By Simon Iliffe, Unimutual Risk Manager

Disruptive events by their nature occur at inopportune moments and at worst can blindside institutions.  They tend to fall into two categories, being either:

1. Traditional disruption; or
2. Technological disruption

Traditional disruptive incidents typically include events such as a large building fire; natural catastrophes including cyclones, floods, storms, bushfires or earthquakes; and civil unrest, sieges, lone shooters and terrorist attacks.  They are events which render all or part of a campus unusable for a period of time and may involve denial of information technology infrastructure or other services to the campus, but are largely manageable and containable.

Technological disruption, on the other hand, arising from cyber-crime or third party introduction of emerging technologies or service offerings in direct competition with your institution, may not be immediately obvious nor directly manageable and can be difficult to contain.  They often constitute a major change in the way a function is performed or a service is delivered and are attractive to users in respect of their ease of access and keen pricing.  Responses to these types of technological disruption requires a degree of organisational resilience and agility and perhaps even a paradigm shift.

In this edition of “disruption as usual” we look at the key issues to consider when faced with recovery from a “traditional” disruptive event. In future editions we will examine the differences between traditional and technological disruption in terms of manifestation and response as well as the importance of organisational resilience when adapting to disruption.

Responding to traditional disruptive events

The three most common causes of “traditional” disruption amongst the Unimutual membership are storms (wind, hail and super cells), building fires and to a lesser extent bushfires and flooding whether it be internal pipe failures, overland flooding of buildings due to intense rainfall or riverine flooding.  Naturally, the degree of disruption will vary dependent upon the extent and intensity of the event.

Effective and efficient response to and recovery from a traditional disruptive event is predicated on sound risk management, emergency management and business continuity planning.  The pathology of traditional disruptive events tends to be linear and will occur in three distinct phases, each of which require different management techniques; firstly, when a critical incident or emergency occurs, the nature of incident must be assessed and the situation contained and controlled; secondly, once under control, the extent of the loss must be assessed and triaged; then recovery can commence.  Often, the manner in which emergency management and triage are conducted will impact upon the nature and extent of the recovery process.

Much has been written about the “how to” of preparing your emergency management (EM) and business continuity plans (BCP) and it is not the purpose of this article to revisit the theory, rather focus on aspects of the plans which will allow you to be “situation ready” and adaptable when under pressure.

Emergencies on your campus will often be managed by response agencies such as the police or fire brigades with university security and facilities staff performing a support role.  Understanding response agency procedure will not only facilitate smooth transition of incident control and management but also improve response times in relation to site containment and access control as well as identification of services and shut – off locations.  Some tips for the emergency management phase include:

1. Identify and involve all the stakeholders when developing the EM plan. A little pain upfront will alleviate a lot of post event discomfort
2. Develop a pocket EM checklist for security and facilities staff
3. If possible take a seat on the Local Emergency Management Committee (LEMC) – This provides direct access to the local council and all the response agencies
4. Have ready access to services diagrams
5. Practice deploying site containment equipment
6. Utilise social media to alert staff and students

Business continuity planning

Again, when developing your BCP, consult with and obtain input from stakeholders across the institution in the knowledge that a disruptive event could happen anywhere, anytime.  The following considerations are some of the more important aspects of business continuity planning and include:

1. Know your business interruption exposure scenarios and risks
2. Understand which business functions and systems are critical to operations
3. Determine how long you can continue to operate without these systems and functions before reinstatement becomes critical. This known as the Maximum Allowable Outage (MAO)
4. Identify acceptable workarounds that can provide short term system and function replacement
5. Establish relationships with key contractors and suppliers whom you will rely upon during the early stage of the response and recovery phase
6. Test elements of your plan on a regular basis

Interested in how other Universities are developing their BCPs, then why not join Unimutual’s BCP Special Interest Group and learn from the experience of others?  Alternatively, the mutual has available to its members a range of resources and contacts which may be helpful during the EM and BCP planning process which include:

• The BCP checklist is designed for use by a University business unit, including schools and faculties
• The campus threat checklist is designed for use by any University campus
• Fire and Bushfire risk management checklists
• Adverse weather and flood checklists