Assessing Risk
Blog
Check Out Our White Papers
Over the years we’ve written a handful of white papers on risk assessment and security. Check them out by clicking on the links below.
Security and Risk Assessment in the Education Sector: A Case Study
Security and Risk Assessment in the Water Sector: A Case Study
Workplace Violence: Understanding the Issue
Active Shooter Statistics: Understanding the Issue
Understanding Bullying: A White Paper
Emergency Action Planning
Emergency Planning
Here at Invictus Consulting, we are all about emergency planning. Putting in the work before an emergency is critical. According to FEMA, “the number, type, and magnitude of decisions and problems that must be addressed during an emergency are a direct outgrowth of decisions that were (or weren’t) make during the planning process.”
It’s worth a detailed look into this statement.
- Decision-makers – The statement above from FEMA assumes that the decision-makers have been identified and trained during the planning process. But it’s worth re-iterating that your organization must identify and train the decision-makers before an emergency. We have come across countless organizations that have decision-making duties written into their emergency action plans that have never actually told the people who are responsible that they’re the responsible decision-makers! On paper it all looks great, but in an actual emergency no one knows who is in charge, no one knows the guiding principles for making decisions, and chaos ensues. Your emergency response team needs to be identified and trained!
- The number of decisions and problems – Think about how many decisions need to be made during an emergency. Obviously the type of emergency dictates some of this, but all emergencies require decisions, and if some of the decisions can be made beforehand, that will ease the burden of decision-makers during the emergency. Also, the more decisions that can be made before an emergency will put decision-makers in a better position to deal with additional (often unforeseen) problems that arise.
- The type of decisions and problems – Obviously the types of decisions and problems vary with the types of emergencies. A tornado barreling towards a school will require different decisions and pose different problems than a breached levee threatening to flood an entire city. This is why it is so critical for each organization to plan ahead. Tabletop exercises are one way to help decision-makers understand the types of decisions and problems they might face during an emergency. A written emergency action playbook for each type of emergency is another way to help decision-makers with their tasks during an emergency. Training is crucial here, as is a clearly defined hierarchy of who makes what decisions.
- The magnitude of decisions and problems – Training and planning ahead help prepare decision-maker understand the magnitude of their task and the magnitude of problems they may face during an emergency. Training for various emergency scenarios is essential, since the magnitude of problems that arise from closing a school early due to an impending snow storm are vastly different from those that arise from closing a school early due to an active shooter. Think about the magnitude of decisions involved in evacuation for two organizations, one with dozens of employees housed in a single building and one with thousands of employees housed in numerous multiple-story buildings on an extensive campus. The magnitude of decisions for something like an evacuation are simply not the same, and this is why organization-specific planning is fundamental to the safety of your people.
Include Everyone in Your Emergency Training
Here at Invictus Consulting we strongly believe in the value of training all of your people in emergency scenarios. Having a solid emergency action plan with different playbooks for different scenarios (e.g., tornado, active shooter, kidnapping) is the first step. The second step is actually training your people on what to do during the various scenarios. We’ve come across more organizations than we’d like to admit that actually have an emergency action plan but have never bothered to share it with their employees let alone train their employees on it.
Here’s the thing about training your people on your organization’s emergency procedures – you have to train ALL of your people. For schools, this means not only your teachers and administrators but also your cafeteria staff, para-pros, secretaries, school nurse, playground attendants, and any other staff member that would potentially be on campus during an emergency. For offices, this means not only your employees but also your Board of Directors, C-suite people, warehouse staff, temp people, and any other people that may be in the building or on the campus during an emergency.
Don’t assume that ancillary staff members, support people, or executives don’t need training. Even if these people are part-time staff or only on campus irregularly, they should still be trained. By excluding ancillary staff from training you risk two things. If an emergency were to occur while they were on campus or in the building, they wouldn’t know what to do. Obviously that’s a problem. But the second risk is that the people who haven’t been trained may either get underfoot in their confusion and panic, or they may attempt to do something that conflicts with your organization’s pre-set emergency procedures and thusly create confusion for those employees who have been trained.
We can’t suggest this often enough – you need to train your people; you need to train them frequently (multiple times throughout the year); you need to train them in different formats (e.g., live drill, tabletop exercise); and you need to audit your drills to close any gaps or reverse any problems that arise. By doing these things, your chances of making sure that ALL your people have been trained properly is greatly increased.
Apps for Emergency Planning
If you’ve been around this blog for any length of time, by now you know that we at Invictus Consulting advocate for everyone to have an emergency action plan. An emergency action plan tells your people what to do in the event of various types of emergencies (e.g., active shooter, tornado, workplace violence); an emergency action plan will tell your people what type of emergency is occurring, where to go, how to conduct themselves, their role as relates to other people (e.g., teacher’s role in terms of their students), evacuation procedures and routes, and other critical information. The other critical aspect of an emergency action plan is drilling that plan with your people.
