Would your business stay afloat?
We recently presented at the Resilient Scotland Conference in Edinburgh – our topic was the importance of considering potential impacts from flooding in your business continuity plan. Sadly, our topic was all too topical, with Storm Ciara and Storm Dennis wreaking havoc over recent weeks, so now seems like a good time to re-iterate some of the points we discussed. Let’s set the scene a bit on WHY this topic is one you all need to consider.
Perspectives on flooding …
Those of you who know me personally will know that as well as my current role with Alert Cascade, I also have over 20 years experience across the fire service and local police force. So, whilst I’m not a flood expert per se, I’m in the unique position of being able to talk about the organisational impact of flooding from 3 very different viewpoints:
I was fortunate/unfortunate enough to be working with Lincolnshire Police during the Boston Floods in 2013. For those of you who don’t know where Boston is, it’s a town and small port in Lincolnshire, on the east coast of England, with a population of around 70,000. Now, the Boston Floods were part of a larger story – from early December 2013 through to February 2014, the UK experienced a spell of severe weather with a series of storms that had widespread impacts.
Immediately before the tidal surge we’re going to look at, storms led to Scotland’s rail network being shut down, 100,000 homes were without power, and there were flight cancellations at Glasgow, Edinburgh and Aberdeen airports. The tidal surge that affected Boston was felt along the whole of the east coast of England, and was the largest surge since the “great storm” of 1953. But just looking at the level of impact flooding had in that one town, you can see the levels of devastation that were caused:
The Boston Floods had a very fast moving timeline – the initial early warnings came in on 2nd and 3rd December, and at that time, this was deemed to be a relatively low risk event – “very low likelihood of significant coastal impacts on the east coast of England”.
Over the course of the next 48 hours, this moved to an “amber” threat level for Lincolnshire, and by 11.05am on Thursday 5th December, Northern Power Grid had declared a major incident, Lincolnshire Police had recorded multiple weather related incidents in quick succession and an “emergency” had been declared, as defined by the Civil Contingencies Act.
In practical terms, that meant all available resources were mobilised – Lincolnshire Police were working on traffic management, evacuation support and public safety, the Fire and Rescue Service were leading flood rescue and high volume pumping, early school closures were initiated, evacuation of vulnerable locations began, and military assistance was granted to support evacuation. By 2.30pm, the threat level was raised to “Red” and the Environment Agency issued severe flood warnings to 12,300 properties in and around Boston. By 4pm, 35,000 properties in the north of Lincolnshire were without power. At 8.32pm, the first critical high tide hits Boston … and that’s when you start to see scenes like the one in the photos here:
What’s really noticeable if you look at this timeline, is the recovery phase … 2 days of flooding led to 3 months of recovery time. If your business, or more importantly your people, were based here, how would this affect you?
The Boston floods viewpoint is very much a “boots on the ground” perspective, but as I mentioned at the outset, I’m also the Director of a business that organisations around the globe rely on to provide a mission critical, 24/7/365 service. We’re a software as a service company, so as you’d expect, our data centres, servers, the platform itself etc are truly resilient – we wouldn’t be in business if they weren’t.
But our business isn’t just about our software, it’s about our people. We’re a diverse organisation, with people based in different locations and having different needs. For us, the biggest part of our flood risk planning has been breaking it down and making it more granular – there’s no one size fits all and no magic want unfortunately, but the biggest piece of work we had to do was information gathering. You wouldn’t have offices in 5 different places then use a generic business continuity plan across all 5 locations (or at least I hope you wouldn’t!), and having a flood plan as part of your BCP is no different. I talked about the tidal surge causing coastal flooding in Boston, but here in the UK we also have river flooding, surface water flooding, groundwater flooding and sewer flooding.
For our own business, we’ve set up some basic “checkpoints” for things we need to consider internally when we’re dealing with flooding. Some of them probably seem like common sense, but having them documented in our plans means we’re leaving as little as possible to chance. And some of our checkpoints are there because we’ve learnt from past experiences (both our own, and those of our customers).
