Week Four Journal Entry

Freestyle Sparring

Learning to Fight Back—Emergency Operations Planning

Abstract

Karate students in many schools or dojos will practice putting all of their various skills together in freeform sparring drills. Two or more students will face off against each other and test their skills, responding to any possible attack or combination of attacks in real time, building their instincts and ability to counterattack. For a business, the equivalent is emergency planning that establishes the way to respond to real-life disasters. Emergency management has received more attention, in part due to the impact and concerns from 9/11 and from the impact of Hurricane Katrina, when we saw an entire American city put out of service. Advance planning is a must for any organization that wants to survive whatever may be thrown at it.

Keywords

Emergency operations plan ; Emergency planning ; Incident command system

Karate Sparring

The primary goal of learning martial arts is to learn how to defend yourself. Learning forms and basic moves all help develop technique, balance, fitness, and muscle memory. The drills that develop reaction and test the instincts that have grown during practice are the sparring drills. Sparring is free-form fighting, where the rules are defined and then two or more karate students practice what they have learned to try and “defeat” the other.

During sparring, an opponent is free to move around and will use feints, strikes, or blocks to attack you. In a true self-defense situation, you could strike an attacker anywhere. However, in classes, attacks are generally limited to above the belt and even sometimes to the front part of the gi or uniform top.

To beat an opponent, you have to be able to attack from any direction and be able to respond or move quickly to seize an opportunity. For example, if an attacker tries a spin kick, you may be fast enough to block the kick and stop the attacker’s spin, exposing his or her back, including kidneys. A quick punch can score a point or end a fight on the street.

In short, sparring matches train students to instantly recognize an attack and react instantly to block it. Some sparring drills even pair two or more attackers against one student, increasing the likelihood that an attack will come from any quarter from anywhere around her. The student must also be able to switch tactics swiftly, going from a block to a kick to a punch, without even thinking consciously about it. Basic skills, such as balance and footing, remain important, especially in a competitive match where the space could be limited and stepping off the mat or out of the ring could count against you.

Businesses in the Ring

Fighting is a last resort and should only be done on the street in a true emergency. Businesses, like our karate students, could face devastating emergencies as well. The threats can come from any direction in a 360° circle around the organization, even from within. Just like karate students use combinations of tactics to beat an attack, organizations have to be able to bring all the right tools and skills to the table to best protect against what could be a shattering experience as well.

For organizations, surviving a disaster is all about emergency planning and business continuity. Dealing with catastrophic events, responding immediately, protecting employees, and keeping the business productive is crucial. According to some studies, businesses forced to close during a natural or man-made disaster remain closed, forever, in one-third of the cases. One out of three businesses shut down for an emergency situation will never open again.

That idea alone should motivate most people to develop the organization’s emergency plans. However, it often does not. Why? For some reason, we humans are very good at rationalizing away the risks. In fact, there are several layers of denial that stop leaders from making emergency plans. I do not know who originally said it, but somewhere I heard the denial described as four layers:

• “It won’t happen.”

• “If it does happen, it won’t happen here.”

• “If it does happen here, it won’t be that bad.”

• “If it does happen here and it is really bad, then there is nothing that could have been done anyway.”

At some point, we have probably all rationalized some sort of potential emergency in the same way. Would you drive across town without a spare tire? Probably. You think the odds of getting a flat are remote. Or if you do get a flat, it won’t be that bad. You’ll call a friend to pick you up and go home and get the spare fixed and put it on the car. Or you’ll call AAA, the American Automobile Association. Or if the tire goes flat and you don’t have cell service, no one is around, it is pouring rain, and it is midnight, you might justify your decision by thinking that you would not have been able to put the spare on anyway under those circumstances.

Each of these denials is false. Disasters do happen, could happen to you, and could be very bad or dangerous. Last, even if it is bad, there are steps that could have been taken to reduce the risks or minimize the impact. In our tire example, having the spare is one step toward mitigating the risk of being stranded in the middle of nowhere. Beyond that, packing a raincoat, keeping a flashlight in the car, and checking that the right tools are there could all help get you back on the road as quickly as possible.

Background of Emergency Planning

The best emergency plan in the world will fail without leadership. Setting up the right structure to keep the response on track during a disaster or emergency is the first step to success. Fortunately, a great model has already been well tested and proved effective. The Incident Command System (ICS) is the structure developed that allows for flexibility while defining clear roles and functions to help navigate through a tough situation.

