Paso, Texas in late 2020 due to an unprecedented surge in COVID-19 infection. It also considers various explanations for the fatality surge, and the fatality management issues observed during the event. The paper suggests what lessons can be learned from this event, in particular those preventable causes that could be avoided in a future outbreak. The paper also examines the gaps in existing mass fatality management processes as they apply to planning for pandemics and mass fatality crisis standards of care.
    Keywords: COVID-19, mass fatality, pandemic, El Paso, emergency management, public health response, healthcare planning

  • Anticipatory foresight and adaptive decision-making as a crucial characteristic for business continuity, crisis and emergency leadership
    Robert C. Chandler, Director of Graduate Studies in Communication, Lipscomb University

    This paper reviews some of the common challenges to high-quality decision-making at the leadership level, such as limiting decision shortcuts, analytical blind spots, failure to consider multiple perspectives or options, and reluctance to adjust decisions that are not working well. The paper also reviews some of the pertinent literature and scholarship on decision-making approaches to build a summative decision-making model of anticipatory foresight and adaptation to overcome dysfunctional decision-making mistakes. The paper proposes a new framework that focuses on the internal decision-making processes that leaders should adopt — an approach to decision-making that combines the concepts of anticipatory foresight, predictive vision, creative imagination, adaptive skill sets and adaptive flexibility. It is essential to incorporate these dimensions in how we prepare leaders, equip and train them, create processes and protocols, and ultimately how we evaluate and assess leadership performance.
    Keywords: foresight, leadership, decision-making, flexibility

  • Maturity modelling: A qualitative approach
    Roderic Keeley, Principal, Measurity

    To restore, recover and resume operations in the wake of a major interruption to business requires clearly defined goals and the existence of a roadmap to achieve, if not exceed, established expectations. This paper proposes that the use of a qualitative approach to measuring business continuity maturity provides the ideal lens through which to gauge an organisation’s current state, identify the gaps that need to be closed, and create that roadmap to resilience. Specifically, the paper argues that looking at how well something is completed or understood provides significantly more value than a yes/no quantitative approach that looks only at if something meets expectations. As any successful programme requires ongoing refinement, this paper is intended both to encourage and challenge practitioners to understand better why — and how — to measure their business continuity programme, as well as provide a foundation for development, with a view to unlocking the opportunity for continued resiliency.
    Keywords: maturity, measurement, qualitative, model, goal, effectiveness, assessment

  • Exercising cyber resilience: The Finnish experience
    Antti Nyqvist, Chief of Preparedness, General Secretary and Tero Oittinen, Senior Advisor, Cyber Resilience, Training and Exercises, Digipool, National Emergency Supply Organization

    Together, the Finnish National Emergency Supply Agency and Digipool are developing exercises to improve the nation’s cyber security. This paper provides examples of these exercises and explains how they contribute to companies’ emergency response and business continuity plans. The paper also describes how the model is being developed to further improve continuity and emergency planning in the area of cyber resilience.
    Keywords: exercise, resilience, preparedness, continuity, cyber, partnership

  • Enabling the decision-making process: Applying experience from Afghanistan to civilian crisis and incident management
    Michael Quam, Threat Intelligence and Crisis Management, Global Risk and Resilience, Micron Technology

    When it comes to crisis management, every second counts — whether it is a fire onsite or a reputational crisis, decisions must be made rapidly to protect the company’s people, operations and reputation. This paper gives real-world examples of standing up and running a crisis management process inside the Special Operations Command during the Afghanistan conflict. It highlights the need for fast, flat and accurate communication in order to enable rapid response and recovery. The paper describes the challenges of building an organisational approach to crisis management and establishing the buy-in, process steps and systems solutions for such an endeavour. The paper will review, step by step, how this process was built in Afghanistan and how to bring it to the civilian sector to create a level of intelligence and response that most civilian companies are yet to realise.
    Keywords: Special Operations Command, incident management, crisis management, security, leadership

Volume 15 Number 2

  • Editorial
    Lyndon Bird, Editor, Journal of Business Continuity & Emergency Planning
  • Cyber-compromised data recovery — The more likely disaster recovery use case
    John Beattie, Principal Consultant and Michael Shandrowski, Principal Consultant, Sungard Availability Services