For example, did you know that in some areas it’s a deliberate policy for council car parks to be built on flood planes so they have an area available to divert water to if needed? So when you’re thinking about commuters and whether they will be able to get to work OK, it’s not as simple as just checking the roads are open or the trains are running – will they be able to park at the train station in the first place? Another valuable point for us is remembering that our staff have responsibilities outside of the workplace; much like the advice we’re seeing from the BCI about the COVID-19 outbreak, one of our key checkpoints is preparing for the fact that flooding can lead to school closures, which leads to staff members needing time away from work or flexible working arrangements at short notice. This doesn’t just affect those specific staff – it puts increased pressure on remaining staff who will probably have increased workloads in the short term, so our plans include ways we can help our teams deal with that pressure.
A vital part of our planning is to look much wider than our own office environment – it’s not uncommon for residents and businesses to be asked not to flush toilets during the immediate aftermath of a flood, as the local authorities work to ensure the infrastructure is stable. So, our staff may be able to get to work, our offices may be accessible, power is on etc, but there are no welfare facilities available for them to use. On the flip side, staff may have no toilets, showers or washing machines at home, or may be dealing with a huge amount of stress. During the Boston Floods of 2013, approximately 40% of homes that were flooded were uninsured against that risk. We’re not here to be “big brother” and know every detail of our people’s private lives, but we do have to be realistic that staff having to deal with that level of stress in their personal lives are unlikely to be thinking about work as their top priority … and rightly so.
From our perspective, all severe weather has the potential to impact our people, but the impact of flooding can be much more wide reaching, much more variable, and much more long lasting. So, rather than having a a single fairly static flood plan (like we would maybe do for an internal IT issue), we have lots of mini plans that cover each specific risk element that sits under the flood umbrella, allowing us to quickly pivot as the situation changes. All of this though, relies on accurate information and regular communication with your staff – plans that aren’t communicated to anybody won’t get you very far!
The final perspective to share with you, is that of the people who use our mass notification and incident management solutions. We’re extremely lucky that because of the services we provide, we have the opportunity to learn from our customers and their experiences. We work with organisations around the globe, as well as providing communications support for organisations whose role involves being deployed to provide assistance abroad during natural disasters. So when we’re doing quarterly account reviews, we get to see the whole picture, not just what’s in the news.
In 2019, 64.8% of UK customer deployments of the Alert Cascade mass notification service related to severe weather events. Looking at customers who we specifically knew had been affected by flooding of any type or scale, there are some common themes that emerged when we spoke with them.
Obviously, these are Alert Cascade customers, so we know they have a mass notification system in place, but more than that, they had access to a good range of other technology that allowed them to work more flexibly to minimise the effects of flooding. The ability to work from home (or another safe location) was vital; we often saw organisations proactively advising staff to work from home rather than to risk driving in potentially unsafe conditions and this was really aided by the fact that they had contingency plans they could activate to allow flexible working.
These two themes overlapped in a lot of places. Overall, customers told us there was a real sense of working together to keep things moving, and that constant communication was key to this. It was important that communication was targeted though, and not “one size fits all”. Whilst all staff messaging worked well for initial information sharing, customers quickly moved to being more strategic with their notifications; two way messaging was vital as it enabled organisations to share information quickly and easily but also to gather meaningful responses from the recipients, and use those responses to make informed decisions about the way forward. Those of you who heard our Resilient Scotland presentation last year might remember that I spoke about the fact that nobody is resilient in isolation, and that’s really what came out here as well; during an incident, feedback was there was a heightened awareness of just how much each area relies upon, and interacts with, other areas within the business.