The ICS was first developed by the military and later adapted by crews fighting wildfires. As you can imagine, there were difficulties in coordinating response, allocating resources, and even planning what should be done. Crews were spread out across wilderness areas, each facing different challenges or needs. Multiple agencies were also involved, from local firefighters to sheriff’s departments as well as groups of firefighters brought in from out of state or other areas. Information from aerial surveillance had to be analyzed, strategies developed, and then the right resources with specific goals sent to the various areas around the fire to help contain it and protect homes or forests.

The basic structure consists of an incident commander who is ultimately responsible for all decisions. The incident commander is directly supported by a team, including a safety officer, security officer, public information officer, and liaison officer. There are several sections, each one in turn supported by a section chief who reports to the incident commander. The sections include operations, planning, logistics, and finance/administration.

The incident commander has the overall responsibility to determine what goals need to be accomplished and the steps to reach those goals. The liaison officer coordinates with any external agencies or groups that may be involved or have asked for help, such as the local office of emergency management or local police. The safety and security officers may be combined into one role and are, as the name implies, responsible for the overall safety and security of those involved with the emergency response. The safety/security role is to identify any threatening situations that could jeopardize responders and make recommendations to adjust for risks. The public information officer, or PIO, is responsible for any media statements or communications, as well as internal communications to employees or affected groups.

Once the incident commander has outlined the overall objectives, the other sections each take on specific roles to achieve those objectives. The planning team is focused on information: what is happening around the organization or externally, as well as gathering information on what resources are available. The planning team takes that information to develop a timeline outlining what needs to be done in the immediate future as well as down the road, even into the recovery phase.

The logistics group is responsible for finding out what resources are on hand, where the resources are, or how to get them. A large piece of this often involves getting a labor team set up. Depending on the type of emergency and the response needed, a labor team can help by providing runners to get information to the right people in the midst of chaotic communications. The labor team may need to help move internal equipment, evacuate customers or patients, direct traffic, or secure the facility.

The operations team is responsible for the “doing.” This team has to carry out the planned tasks and may be dependent on the supplies procured by the logistics team. This is where the rubber meets the road. If the emergency involves damage to a critical building, the operations team will be responsible for assessing and repairing the damage. Specific team members may include a cross section from across the organization, such as information technology personnel, especially if the disaster affects data servers or equipment. In a hospital, operations may be focused around clinical care, especially if the emergency is an influx of patients or involves the evacuation of patients to other care sites. The labor team put together by the logistics crew may be put to work in a needed role.

Next is the finance or administration section. This group is responsible for tracking expenses, purchases, payroll issues, time sheets, or any other item that reflects a cost to the organization. For example, during a blizzard, hospital staff may be forced to stay overnight to continue caring for patients. Nearby hotel rooms may be used to give everyone a chance to get some sleep and rest between shifts. The finance team tracks those expenses as well as who was working at what times. The administrative side also includes keeping a log of decisions made at the incident command level as well as collecting and keeping any related paperwork.

The Incident Command System is designed to be flexible. That means for some situations you may not need to assign a person to each and every role. For example, if the scope of an emergency is smaller or temporary, the same person may fill the role of the operations section chief as well as the logistics chief.

In law enforcement, the first police officer on a scene becomes the incident commander. His responsibilities include making sure the scene is safe, identifying what additional resources will be needed and what immediate goals need to be established, and beginning to work towards those goals. As other police officers arrive, he will assign them as needed, similar to how the operations chief would work. In short, the initial response and preliminary ICS may be one person and grow to include other officers, supervisors, and even other agencies, such as the fire department or paramedics.

Fire departments routinely use the ICS in an even more formal way. The initial fire truck on scene quickly becomes the command center and even uses that term as the radio identifier. Eventually, when a battalion chief arrives, that person becomes the incident commander and takes on that radio designation to provide continuity of communication for everyone in the field reporting back or requesting instructions from the incident commander.

The United States’ Federal Emergency Management Agency has numerous free courses available online that help train individuals on ICS. These courses are a great way to get those in your organization familiar with the type of command structure that should be used to deal with emergency situations.

Emergency Planning

The emergency plan is the guiding tool that the incident command team needs to best address disastrous situations. The plan should focus on four areas: prevention, mitigation, response, and recovery. Obviously, the planning needs to start long before any emergency actually happens.