    To extort a ransom payment, ransomware actors must make the threat sufficiently compelling that payment seems like the only option. This is achieved by encrypting or disabling a company’s data replicas and backups as well as its production data — data that are essential to the organisation’s success. To prevent this happening, it is essential to extend one’s thinking beyond the organisation’s cyber security incident response plan and disaster recovery programme and give active consideration to a cyber incident recovery risk management (CIR-RM) programme. This paper explores what this requires, including the right thinking, the right approach, the right team and the right plan.
    Keywords: cyber crime, cyber attack, ransomware, malware, data recovery, disaster recovery, immutable backups, cyber incident recovery, cyber incident response

  • Achieving business resiliency to natural disasters through the lens of risk management and insurance
    Frank Russo, Principal, Procor Solutions + Consulting, Tracy Alan Saxe, President, Saxe Doernberger & Vita and Joseph Poliafico, Vice President Global Risk and Safety, First Onsite

    Natural disasters have been occurring more frequently and with greater potency, creating a real and heightened financial and operational risk to businesses around the globe. This paper aims to enhance traditional business continuity techniques and strategies by discussing how risk management, insurance and claims knowledge can form a robust platform from which to minimise the impacts of natural disasters on business. To this end, the paper combines professional knowledge from the fields of risk management, disaster response and insurance claims recovery to offer best practices in the key phases of planning and response.
    Keywords: risk management, disaster management, insurance claim preparation, insurance dispute, insurance coverage, policyholders

  • The benefits of lessons learned: The COVID-19 experience in the Canadian province of Alberta
    Eric A. Bone, Director of Zone Operations, Emergency/Disaster Management and Jeffrey Tochkin, Emergency Management Officer, Alberta Health Services, Canada

    The mantra from Emergency Management professionals is that lessons learned when enacted are beneficial; when they are not, it is a lesson observed. The COVID-19 pandemic has required healthcare organisations to be agile and responsive. This paper describes how Alberta Health Services leveraged the lessons learned from previous incidents in order to provide a flexible response to a rapidly evolving situation.
    Keywords: healthcare resiliency, lessons learned, pandemic response

  • Organisational resilience in action: A four-month denial of access to the workplace
    Linda-Jane Richan, Corporate Support Officer, Parliamentary Counsel Office, New Zealand

    This case study looks at a denial-of-access event, where airborne asbestos material was found in a government-owned building leased by the New Zealand Parliamentary Counsel Office (PCO). The paper describes how despite the lack of advance notice, the PCO demonstrated its resilience to business disruption through its leadership and culture; its networks and relationships; and being change-ready. The paper also discusses how the incident provided an unexpected opportunity to build further resilience on return to the workplace.
    Keywords: resilience, asbestos, critical functions, resources, communication

  • Key lessons from Hurricane Dorian: The benefits of a flexible top-down storm response
    Emad Aziz, Provincial Lead, Business Continuity Management Office, Government of Nova Scotia

    In 2019, Hurricane Dorian wreaked widespread havoc across the Province of Nova Scotia, with significant, adverse impacts affecting citizens and government services for a protracted period. This paper describes the challenges faced by the provincial emergency management and business continuity response teams. It argues that storm response requires a flexible top-down approach, with senior leadership delegating responsibility and encouraging locally-driven decision-making. Using examples from Hurricane Dorian, the paper shows that as emergency response and business continuity overlap, response teams must find a balance between the protection of life and property and safeguarding the continuity of business. This can be accomplished through strategic support from senior leadership, the adoption of evolving best practices and competency development through training and realistic exercise scenarios.
    Keywords: delegation, hurricane, business continuity, emergency management, telecommunications failure, incident command system, mental health

  • Automating an operational resilience programme: An approach to readiness
    Marzia Haenen, Independent author

    The decision to automate any part of a resilience programme may be straightforward, but translating that decision into a successful software selection and implementation demands complete, detailed scoping and a commitment to a culture of ongoing change and improvement. This paper provides an approach to the design of supporting reporting and data frameworks and models, up to the point of requests for information or proposal. It also provides suggestions on embedding an ongoing change process, and guidance and watch-points at each stage. This should in turn ensure that software selection is informed and successful, and that subsequent change is managed successfully.
    Keywords: automation, tooling, change, design, data

  • The impact of business continuity management on the components of supply chain resilience: A quantitative analysis
    Gianluca Riglietti, Head of Research & Intelligence, Panta Ray, Amir Avatefipour, Master’s Student and Paolo Trucco, Professor of Industrial Risk Management, School of Management, Politecnico of Milan

