Disaster recovery is one area where prevention is the best medicine. Unfortunately, as many incidents that can adversely affect the workplace cannot be prevented, risk analysis and preparedness prove the next best course of action. HR professionals aim to ensure the safety of their workforce and any contractor or vendors on their property, minimize damage to the site, the environment, or machinery, and reduce downtime or disruption in service.1 There are steps to take in a preparedness and response plan; if your firm is large, you likely have an emergency response team in place; if you still need to, appoint a response leader yourself. However, the response is the last step: here, we look at the phases in addressing disasters, focusing on those events that pose an operational risk to your organization. After assessing both the probability and degree of risk, the steps include prevention, mitigation, preparedness, and your response were the event to occur.
While there is an entire profession of risk assessment, HR can at least consider the possibility of an adverse incident and ascertain the risk to the organization if that incident occurs. Evaluating risk and the cost of risk is its own science, yet we can use premises from that science and apply them in preparedness planning.
Business Risks
Many significant business risks are preventable; your organization likely has procedures to prevent these from happening. Such risks include:
- Security and fraud risks include data breaches, cyberattacks, identity theft, embezzlement, money laundering, criminal record, and intellectual property theft.
- Compliance risk includes laws and regulations governing occupational health and safety, equipment certification requirements, taxes, hazardous waste disposal, climate initiatives, and data privacy.
- Financial or economic risk; areas that affect cash flow and profitability, such as market movements, foreign currency exchange rates, over-reliance on venture capital, or commodity price fluctuations; these are commonly addressed through getting insurance, diversifying income streams, and limiting the amount or tenure of loans.
- Reputational risk is often preventable. These include bad customer service and support, shoddy products, protracted labor action or strikes, negative Yelp! or Glassdoor reviews, or other damaging publicity about your employees or leadership.
- Operational risk.2 Unlike the preceding risk factors, an operational risk that interferes with your business processes may be difficult to prevent but critical to plan for – these risks are the focus of this article.
For each of these, consider both the probability of the occurrence and the likely severity of the damage where it occurs. Organizations vary in their tolerance for risk: you may find your company has a greater risk tolerance than HR professionals. The strategies for approaching known risks are, in fact, relatively simple:
- Accept the risk potential and budget for its impact (e.g., we know a planned building site is on a flood plain, and we budget or insure for that potential occurrence).
- Avoid the risk (or activity) totally (e.g., the potential for war is higher in country X, so we will not locate personnel there); thus, the chance of business discontinuity is eliminated.
- Mitigate potential risk by optimizing preparedness and planning for the risk impact; (e.g., conduct regular site evacuation drills, have backup off-site data sources, and up-to-date real-time employee location information).
- Move the responsibility for a risk to another entity, which is what insurance policies do for you.
Assessing Probability
When you evaluate risk across your organization as an HR professional, locational issues can weigh heavily. Some areas of the world are more prone to earthquakes than others; some regions are more likely to suffer from tornados, floods, wildfires, volcanic eruptions, or hurricanes. Some are more prone to human-led issues impeding business, such as wars, terrorist attacks, transportation disruptions, etc. As part of your risk management strategy, you will be considering and weighing the probability of an event occurring against the cost to the company and employees if it does happen. As employee safety is foremost, considering the likelihood of a devastating event is essential, then balancing the cost of mitigation vs. the business impact of so doing. After considering the possible, the task is too narrow to the more probable, knowing you cannot be accurate 100% of the time. If you have multiple geographies in your company, you will need to consider the likelihood of potentially disastrous events on a regional basis.
Geolocational risks
The probability of a particular type of natural disaster may be location specific. In this, existing data is helpful. Consider:
- Tornados: it makes more sense to have an on-premise tornado shelter, a tornado alert siren, and trial drills for employees if your site is in the “tornado alley”: the states of Texas, Oklahoma, Nebraska, Kansas, Colorado, or South Dakota. 3
- Earthquakes: Alaska has the most earthquakes, but California, in second place, has the most damage from them. The following most earthquake-prone states are Hawaii, Nevada, and Washington state. Given earthquake probability—not just possibility—means attention to seismic-ready buildings, bolted-down furnishings, employee shelter, and evacuation plans. 4
- Hurricanes: Florida is by far the most hurricane-prone state in the US: 40% of US hurricanes strike Florida. Texas, Louisiana (tied with North Carolina), and South Carolina. Hurricanes are considered seasonal (so you have an identifiable time factor): from June 1 to November 20. 5
- Wildfires:California has had the most significant number, with Texas second, followed by Colorado, Arizona, Idaho, Washington, Oklahoma, Oregon, Montana, and Utah. While corporate structures, supply chains, and transportation may be affected, and because residential property damage can be devasting in these fires, consideration of the impact on employees if fires sweep through their communities also merits planner attention. 6
- Floods:According to authorities, every state has flood hazard zones – and like fire, flooding can devastate corporate structures. The highest risk is in Louisiana, followed by Florida, Mississippi, Arkansas, and New Jersey. 7 However, for cities, Miami, Florida, has the highest flood risk score in the United States. 8
Disastrous Events can be Anywhere.