The first step is to identify an emergency planning team. The team should include senior leaders or an organization executive to act as sponsor and provide key leadership where needed. Other members should include security, information technology, facility leaders or building engineer, and human resources. The team should be a cross section of critical aspects within your organization and include any departments that do have, or should have, some expertise in the emergency planning arena.

Once the team is formed, it should start by identifying potential risks or threats to the organization. For us, it is already done. Pull out the security risk matrix we conducted in  Chapter 4  and review the list of threats. The list included security risks, such as criminal events, which may or may not rise to the level of an emergency planning need. However, some criminal events, such as an active shooter, bomb threat, or hostage situation will definitely be part of the emergency plan.

Other threats may include weather, such as hurricanes or blizzards, and even strikes or work stoppages in vendor locations if that would essentially shut down the organization. Some of these topics will fall under business continuity and the steps that an organization should be prepared to follow to continue operations or business functions.

There is a concept called all-hazards planning, in which the emergency planning process takes a generic approach to develop the response for a wide range of threats, rather than a specific plan for each and every risk. While there are similarities in responses, the emergency response may be vastly different for each event. The first stages, such as forming the ICS, and gathering information, determining goals, and planning how to deal with the emergency may be similar. The actual details of the response will change.

I prefer looking at all the likely hazards and creating checklists outlining what needs to be done for each scenario. There will be some similarities with many of the hazards. For example, both hurricanes and blizzards will impact how employees, suppliers, and customers get to and from the organization and both could result in power outages. In fact, utility failure is another potential hazard, so there will be common ground as you create your list. The shared responses only have to be created in one plan, making the process simpler. And having a response checklist clearly identified for the emergency facing the organization will make it much easier to start the response.

Planning for the various potential disasters should revolve around several common themes: loss or damage to the enterprise’s buildings; lack of access to the organization; loss of utilities such as electricity, water, or heat; and injury or loss of life.

Damage to the organization or buildings can occur due to severe weather such as tornadoes, high winds, hail, earthquakes, or even blizzards where heavy snow could collapse a roof. There are man-made events, such as terrorism or accidents, that could result in damage as well. Whether the loss of the buildings is due to an explosion, weather, or a truck accidentally colliding with the side of the building, the result is the same. The common elements of the response should include an assessment of the damage, identify and relocate critical functions, determine the length of time the area will be out of service, and set up operations in another location to resume business.

After Hurricane Katrina, some experts recommended businesses set up a spare or backup facility in order to continue operating after a disaster. A separate site, located about 200 miles away from the original, would be accessible by car in case air travel was not possible, as we saw after 9/11. The site should include phones and computers with backup access to any servers or data needed to function. Presumably, during a disaster vital staff would drive to the location, set up in hotel rooms, and continue working.

A plan like this sounds good in theory, but I do have concerns that would have to be worked out in advance. One is the cost. It is hard to imagine very many organizations being able to afford equipping and setting up, plus securing and maintaining, a second location just for emergencies. Some companies will have satellite offices that could serve that function and could base their plans around that. For other companies, the idea may not be suitable. However, even a school may set up arrangements for transporting students to another facility if the school is not available. For a long-term disruption, a school may arrange to use local churches or send students to surrounding schools.

Part of the planning should definitely include making arrangements in advance and getting a memo of agreement or memo of understanding (MOU) before an emergency occurs to ensure that external resources will be available during a disaster.

Another central theme to consider in planning is the lack of access to the business. This could be due to weather, such as blizzard, with roads closed, or due to an evacuation caused by a bomb threat or even tied to the first theme and damage to the building that create an unsafe environment. Planning should also focus on how to continue functions for both a short-term situation and a longer-lasting event. A key planning concern is how to access vital data or technology. If it is a quick evacuation, planning also needs to include accounting for all employees and customers (patients, students, etc.) and confirmation that everyone is out.

For both damage and loss of access, security should be a high priority (see  Figure 9.1 ). Looters move into disaster areas quickly realizing that no one is present and valuables are exposed. When homeowners are forced to evacuate large areas due to wildfires, it is amazing how quickly come the reports of looters getting into the area, burglarizing homes, and stealing property from people already suffering. Business evacuations are no different.

  FIGURE 9.1 Empty or damaged buildings quickly become a target of looters or other criminals.

Emergency planning must include a secure operations component on how to secure the building whether with internal security or MOUs with local security companies to provide the right level of coverage to secure a facility. During a long-lasting event, fencing, locks, or other measures may be needed for complete protection of the property.

