Hurricane Harvey dumped over 51 inches of rain — or about 27 trillion gallons of water — on Texas and Louisiana last summer, more than four times the amount Louisiana and Mississippi received from Hurricane Katrina in 2005. Harvey caused catastrophic flooding, displaced tens of thousands of people and caused over US$180 billion in damage. It also provided a real-time test of business continuity plans (BCPs) for thousands of organizations.
Nothing beats a real-world, catastrophic event to reveal the strengths and weaknesses in a company’s BCP and disaster recovery program. However, as destructive as Hurricane Harvey was, the business disruption many companies experienced was not technological in nature. Rather, it was due to their inability to access their facilities and get their workforce back up and running quickly after the event.
Prior hurricane events in the Gulf Coast region, like Katrina, had already underscored the need for businesses to consider the potential for a post-disaster outage lasting a month or longer. Even so, few companies in Harvey’s path had considered a scenario in which historic flooding would make it impossible for their entire workforce to come to the office for weeks — or force many of their employees to leave the area entirely and indefinitely.
After talking with several companies impacted by Hurricane Harvey, we have identified four critical areas where organizations need to improve future recovery plans to minimize the impact on their basic business operations and help their teams get back to work quickly:
- Communication to Employees
The top challenge in any significant emergency or outage event is communicating with employees, customers and other key stakeholders. Effective communication is critical to any crisis management response plan. Yet time and again we see companies fall short in this area.
In the aftermath of Hurricane Harvey, some firms used “blast communication” technologies to reach out to their workforce digitally. Some posted updates only on their website, while others relied on the low-tech “call tree” approach to reach critical personnel. Regardless of the technology or methodology employed, the key struggle for many companies was to communicate meaningful updates in a timely manner. Systems increasing in popularity are those that allow employees to respond to text communications, providing positive acknowledgement to management that their workers are safe after the storm.
- Remote Work Capabilities
While Hurricane Harvey was historic in the amount of rain that fell, the Houston area was spared other more typical hurricane impacts such as significant power, cell phone tower and internet outages. As such, most corporate IT systems were up and running; however, employees had to work from home because movement throughout the area was all but impossible. That created a massive test of organizations’ ability to have their entire workforce operate remotely.
While some companies had plans in place for some level of remote connectivity, the ability for all necessary personnel to connect remotely for a long period was truly tested. Many organizations found they didn’t have enough virtual private network (VPN) connections to allow the broader workforce to connect simultaneously. The increased use of web-based applications and software-as-a-service (SaaS) models helped to mitigate the impact of not being able to access physical buildings, but such reliance is a risk itself, in case of an Internet outage. Fortunately for this event, that wasn’t an issue. However, it is something companies must evaluate to ensure multiple internet service providers’ (ISPs’) network connections and redundant communication lines are considered.
- Access to Key Personnel
When homes across a region are flooded, it creates a life safety issue for workers and their families. People must ensure their families and loved ones are safe and have appropriate shelter; obviously, they will prioritize those efforts over any workplace demands. The impact for companies is that they may not have access, for some time, to critical personnel needed to carry on essential business processes.
After Hurricane Harvey, people needed to find shelter, rescue belongings and make go-forward plans – a period that took days and even weeks, in some cases. Several companies we talked to said they hadn’t done a thorough job of documenting core processes managed by seasoned staff, or cross-trained other employees to manage those processes. So, many business-critical tasks languished until key personnel could reconnect and resume business functions.
- Employee Assistance
Hurricane Harvey is estimated to have destroyed more than 175,000 homes in Texas. Once recovery efforts began ramping up, businesses in hard-hit areas quickly realized that many of their employees were going to need a lot of support to get back on their feet.
Companies were scrambling to figure out how to get financial assistance to their employees in need, and how to prioritize those efforts. Some organizations organized rescue crews to help with home demolition, or provided food services and clothing to those in need. Others used social media channels like Facebook to set up private and group sites to communicate logistical needs and responses. And some organizations used social fundraising websites to collect funds for those impacted by the storm and subsequent flooding.
Social media provides a means to ramp up sites and communication vehicles quickly. However, for their response efforts to be effective, companies need to discuss how to address employee needs and distribute funds appropriately, and consider potential tax implications, before a disaster strikes.
Take Time Now to Document Lessons Learned
Companies should discuss what went well after Hurricane Harvey, and consider how they can improve their response plans. It’s a good idea to document the lessons learned so they can be used to prepare for future emergency situations. Many companies feel like they managed through Harvey and its aftermath with little impact to their business overall. But it’s important for these organizations to recognize that this hurricane only tested limited aspects of their BCPs, and that more tests are sure to come.
The national and global attention that Hurricane Harvey received provided some advantage for companies affected by the storm in that there was broad visibility and sympathy for businesses that faced post-storm delays in providing services or goods. Customers and stakeholders were willing to “forgive” companies for being in the path of this disaster, and needing time to recover. However, the marketplace is likely to be much less forgiving of a company that suffers a business continuity challenge for less apparent reasons than a hurricane. Organizations should view Hurricane Harvey — and the entire 2017 “disaster” season — as reasons to ensure their BCPs are up to date, and an integral part of their overall enterprise risk management efforts.
Dugan Krwawicz, Senior Manager in Protiviti’s Business Continuity Consulting practice, contributed to this content. For more insights, visit our Business Continuity Consulting page.
