Terrorism Risks Can Be Managed

Risk managers must be well-prepared to deal with all types of emergencies, including terrorism. The planning process includes risk assessment, mitigation where practical, organization of resources, and development of procedures for response and recovery.

Terrorism risk is measured by the probability of attack, vulnerability of people, assets and operations, and the magnitude of consequences. Risk managers need to understand whether their businesses are a target or whether they could be subject to collateral damage if an adjacent site is attacked.

Assess the vulnerability of people, buildings and operations to attack, and identify opportunities to mitigate the exposure. Site selection, placement of buildings on site, space management, physical barriers, operational security, and protection of critical utilities can all help mitigate exposure.

Understand the potential consequences of an attack to determine the investment warranted for mitigation, response and recovery. For example, financial services firms have traditionally budgeted a significant amount to ensure they can resume critical operations promptly. Comply with regulations such as OSHA standards that require emergency planning, and others–particularly for financial services and healthcare firms–that require recovery planning.

Effective response to a terrorist threat requires organization of teams and the development of procedures specific to each threat. An emergency response team led by a capable incident commander should be organized.

The emergency response team must be trained to recognize signs of potential attack, since evidence of a chemical or biological attack might not be readily apparent. The ERT must evaluate the threat and respond promptly to safeguard building occupants as well as physical assets and operations.

Procedures should include evacuation of building occupants to a safe location, or sheltering them inside if an airborne hazard exists outside. Accounting for evacuees is critical but very difficult. Updated information and multiple means of contact might be required to account for all employees after a major incident.

A corporate or executive-level crisis management team should be organized to assess the impact of the attack on the company as a whole, determine the most effective course of action, and communicate with internal and external stakeholders.

Recovery of critical functions should be assigned to a business recovery organization. Information technology and communication systems are critical, and most companies have recovery plans in place. However, plans should also address other critical functions, including supply chains, service and other functions.

Prompt and effective response requires response and recovery organizations to be so well trained that they can respond almost instinctively. Plans must also be kept up-to-date as personnel and operations change. Connect with police, fire, emergency medical services and emergency management officials to coordinate your plans with theirs. Establish conduits for effective communication–so you can receive official information promptly.

Today, risk managers must be prepared for terrorist acts–the welfare of employees, the protection of physical assets, and even the survival of the business itself might be at stake. Remember, the actions taken in the critical initial minutes will often determine the ultimate impact of the emergency.

(Mr. Schmidt is co-author of a new book, “Business At Risk: How To Assess, Mitigate and Respond To Terrorist Threats,” published by The National Underwriter Company. To order, call 1-800-543-0874.)

Donald L. Schmidt is senior vice president, managing consultant and operations manager within the Risk Consulting Practice of Marsh in Boston.

Reproduced from National Underwriter Life & Health/Financial Services Edition, April 22, 2002. Copyright 2002 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.