Utility failure is a very real risk. Some areas are served by aging infrastructure and utilities are increasingly targeted by cyber criminals attempting to hack and tamper with systems. Losing electricity, water, or gas can quickly turn a workplace into a useless shell. An assessment on how long the outage will last is one of the first steps to be taken. If it will last for a length of time, then you are in a situation where the building is essentially damaged and relocation may be necessary. Again, there must be access to virtual data or servers. In the case of power failures, access to retrieve hard copies of paperwork or other documents will be possible. In some circumstances, you may choose to continue to operate in the main location, such as during a loss of water. Water bottles can be brought in. Even toilets can be flushed with buckets of water. However, there is still planning to be done to determine the resources needed and the best course of action.

The last impact to consider during a disaster is injury or loss of life. In recent years, we’ve seen this in many forms. Letters containing anthrax or other powders cause disruption. Even if the powder is not anthrax or harmful, the threat is present and the situation has to be handled as an imminent menace. Bomb threats and actual devices, even a small pipe bomb, are another concern. In the last chapter, we talked about the risks associated with workplace violence, including active shooters. The planning process for a comprehensive emergency plan needs to include all possible serious violent acts.

During some violent acts, such as an active shooter, the best course of action may be for everyone to shelter in place. These incidents are often over in a few moments. There may not be any opportunity to assemble the incident command team, at least not during the incident. In this case, the planning should focus on prevention, mitigation, and recovery. The response is there, but it will be up to individuals or groups throughout to implement the plan, so advance training and practice exercises are critical to make sure the response works per the plan. During an active shooter situation, the incident command team may still be able to communicate but will have to rely on phones or conference calls, if it is safe to do so.

Accidents or fires are a common form of life-threatening situations. The emergency plan should focus on those types of hazards and the related risks. If there is a serious accident or fire, the plan needs to address coordination with first responders, such as the fire department, and provide information on what hazardous materials are on site and where potential victims might be located. The response also needs to include accounting for employees to make sure no one is left in harm’s way.

The Written Emergency Operations Plan

When everything goes haywire, trying to remember what to do amid the chaos is not going to be successful. The emergency operations plan (EOP) must be written and accessible. The plan is fundamentally a guide to deal with and overcome any disasters, so it should focus on the hazards, what to do, how to respond, and who will be doing what.

A plan can be as detailed as an organization wants. It may include the scope, list the planning team members, and outline authority and executive sponsorship. Since the heart of the plan is to be a tool during emergencies, I like to keep the EOP direct and on track. It can include specific appendices that list the detailed steps to follow for a given emergency, but somewhere there should be a practical guide.

Key parts of the plan include:

• Scope: i.e., address or locations covered by the plan identified here.

• Identified hazards from the security risk assessment.

• List of critical functions or assets: to help establish guidelines for recovery, organizational survival time may be listed here. For example, if a company has cash on hand to meet expenses for 17 days, then it becomes imperative to resume operations within that time or shut down.

• List of resources, including aid agreements or MOS with external resources.

• Trained incident command team leaders: some individuals may be specifically trained for certain sections, such as logistics. Every role should have at least one other person who can fill in. Larger organizations may have three or four people available on different shifts to create the ICS.

• Communications plan covering how teams and individuals will relay information during emergencies; includes how information will be provided to employees with updates on the situation.

• Media plan addressing how information will be relayed to local news agencies. Remember, “no comment” is not a viable media plan.

• Checklists: an appendix or supplemental tool kit that provides detailed goals and steps to follow for each leader in the ICS to guide the team through the emergency and ensure that critical steps are not overlooked or resources forgotten.

• Recovery plan: this will be covered in more detail in the next chapter.

The plan should be useable, practical, and realistic. Remember that the plan is for situations that are out of the norm; there will be chaos and perhaps even some panic among employees. A plan that is too complex or too detailed will not be read, understood, or implemented with the best results.

Trouble Spots

In every real emergency or disaster and every drill there are always problems. No matter how well the plan was prepared or thought out, nothing ever goes smoothly. Each situation is different and there are unexpected obstacles.

The most common problem, one that I’ve seen in every emergency, is a breakdown in communication—not necessarily a technology problem with radios, cell phones, static, or dropped calls, but more often the right information not getting to the people who need to know. When that happens, the wrong decisions are made based on faulty input, or critical steps are not carried out.