Several classes of events require preventative and recovery planning, regardless of company size or location. Fire or water damage, for example, can bring a company to its knees in a hurry.
- Workplace fires: Workplaces are considered “non-residential structures,” according to the National Fire Prevention Association. In 2021, 125,500 non-residential structure fires caused an estimated 130 civilian fire deaths, 1,100 civilian injuries, and $3.6 billion in direct property damage. From 2020 to 2021, non-residential structure fires rose 4 percent, deaths rose 30 percent, injuries did not significantly change, and direct property damage rose 6 percent.9 Fires can be caused internally by electrical failures, gas explosions, sabotage or arson, and other causes.
- Water damage: Water damage can be more than just external floods, though a report from the nonprofit First Street Foundation and commercial engineering firm Arup finds that businesses in the U.S. could lose more than 3.1 million days of operation next year due to increasing flood risks from human-caused global warming. The report predicts this total may grow to 4 million days by 2051, warning of ripple effects throughout local economies.10 However, broken water mains or a malfunctioning sprinkler system can prove equally devastating.
- Workplace shootings: Workplaces are the most common mass shooting sites, with perpetrators most likely fired from that site, according to the Violence Project, which tracks mass shootings, defined as four or more victims killed. The second most common location for mass shootings was retail locations, representing 16.9% of all recorded mass shootings. The third most common location was restaurants and bars, which represented 13.4% of all recorded mass shootings, according to the Violence Project. 11 The Bureau of Labor Statistics reports that there were 392 workplace homicides in 2020, plus 37,060 nonfatal injuries in the workplace resulting from an intentional injury by another person. That figure rose to 481 workplace homicides in 2021.12 The five occupational groups with the most workplace homicides in 2020 were sales and related, transportation and material moving, management, construction and extraction, and production. Homicides in sales and related occupations accounted for 23.5 percent of all workplace homicides in 2020. 13
The initial planning, the response itself, and the recovery planning vary on the event, and all rely on identified safety measures, employee education, and simulated drills. At the very least, all employees need to know how to safely exit the site, where to reconvene in a safe location, what communication mechanisms are used in an emergency, and the most likely corporate responses to the event.
Ascertaining Impact
All risks are not equal, and as with anything, there is a cost to the degree of prevention or recovery steps undertaken. For example, you could likely build a building that would withstand a severe tornado or hurricane, but the cost could be far more prohibitive than the effort is worth. Better to invest in insurance and build anew in most cases. Given that you can neither prevent nor prepare for all operational-impeding events, to a certain extent, HR professionals must think a bit like gamblers—hedging one’s bets, as it were. To begin, limit the parameters:
- Is it likely to affect one or all sites in our organization? For example, would a hurricane causing the closure of the Florida plant adversely affect operations in Texas or Washington? Unlike natural disasters, however, war or epidemics could force the closure of all sites in a single country.
- Is it likely to affect all classes of workers or only subsets? Bird flu, for example, may affect those raising poultry more directly than leadership housed elsewhere.
- Is it likely to impair the workforce or permanently disable or kill them? (Consider a toxic gas spill in a chemical plant in which all unprotected workers could be exposed or a roof collapse during work hours due to the weight of snow from a blizzard).
- Is it likely to be of a long- or short-term duration? For example, internal network failure will raise havoc but likely be addressable within days; a total grid failure could prove lethal for many businesses relying on e-commerce or real-time networked communication.
- Is it likely to result in site closures or new working models (as in the past pandemic with the move to home offices or closures of meat-packing plants)?
- Is the overall financial risk to our organization large or small? In other words, what does it take for our firm to survive what may be a protracted slowdown due to the event?
- What are the cost implications by unit, given the risk perceived?
