Picking up after Sandy: Resilience in the eye of the storm

Authors: Neil Kaufman

Hurricane Sandy has forced business and community leaders to question the effectiveness of their disaster preparation and planning. What can Sandy teach us about developing a comprehensive and practical risk resilience programme?

Where were you when Hurricane Sandy hit?

I know that’s going to become one of those questions that people ask when they hear I live in Manhattan. The answer is that I was right there. As the storm approached, with its eye looking straight at us, I was wondering how to prepare, how much to prepare, how much would my family, friends and neighbours be affected?

And then afterwards, assessing the impact, working together with those friends and neighbours to do everything we could for anybody who needed it. We wondered how quickly we would be able to get back on our feet again. And with so much devastation, what would things feel like when we did?

Of course, my thoughts weren’t immediately on my work at that time, but I knew many of my clients would also have been affected by the hurricane. My job is to help businesses ensure they can keep their key operations running in the event of an accident, a disaster such as Hurricane Sandy, an emergency or threats. Never more pertinent, this is known as business continuity management (BCM). BCM is a key component of risk resiliency as it can fortify a company’s long-term ability to withstand external threats. Some businesses were more prepared than others.

From weathering Sandy live with my family to getting back into the corporate field and helping clients recover afterwards, there had to be something to learn. This article shares some of my reflections on what this storm taught us about disaster resilience.

Could anyone really have been prepared for this?

Hurricane Sandy affected 24 states in the US. It swept up the entire eastern seaboard from Florida to Maine and west across the Appalachian Mountains to Michigan and Wisconsin. There was severe damage in New Jersey and New York. The people of New York City experienced flooding in streets, tunnels and subway lines and lost power in and around major parts of the metropolis. A construction crane atop a $1.5 billion luxury high-rise in midtown Manhattan collapsed in high winds and dangled precariously. This prompted precautionary evacuations and many of the surrounding streets were cleared. There were power outages and soon after, gasoline shortages.

For some, these resource constraints lingered for weeks and many businesses and communities continued to struggle. From a very personal perspective, some of my friends lost homes, clothing, cherished possessions and a lifetime of collected memories in family photos – forever gone. I saw amazing efforts of neighbours helping each other. My office mate shared a portable generator with his neighbours to make a community dinner and then took turns waiting in lines for gasoline. I was proud to see my own son working in a kitchen at an evacuation shelter for displaced victims of the storm in lower Manhattan.

Going concern or long gone?

While many businesses may have had plans in place for the hurricane response, the quality of those plans tended to vary widely. Those companies that did not have BCM procedures in place as part of their overall approach to risk management, learned some painful lessons. In the aftermath, Hurricane Sandy had many business leaders questioning just how robust their preparations were. How comprehensive were their BCM programmes? Will future storms have an even greater impact on preparedness and long-term resiliency? Would a good plan be the difference between going concern and long gone?

If we look at the experience of Sandy and the nature of the response, some common pitfalls and practical priorities emerge:

Get real about the reality before you really have to. Even with a plan, disaster recovery won’t go completely as planned. Once the hurricane was over, the unexpected continued to happen, slowing recovery significantly in some cases. This is what businesses learnt from the harsh realities they encountered:

You are on your own. Don’t expect assistance from agencies and local authorities. Outside assistance wasn’t able to address many companies’ recovery needs. Those that fared better had prepared for loss of life support systems (e.g. having generators that were tested and not located on ground floors scheduled diesel fuel deliveries for those generators). Organisations that had reviewed their needs in advance were better placed.

Plan the work, and work the plan. More often than not training and education had not been carried out throughout the entire organisation. Only people involved in continuity planning understood the programme and the overall plan. Training and exercising both senior management and line management is critical.

Don’t live in a silo. IT recovery capabilities were not well-aligned with the business recovery requirements. Loss of critical infrastructure and telecommunications had not been considered and universally planned for. This hampered business recovery. Recovery strategies and remote locations had not examined various disaster scenarios that could include a geographic event. Many organisations’ recovery priorities were neither broadly known nor kept up to date. The result was slower responses and misaligned strategies. Organisations that had pre-vetted those priorities and strategies were able to get back on their feet faster.

Silence was not golden. The ability to communicate in multiple ways (land lines, cell phones, satellite phones, social media) was essential to staying connected. Having multiple suppliers for service was critical to avoiding a busy signal or a dropped network. Many businesses wrongly calculated that staff would be able to access their work applications with remote computer connectivity for email and workflow.

All hands can’t be on deck. Just like me, most people were not available to focus on recovery since many were dealing with personal losses and damage. Organisations had to deal with the loss of, or inaccessibility to, key personnel while also supporting the needs of their families. Better prepared organisations had robust substitutes identified for key recovery functions.

Know your suppliers. Key suppliers did not have continuity plans to ensure the resiliency of their services. Key suppliers were not thoroughly integrated into the recovery strategy of many organisations. Supplier management pre- and post-event became a point of widespread discussion.

Read the fine print. Insurance did not cover all the losses from business interruption and property damage. Service level agreements from vendors which read ‘best efforts’ were a wake-up call for many. What’s more, the fine print often referenced ‘force majeure’ exceptions to the vendor taking responsibility for these ‘acts of god’. Reviewing coverage and policy limitations is part of staying prepared. Those companies that had planned for key supplier outages were able to implement supplier redundancy programmes and enact contingency plans sooner.