We live in a very interconnected world, and some staff relied on social media for information rather than trusted sources. This had two effects – firstly, that staff were forming opinions and making assumptions about whether the office would be open based on incorrect information. Secondly, frequent misinformation and hyperbole about the severity of local weather caused some staff to be totally unaware when there was a genuine issue; they were so used to seeing/hearing about “The worst storm for XXX years” that they ignored weather reports in general. Roughly 5.2 million business and residential premises in the UK (one in six) are at a significant risk of flooding, and are eligible to receive free flood warning alerts, but only 41% of those occupiers have signed up to the service. When it comes to business continuity, this meant that sometimes it was a case of the blind leading the blind as no-one in the teams responsible for managing an incident had signed up for the free alerts. A major learning point for some of our customers was that the business continuity or resilience team need to be in the know about potential weather related incidents, and many have now made it standard practice that their team members are signed up for these alerts.
Plans written by people who don’t know the area, without involving people “on the ground”, tended to either have large knowledge gaps, or to be too complex because they attempted to cover every single possibility … no matter how remote the chance of it happening. When we spoke to more enterprise level customers, we received some feedback that although flood plans were in place, they tended to be technical in nature and overly focused on systems and processes whilst often missing what some staff saw as common sense points. The best advice we can give here is to actively involve the people who will be affected by your plans in the actual planning; not only will this give you valuable local information, it will help those staff take ownership of your resilience processes. Although organisational resilience and business continuity teams will often lead the way, resilience is everyone’s responsibility.
This was the biggest negative that came out of the feedback we received. Without up to date contact data, perfect plans and clear, concise communication went nowhere. We saw some customers attempting to carry out data imports mid incident as it quickly became apparent that contact data had not been maintained. System wise, there are no restrictions on the number of data imports our customers can carry out, and we offer 6 different data maintenance options off the shelf, so there are no technical reasons why data isn’t kept up to date. When we carry out our quarterly reviews, we often score ten out of ten for our data maintenance ease of use, and most imports take under ten minutes, so it isn’t that this is a complex process that needs heavy resources. What sometimes seems to happen is that data maintenance is seen as a low priority task; if a mass notification system is seen as an insurance policy, then some organisations gamble on never having to use it and therefore keeping it up to date isn’t high on their list of “Important things to do today”. Some customers also gave us feedback that internal silos caused them problems – data maintenance was seen as someone else’s job (usually the HR team). So even though the business continuity team are relying on being able to use that contact data in an emergency, they’re not necessarily working with HR to make it clear how important it is.
Flooding was rarely a specific part of the Business Continuity Plan, so sometimes no-one knew whose job it was to monitor for severe weather. Even when someone was actively monitoring for flood alerts, there was still a grey area about when to invoke a BCP, when to communicate with staff etc, and this sometimes meant nobody actually took the decision to invoke a plan. This was particularly true when it was a low level incident i.e. surface water flooding.
3 very different perspectives … working in the emergency services on the ground in a major incident and seeing first hand how it affected people and businesses, being responsible for ensuring my own organisation can continue to provide mission critical services to customers, and seeing those same customers dealing with flooding affecting their organisation. Across all 3 perspectives though, there are some clear commonalities and things it is worth considering in your own organisations.
Most importantly, your people are your primary asset. Flood plans that focus on protecting your premises will not actually protect your business. You need to look wider than that – your premises may be hunky dory, but can your people get to them safely? Do they need extra support? Have you given them the tools they need?
Secondly – the aftermath requires just as much planning as the actual incident. Water recedes and drains away but your staff will be dealing with road closures, train delays and high levels of stress for months to come.
Communication and collaboration are vital – allow your staff to feedback into your plan, and give them a route to forward on new information during an incident. You may know that there’s a flood warning for the region, but your staff may know that a specific road has a diversion in place, or that there’s standing water on a certain street.
And finally – iteration is your goal here, not perfection. Plans should be continually refined and improved, not written once and reviewed annually. You wouldn’t have a cyber risk analysis that stayed static for 12 months, so why should your flood plan?