Preparedness and Response
The goal is to mitigate risk potential by optimizing preparedness and planning for the impact of a designated risk. Even if the operational effect of the event cannot be mitigated, workforce preparedness is your number one responsibility. 14 Most firms have an emergency response team, or at least someone charged with thinking about disaster effect and recovery. This team or individual prepares emergency plans and procedures, provides preparedness training, and directs crisis management activities. 15 Note that the first measure in most emergencies is to contact fire, medical, or police professionals.
For example, considering any workforce emergency, train employees to exit the building properly and promptly. An evacuation plan and corresponding training should provide employees with information to:
- Know two exits and escape routes from their work area;
- Assist others with the proper escape route, if possible;
- Exit to the designated meeting area regardless of whether others comply and follow.
If an active shooter creates a crisis and employees cannot safely evacuate, they must be trained to hide. Partners at Fisher-Phillips’ Workforce Safety Practice Group recommend that employees are trained to effectively lock and barricade themselves in a safe area and use door locks and desks or furniture to block the shooter from entering the door to the room. Hiding places should be out of sight of windows, and employees should also silence noisemaking devices that may alert the shooter to their presence (cell phones, tablets, computer speakers, etc.). Ideally, the area will be protected if shots are fired in the employee’s direction. Employees should only contact 911 to alert the authorities when it is safe. However, they should be careful not to alert the shooter of their location. 16
In all events, a plan and practice are imperative. Routes for evacuation must be practiced, not just posted. Repetitive drills can make the response second nature, and while not wholly alleviating panic, can better ensure employee safety.
Post-disaster Response
Here we are talking about the response AFTER the event rather than the response while the event occurs. A coordinated, prompt, and thoughtful corporate response to emergencies is imperative. Handwringing is not the answer here; this is HR’s “keep calm and carry on” moment. You can put your business continuity plan in place because you have anticipated the possibility of an occurrence that causes business operations to halt. You have employee locations and contact information, including emergency contacts. You have detailed communication procedures to follow, including executive communication with the press and media.
Conclusion
Whatever the crisis, the foremost responsibility is to the people. HR’s role is, in part, to mitigate the uncertainty that is inevitable following a workplace crisis. Employee support, trauma mitigation, consolation, and family assistance may be required and should be immediate. The continuity plan should be explained as early as possible. Fear of returning to the workplace is not uncommon and should be accommodated and expected. If, for example, the site is destroyed through fire, proves unworkable through water damage, or is uninhabitable from mold, smoke, or fumes, alternative work environments must be addressed quickly. The pandemic provides guidance, as many now are well-versed in working from home. No one likes to think about unpleasant events, and workplace disasters are unpleasant and dangerous. However, HR professionals are responsible for preparing the workforce should a disastrous event occur.
Endnotes
1 Emergency Preparedness in the Workplace: 5 Tips for HR | Eddy, https://bit.ly/3OPVRyO
2 5 Types of Business Risk Every Leader Should Plan For | RMI, https://bit.ly/42peixa
3 What States are in Tornado Alley? (+how many tornadoes/state each year) (tornadoxtreme.com)
4 Which State Has the Most Earthquakes? | House Grail, https://bit.ly/43lXVmz
5 Which US states are hit most by hurricanes? | www.finder.com
6 Wildfire Statistics by State (Updated for 2023) – www.Policygenius.com
7 States With the Highest Risk of Flooding | https://Stacker.com
8 Top 10 Cities Most Vulnerable to Flooding in 2023 – Insurify, https://bit.ly/3qrppsq
9 Fire Loss in the United States During 2021 (nfpa.org)
10 Businesses face alarming levels of increased flood risk (www.axios.com) by Andrew Freedman, December 14, 2021.
11 Workplaces are the most common mass shooting sites, data shows – ABC News (abcnews.go.com) By Ivan Pereira. April 11, 2023.
1215 Disturbing Workplace Violence Statistics for 2023 (https://techjury.net)
13 Workplace violence: homicides and nonfatal intentional injuries by another person in 2020 : The Economics Daily: US Bureau of Labor Statistics (www.bls.gov) November 21, 2022.
14 NWHRN-Guidelines-Writing-Emergency-Preparedness-Plans-FINAL.pdf (https://bit.ly/45QGufp)
15 What Do Emergency Response Team Members Do: Daily Work & Skills (www.franklin.edu)
16 4 Key Actions Employers Can Take to Best Prepare for an Active Shooter | Fisher Phillips, https://bit.ly/43LwaDR