    This study investigates the mitigating influence of business continuity management (BCM) with respect to supply chain disruptions. Using a dataset from the 2017 BCI Supply Chain Resilience Report, the authors conduct partial least square-based structural equation modelling with reflective constructs for both exogenous and endogenous variables. The results demonstrate that BCM reduces vulnerability and mitigates the impact of supply chain disruptions on operational performance. The study highlights BCM’s contribution to such important components of supply chain resilience as visibility, collaboration and agility. In addition to demonstrating the impact of BCM on supply chain resilience, the paper explains the role of top management in the BCM process, and provides a list of measures that organisations can take to protect themselves from external threats. This is the first study to use statistical analysis to provide empirical validation in this field, while employing a clear definition of BCM in line with international best practices.
    Keywords: supply chain disruption, supply chain resilience, business continuity management, SEM

  • Rhinos and risk assessments
    Jo Robertson, Crisis Management Expert

    It is wrong to describe the COVID-19 pandemic as a ‘black swan’ (ie a catastrophic event that no one saw coming). Far more apt would be to call it a ‘grey rhino’ — something that has long been predicted but overlooked by leadership the world over. This paper argues that it is time to stop relying on outdated risk formulas and adjust risk assessment methodologies to account for these grey rhinos. Simply put, it is time to accept that the potential impact of an event is more important than its likelihood.
    Keywords: gray rhino, grey rhino, risk assessment methodology, crisis leadership, executing crisis, crisis management

Volume 15 Number 1

  • Editorial
    Lyndon Bird, Editor, Journal of Business Continuity & Emergency Planning
  • Business resilience best practices that do not work: Cautions and guidance
    Cliff Thomas, Director of Enterprise Risk Management, National Center for Atmospheric Research, Colorado State University

    Across the world, there is an increasing tendency for businesses to rely on best practices, based on the assumption that they provide proven, credible and efficient solutions. In-depth scrutiny of ‘best practicism’, however, paints a different picture of its effectiveness; indeed, the adoption of best practices is commonly ineffective due to their misapplication or the use of unsupported assumptions. This article explores the use of best practices in the business resilience profession and describes reasons why assumptions about them are often incorrect. Cautions about best practices focus on the importance of change processes, underestimating problem complexity, and the influence of confirmation bias. These factors, and ways to address them, are described in the context of business resilience.
    Keywords: best practices, business continuity, business resilience, cognitive biases, complexity, confirmation bias

  • Practical insights for regional multisectoral exercise planning: The Greater Toronto experience 
    Claudia Cocco, Co-Lead, Ontario Health — Toronto Region, Hospital Emergency Preparedness Program and Manager of the Emergency Preparedness Department and Moira Hennebury, Emergency Preparedness Specialist, Sunnybrook Health Sciences Centre

    Exercise GTA Unified was a functional, multiagency, cross-jurisdictional, health-sector focused mass casualty preparedness exercise conducted in the Greater Toronto Area (GTA) on 28th November, 2019. With over 1,000 unique paper-based and electronic injects and 34 participating agencies, including 22 separate hospital sites, Exercise GTA Unified is likely the largest health-sector focused mass casualty preparedness exercise ever conducted in Canada. The exercise design approach supported a successful, objective-based functional exercise, with elements of marked realism for participants. The exercise offered a unique opportunity to collect data for future analysis and the insights gained will have a transformative impact on interagency engagement and cooperation for emergency response planning. Furthermore, the approach adopted for the exercise is affordable, reproducible, scalable and transferrable to sectors beyond the health system. This paper provides a detailed review of the key planning and design components adopted in the development and implementation of the exercise, as well as practical insights for the design and conduct of multi-agency, cross-jurisdictional functional exercises.
    Keywords: mass casualty incident, health system, exercise design, surge capacity, regional emergency planning, operations-based exercise, functional exercise

  • Incident command system: Situation unit leader and county public health liaison roles in the federal medical station, Santa Clara, in the COVID-19 response 
    David Matear, Healthcare Executive Advisor, Stanislaus County Health Services Agency

    Federal medical stations (FMS) and alternative care sites are used to provide surge capability and capacity for short-term inpatients with healthcare needs that cannot be accommodated or provided for in a general shelter or general acute care facilities. In March and April 2020, an FMS was deployed to support the management of the COVID-19 pandemic in the ‘hotspot’ of Santa Clara County, CA. This paper describes how the flexibility of the incident command system allowed for the positions of situation unit leader and liaison officer to be combined at the FMS, supporting the effectiveness and efficiency of the FMS through comprehensive situational awareness, information-sharing and collaboration. This method of combining closely related roles is not suitable for all healthcare emergencies, but as this paper demonstrates, it is well worth considering in circumstances where competences and capacity align.
    Keywords: emergency preparedness, healthcare, hospital, alternative care site, incident command system