Communications will break down largely due to the “fog of war” mentality. Often in the incident command center so much information and feedback is being sent or received that the chain of command starts to fall apart. All decisions should strictly follow the chain of command and go through the incident commander. However, leaders in the field or even section chiefs start bypassing the incident commander in an effort to resolve problems quickly. The problem is that other section leaders are not aware of the change in the situation, available resources, or new problems encountered.

I remember one incident involving a mass casualty influx at a hospital. The command center was very calm and quiet, and it did not appear that anything out of the ordinary was going on. I began to worry about what was going on in the emergency department where the incoming patients were being treated. One of my team members came in to relay information and confirmed that the situation on the front line was extremely busy and chaotic and none of the sense of urgency or need for additional clinical support was being relayed back to the incident command team. The emergency department had begun calling other hospital units to send staff, completely bypassing the incident command (IC) center.

The reason this is a problem is that the incident command team and sections have no idea what resources are where or whether or not they are needed. On the flip side, I’ve also seen situations where those in the field are relaying vital information only to have it ignored. If that places others in danger or harm’s way, individuals will quickly work together changing the plans without passing the information back to the incident command center. This happened during one hazardous material spill when I was a police officer. Based on the information from those on the scene about the chemicals involved and the wind direction, officers realized that other officers were being sent into the “hot zone” to divert traffic. When incident command could not be persuaded to change the decision, officers communicated between themselves to change the plan, affecting the entire traffic pattern as defined by the incident command team.

The best way to mitigate some of the communication problems is through training. Everyone involved in the execution of the emergency plan should be well trained on the expectations and the communication portion of the EOP. The communications plan and training should include details on the types of information to pass through incident command and how to request additional resources. All involved individuals need to understand the specific roles and tasks and how that fits into the overall strategic goals of the emergency response.

During one evacuation drill, the plan had been trained to the labor teams that would be carrying out the drill with specific directions on where to move evacuees. Some of the units were assigned to move evacuees from one point on the floor to the elevators, but they were to wait for the next unit to take over at the point. The elevator teams were only supposed to transport people to the main level where another unit would meet them and escort them to the exit. However, once put into action some of the teams decided not to follow the plan. The floor unit decided to go ahead and transport people down the elevator. The elevator team meanwhile missed them and was waiting for the unit that had now left the area entirely, leaving more people behind on the floor who still needed to be evacuated. The idea may have seemed like the best course at the time to those individuals, but instead created confusion and unnecessary delays. It was also frustrating to the logistics section chief who was being asked by the operations chief where the units were that had been sent to the area to carry out the evacuations.

Another common obstacle is hesitation or failure to take action. Depending on the situation, there may be only a few minutes to start the EOP, including setting up the incident command team. Even in drills with a high sense of urgency, the acting incident commander was slow selecting team members and trying to gather information rather than providing early and clear instructions on what steps everyone needed to take.

For example, during a bomb threat a search should always be carried out. If there is a suspicious device on the grounds, it is obviously much better to find it as early as possible. The incident commander should quickly set up the team and set goals, i.e., searching the entire area, coordinating with law enforcement, and documenting or recording which areas were searched.

A mass casualty incident is another example where urgency is needed. As soon as information comes in that there are numerous patients due to an explosion, bus accident, or another hospital forced to evacuate, there are only a few moments before the first patients may begin arriving. The emergency plan for that type of situation needs to be implemented immediately, without delay.

Another common obstacle is a failure to fully debrief an emergency situation. If the incident command team was activated, a careful review of what happened, what went well, and what did not should always be done. The debriefing should include everyone involved and get the perspective of different groups involved in the response. As noted earlier, the view from the front line of the operations section might be very different from what the finance section was facing.

The review should be facilitated by someone looking to get constructive feedback. The findings should be documented. Perhaps most important, the findings ought to be used by the planning team and adjustments to the emergency plan or response made to correct any issues.

Conclusion

Each emergency or disaster will present unique challenges and problems. The response will never go perfectly, and everyone needs to be able to adjust and remain flexible. Fortunately, with careful planning and willingness to learn and adapt, supported by training, the employees will be prepared to support the emergency response and help shift the focus back to recovery as soon as possible.

Business Karate Belt Level

Test your company’s karate belt level in the discipline of awareness/stance. If your organization meets each belt level and all the standards of the lower belts as seen in  Figure 9.2 , you have then achieved that color level.

  FIGURE 9.2 What is your belt level?