Today we want to talk about making your emergency action plan mobile. There are a few apps on the marketplace that allow an organization to put their emergency action plan and accompanying documents in an easy accessible and mobile place. Let’s face it – our people (whether it’s our teachers, employees, executives, students, third-party contractors) have their mobile devices within arms reach at all times. What better place to have your emergency action documents than on people’s phones?
When looking at the options on the market, think about the following:
- Is the information on the app secure?
- Can documents be uploaded easily when parts of the plan change?
- Can the app handle images such as floor plans, evacuation routes, and other maps?
- Can the app be used offline so that people can view emergency documents even if there is no internet available?
- Is the app user friendly so that your people can easily use the app during an emergency?
You can find apps on your choice of app store by querying “crisis manager,” “emergency management,” “incident management,” “crisis plan,” or “mobile emergency response plan”. At this point in time there are only a handful of options on the market, but we are hopeful that over time more companies will put products on the market to give users increased options. If you are an app developer, consider creating an app based on the bullet points above.
Blogs We Like
Today we thought we’d share a very brief list of the security blogs we regularly check here at Invictus Consulting.
FEMA blog – we are all about preparedness here at Invictus Consulting, and the Federal Emergency Management Agency (which is a division of the Department of Homeland Security) is our go-to resource
Homeland Security blog – topics of interest to Invictus Consulting include critical infrastructure, disasters and preparedness, terrorism, and cybersecurity
Department of Labor blog – this is where OSHA issues are posted, since OSHA is a division of the Department of Labor and doesn’t have its own dedicated blog
Security Today blog – some of us at Invictus Consulting are gear heads, and we love researching cameras, card readers, and other types of physical security hardware; Security Today is a great resource for this
Security Management magazine – Security Management is a publication of ASIS (American Society for Industrial Security) and one of the industry leaders
Campus Safety magazine – we work with a lot of schools here at Invictus Consulting, and Campus Safety is a great resource for all things security related in education
Columbine Shooter’s Mother Speaks
The mass shooting at Columbine High School in April, 1999 changed the way SWAT teams operate; it changed the way administrators and parents view security at schools; it changed the national discussion about gun violence, mass shootings, and school bullying.
In the worlds of security, risk management, and law enforcement, we don’t like to give power to mass shooters by posting their name(s) – this can tend to glorify the act of being a shooter, bring notoriety to the shooter (which is sometimes the motivation behind a mass shooting), and detract from the names of the victims. So while we name victims of mass shootings, we do not name the shooters. (The media generally doesn’t follow the same line of reasoning; shooters are frequently named, their history is usually researched, and often their media coverage overshadows that of the victims.)
With that said, the mother of one of the Columbine High School shooters recently decided to speak out about her experience as the mother of one of the shooters. Her TED Talk does not glorify mass shootings, it is not a case for increased security at schools, and it is not a diatribe on gun violence; but it is worth watching, given how significantly the mass shooting at Columbine was for our nation.
Happy Holidays
Mass Notification Considerations
Mass notification is a critical part of emergency planning. Without a way to alert your employees or students about an emergency, you have no way to manage your most valuable assets – your people. Imagine a scenario where an active shooter is in the main lobby of your multi-story building. You have no formal mass notification 
system, so someone pulls the fire alarm in an attempt to alert people to the shooter. Because people have been trained to exit the building when they hear a fire alarm, most of your employees dutifully shuffle down the stairs to make their way out the main entrance. In other words, they head straight to the location of the shooter. Proper mass notification in this situation would have altered your employees to the nature of the threat, it would have initiated a lockdown procedure, and it would have kept other employees from coming into the office at that time.
When considering installing and implementing a mass notification systems, decision-makers should consider the following points:
- Will it include the ability to send text messages to users?
- Will there be ways to alert users who do not have their cell phones on hand (e.g., scrolling marquees, email, audible sounders)?
- Is the system easy to maintain? Will the vendor/installer work with you if problems arise?
- Will it be easy to add new users as necessary?
- Will the system be user-friendly?
- Can the system be integrated in to your security management system?
- Will the system be easy for administrators/executives to use during an emergency?
- What are the upfront costs? What are the monthly costs?
- Do you want the system to have bi-directional communication (e.g., ability for users to give feedback or respond to certain alerts)?
- Do you want maps to be part of the system, where users can view a map of where the emergency is occurring?
- Do you want to be able to send alerts to various audiences (e.g., employees only, certain office locations only, executives only, etc.) rather than all users?
- Will the system support your organization’s emergency action plan?
There are many mass notification systems on the market, and there are many features that can be included in whatever system you choose. Mass notification is such a critical facet of emergency preparedness – it is important that your organization have some way to alert your people of an emergency or threat. Make sure you get the right system for your organization’s needs, size, types of users, location, and culture.