Building Resilience to Protect your

Business

Gillies Crichton. MSc. GIFireE. MBCI8 April 2014

Preplanning

• Terrorists don’t attack Scotland….• Plan for the worst – hope for the best !• Flexibility • Cause and Effect• Training of all key staff – from top to bottom• Regular testing of the plans• Liaison & Communication• Learn from mistakes

Organisational Learning

• Passive learning: we are aware of the potential, but do nothing with it

• Active learning: we proactively use the learning to continually improve

We can use active learning to employ foresight instead of hindsight….no need to rely on 40:40 hindsight vision!!

Background to Terrorist attack• Friday 29 June – failed double car bomb

attempts in London• Saturday 30 June – Glasgow Airport

– predicted second busiest day of the year– school holidays started the day before– work underway on £30m terminal extension

• Call to Airport control centre at 15:11 “vehicle has run into door 2 and is on fire”

Initial Response• Evacuation of checkin• Invacuation - passengers in the piers and

unaffected areas left in situ• Full response by emergency services• Backup by Airport Fire Service• Crisis Management Team call-in

Crisis Management Team

• Established at 16:00 hrs on Saturday 30 June• Set out priorities • Plan for protracted incident• Liaison with Emergency services

Business Recovery Team

• Team established at 17:00 hours • Help Emergency Services to Help us…the Danny

effect !!• Priority to have new processes, systems &

resources in place before areas handed back from Police

Business Recovery• At 3.10pm, announced terminal fully

operational – Breaking News on News 24• Dealing with visiting VIP’s

– Good for staff morale– Can slow down pace of recovery– Shows united front– Lets the world see the recovery process in action

Crisis Management

versus

Public Relations Management

Media

• Handling the media is an important aspect

• Increase in the use of social media

• Immediate – in the moment

• Live pictures• Media hungry

Terrorist Attack• Determine key messages• 129,091 hits on website compared to 6127

previous week• Unprecedented media interest – up to 800

media calls within 24 hours of the attack

• Continuous rolling coverage on Sky, News 24, CNN, Fox News

• Roving Reporters……

Key Challenges• Moving 3,500 people to SECC• Police priorities was to gather evidence – Glasgow

Airport priorities to get the Airport operational in shortest timescales

• Longer term – diverting capital & revenues away from planned spend to fund costs of attack.

Key Learnings

• How would our response have differed had there been mass casualties/fatalities?

• Staff Trained, plans in place & tested regularly – all the way through to Business Recovery

• Work in Partnership with other responding agencies• Initiate business recovery plans in tandem with crisis

response – keep them flexible• Challenge yourself and your teams • Expensive team building exercise!

7R’s Model

(Gillies Crichton: 2007)

Intrinsic Interaction Between Plans…

Emergency Plans

Contingency Plans

Business Recovery Plans

Importance of Business Resilience

• The media measures disasters by money & lives lost rather than improbability of its occurrence

• Eyjafjallajökull volcano cost the Airline industry circa $1.7 billion with 107,000 flights affected

• Hurricane Sandy grounded 15,000 flights worldwide and 25% of all USA flights

• The terrorist attack cost Glasgow Airport circa £4m.

Some Common Misconceptions

• “It won’t happen to us”• “We will cope, we always do”• “We are too big a company to fail”• “Terrorists won’t attack us”• “The Insurance will cover it”• “It Costs too much”• “It’s not worth the time & effort”• “It is a black art”• “It is complex & complicated to manage”• “It is someone else’s job”.

The Facts !• Every year, 1 in 5 businesses face a major disruption• Organisations are expected to face a crisis situation

every 4 years• 80% of businesses suffering a major disaster, cease to

exist within 3 years• Around 50% of businesses experiencing a disaster &

which do not have effective plans for recovery, fail within the following twelve months.

In summary…• We need to take every available opportunity to

learn… this includes incidents outwith your sector

• We should expect to face crisis situations at least every 4 years

• We need to have a strategy in place • We cannot simply rely on emergency plans• You can and should play a part in minimising

disruption and restoring normality as soon as possible.