  • Building adaptive business continuity plans: Practical tips on how to inject adaptiveness into continuity planning processes
    Tracy Hatton, Managing Director and Charlotte Brown, Managing Director, Resilient Organisations

    With the world becoming increasingly complex and uncertain, the disruptions that businesses face are becoming increasingly unpredictable. Traditional approaches to business continuity planning must therefore evolve to enhance organisational resilience. As this paper will discuss, it is vital to ensure a balance between detailed planning and flexibility and adaptability. This can be achieved through: 1) creating closer links between business continuity and strategic management; 2) embedding a culture of resilience throughout the organisation; 3) decentralising business continuity planning and enabling teams and departments to design and own their own plans; 4) making planning principles-based; and 5) exercising more frequently. This paper argues that planning must be based on principles and outcomes rather than processes, and how it must, to be integrated within broader risk management and strategy functions to be inclusive of everyone, from the staff all the way up to the board. In short, preparedness and resilience must become part of their DNA.
    Keywords: business continuity, organisational resilience, adaptive planning, business disruption

  • A dynamic risk-based approach to managing a pandemic
    Marc Siegel, President and CEO, M Siegel Associates

    A pandemic is a unique natural disaster that will pose challenges for any organisation. During the COVID-19 pandemic, for example, organisations of all types have struggled to maintain operations while assuring the health and well-being of the various persons who work on their behalf. Certainly, many organisations have found that their risk management and business continuity plans fail to consider adequately the disruption associated with a pandemic caused by a novel pathogen. As this paper discusses, this suggests a need to revisit risk assessments and business impact analyses; the assumptions and timeframes on which they are based; and the plans that they have generated. The paper argues that static plans are ill-suited to address the evolving threat of pandemic, and that effective planning and management of pandemic response must be dynamic in nature.
    Keywords: risk management, continuity management, pandemic planning, dynamic planning, COVID-19

  • Supply chain resilience
    Alan Elwood, Director, Risk and Resilience

    This paper explores the significance of supply chains to modern economies and the brittle nature of those supply chains. It considers how this brittleness is increasingly exposed by an array of threats, both natural and manmade, as well as the pressures placed on supply chains from rapid changes in society’s expectations and priorities, including with respect to globalisation and ethical considerations. The paper establishes why resilience matters, setting out the degree to which known risks are mitigated and assessing the current status of supply chain resilience. Finally, practical techniques are suggested by which organisations may better understand the risks to their supply chains and enhance the resilience of those chains.
    Keywords: supply chain, value networks, resilience, crisis management, business continuity

  • Spinning straw into gold: The fairy tale of disaster cost recovery
    Michael Martinet, Past Member of the Global Board, International Association of Emergency Managers

    Globally, disasters appear to be growing in frequency, intensity and cost. While national governments provide varying levels of assistance to affected populations and regions, are local agencies doing what they can to prepare for the next disaster? This article discusses what can be done, sometimes at minimal cost, to be better prepared to recover economically from the next disaster.
    Keywords: FEMA, Public Assistance, disaster, cost recovery, recovery plan

  • Integrating local personnel response and recovery capacity: A conceptual model for small to medium enterprise hazard risk analysis
    Steven Haynes, Director of Risk Management and Insurance Program, Naveen Jindal School of Management, University of Texas at Dallas and Tony McAleavy, Assistant Professor in Fire and Emergency Management, Oklahoma State University

    Small-to-medium enterprises (SME) are vulnerable to disasters because of their limited ability to duplicate, separate and diversify their risk. SMEs must therefore rely on local personnel and resources to plan for, respond to, and recover from disasters. Unfortunately, community-level planning does not readily incorporate SMEs effectively. SMEs are thus forced to plan in isolation as current hazard risk analysis (HRA) models do not adequately account for the capacity of local personnel to respond to emergent hazards. Accordingly, this study posits an easy-to-use SME disaster impact model for HRA that combines probability theory and statistical analysis to integrate local personnel capacity. The model is designed specifically for SME usage; although, it can be applied to any organisation regardless of size. This study proposes a standardised HRA probability and consequence sequence based on the analysis of over 400 locations and risks that determined the model’s reliability in practice. The posited SME disaster impact model for HRA effectively integrates vulnerability and local personnel capacity with services, personnel and equipment to optimise SME disaster response and recovery capacity.
    Keywords: impact analysis, continuity management, resilience, risk modelling, small-to-medium enterprises, hazard risk analysis