Risk managers preparing for disasters can learn a lot from the very first known practitioner of catastrophe mitigation, who took to heart advance warnings of a calamity literally of biblical proportions, took extraordinary safety measures even though there was no sign of any immediate threat, and who endured extreme ridicule for his preparedness efforts. That risk manager was none other than Noah of the Old Testament.

“Noah was the first risk manager. He underlines the importance of due diligence,” according to Jay N. Rosenblatt, a partner at SimpsonWigle LAW LLP in Hamilton, Ontario, who pointed out that it wasn't raining when Noah built his famous ark to save the world's animal kingdom during the great flood.

Mr. Rosenblatt, whose law firm provides legal services and strategic advice, said that a major danger to risk managers is lack of awareness of their catastrophe risks.

“The first thing is to let people know there is a problem,” he said. “I've realized that having business interruption insurance is great, but if it isn't hand-in-hand with a business continuity plan, it's probably not going to be of any benefit, because if the company doesn't survive the disruption, then what good is business interruption insurance?”

If there is a catastrophe, he noted, an organization's senior management “often believes business interruption insurance will take care of everything,” when in fact “they may not even be able to open up again.”

Formulating a comprehensive continuity plan is therefore critical, he added, because it will “continue the flow of money, and that's what feeds the business and the stakeholders.”

Risk managers of larger companies striving to put an effective continuity plan in place are sometimes handicapped by their firm's structure, he observed.

“They have to find the senior person who is accountable, or if they can find their way to the board room–because at the end of the day, it all ends up with the board,” he said. “If the board is not considering the [catastrophe] issues as well as monitoring and keeping track of what's happening, they're going to be responsible.”

The biggest risk of all, he warned, is faced by an organization's personnel–so risk managers must focus on protecting their health and safety, as well as how to get them back on the job as quickly as possible after a disaster strikes.

Next is the supply chain's vulnerability to a natural or man-made catastrophe. “If the supply chain isn't resilient, whether suppliers, sub-suppliers or the customers, the company is not going to be resilient. It won't continue and the employees and management won't have jobs,” he said.

Members of the supply chain, he explained, which can include many types of suppliers, also need business continuity plans of their own to remain reliable partners.

“I'm trying to get people to verify that suppliers have a business continuity plan in place,” he said, noting this can be done in several ways, by seeing to it that an organization:

o Audits suppliers.

o Asks suppliers to provide a certificate showing that a certified continuity plan is in place.

o Secures agreements with representations and warranties verifying that a continuity plan is in place, that the plan has been tested, and that it works. “If there is a problem with [violating] the contract they can be sued,” he suggested.

Mr. Rosenblatt warned risk managers need to realize that “not only should their suppliers have [business continuity planning] in effect, but also their suppliers need plans. Otherwise, you can have a tsunami effect that can take you down anyway.”

The same goes for an organization's key customers, he added, noting that “if they don't have something similar in place, they're not going to be able to pay.”

In fact, insurers, he reported, are starting to check a company's continuity plan, as are banks, to make sure they are prepared for a worst-case scenario.

“When [lenders] are either doing a new loan application or an annual renewal, they're looking at that and they're going to be looking at it even more, as will regulators,” he noted.

Risk managers, he said, can get a foothold with decision-makers by impressing upon their organization that having these plans in place may help them get a better rating or could lower the firm's insurance premiums.

Brokers, as well, can add value by negotiating reduced rates for clients with a comprehensive, tested contingency plan in place. He said brokers can help spread the word of the value of such plans by pointing out how sound contingency planning can help them secure not just lower insurance rates but better coverage terms and conditions and higher limits.

Mr. Rosenblatt also noted that any company wishing to do business with a major retailer will be required to have a supply chain continuity plan to do business. “Those that don't have this,” he said,” risk not getting–or losing–the business.”

Charles Bauroth, technical operations manager for Liberty Mutual Property, based in the company's office in Weston, Mass., pointed out that while there are large natural disasters with a broad effect, such as Hurricane Katrina, risk managers must also be prepared for smaller-scale but no less disruptive disasters.

When hurricanes such as Ike hit, which happened three years after Katrina, “people were reminded of the difficulties of evacuating a large population. When we saw everybody trying to leave Houston, that reminded a lot of risk managers that it might not be as easy to implement a plan as they might have thought.”

More recent disasters, he said, have included floods in Massachusetts, Rhode Island and Nashville. He pointed out that hailstorms and tornadoes also just pop up, often occurring with weather fronts that move through the Midwest.

“It's ongoing. These events are reminders to risk managers that they need a plan in place,” he said.

Mr. Bauroth believes more risk managers are starting to get the message and drive home the importance of contingency planning with their senior managers and boards of directors.

“I think the sheer number and the geographic spread of events over the past couple of years has required risk managers to ask if they have a plan, first of all, and whether it is adequate, and whether it addresses the specifics of the exposures to my locations or my company,” he said.

Mr. Bauroth noted a few variables influencing risk managers on disaster planning. “One is the economy,” he noted. “Most likely the economy has affected business with reductions in capacity, shuttering plants and reduced personnel.”

This points to the need for risk managers to continually review and update a business continuity plan to reflect the latest realities on the ground.

“If a particular operation no longer exists or is closed down, or if certain employees who would have implemented the plan are not around, or a certain supplier is no longer available, it requires you to really look at your plan and ask if it's still adequate for the exposures,” he advised.

Another factor to note is the interconnectedness of aspects of an organization and the impact the economy has on this.

“If you had two facilities that were supplying the bulk of your plants, but these two facilities did all of your manufacturing, maybe you only have one now,” he said. “So that really increases the importance of having a plan, in case that one goes down. Or maybe you were dependent on just a couple of outside suppliers and they are not all there anymore.”

He noted that as well as securing the supply chain and checking company operations, risk managers need to remember to review any contracts that might have been set up with outside vendors as part of the continuity plan.

“They may have shut down or gone out of business,” he said. “So you need to make sure there are still people there to fulfill those contracts. Once the disaster happens, that's not the time to go looking for resources,” he emphasized.

Property and casualty insurer Zurich offered some advice in the wake of the hurricane season, now in force through Nov. 30. The time for property owners to worry about hurricane preparedness and safety isn't in the hours before a storm hits–it's right now, Zurich stressed.

“We have all witnessed the tragic devastation that hurricanes can wreak on buildings, homes, communities, and people's lives and livelihood,” Armand Fernandez, chief risk engineering officer for North America at Zurich Services Corp., said in a statement.

“During a storm, the primary concern is getting individuals to safety,” he said, adding that the best time to plan for business continuity as well as protection of people and property is “in the days, weeks and even months before hurricanes strike.”

Zurich recommends that businesses in hurricane-prone regions implement an emergency action plan that Mr. Fernandez suggested “should be a living, breathing document that is reviewed and updated at the outset of each hurricane season.”

Special Reports /

How Sound Is Your Firm&#039;s Disaster Contingency Plan?

Related Stories

Recommended For You

How Sound Is Your Firm's Disaster Contingency Plan?