Disaster planning for the World Trade Centre (WTC) was good – the problem was that the sheer scale of the disaster had not been anticipated.
Until now, common business practice has been to estimate the best and worst cases of an individual risk occurrence and attempt to plan for the worst – the compounding of risks was rarely considered worth calculating.
It is not known why such a worst-case scenario plan was drawn up for the World Trade Centre. However, in other organisations, this is partly because the science and process behind such calculations is difficult, partly because resources are not present and partly because many risk managers feel lucky when they manage to persuade management to allocate any significant level of spend at all on the management of what the board may have considered to be an unlikely set of events.
The challenges compound. As risks and consequences increase, so does the necessity for a combined and co-ordinated approach. As this grows, so does the number of stakeholders, each with different commercial and ethical views on the above and below the line costs of implementing such plans.
Given the high-profile use of the WTC, the only measure that might have made a difference was the regularity and manner of rehearsals, the adoption of a “status” indicator on each floor and a new design for the emergency exit routes. But the only way such measures can work is if they are well published and known by as many inhabitants as possible. The very publication of such contingency plans and countermeasures could also have informed the organisations that planned and undertook such horrific attacks.
There can be few organisations that are not reassessing their risks and exposures in the wake of last week's attacks. The risks can be broadly placed in three categories: assets, facilities and people. As different organisations have different perspectives on what constitutes an asset, definitions should always be agreed upon before planning is undertaken. Failure to do this may result in muddled thinking and miscommunication and can lead to gaps in plans, communication and management.
Disaster recovery sites are usually located a considerable distance from the main site and it is unlikely that any WTC tenants expected to recover from any emergency in the other tower. It remains to be seen how well the sites function or the level at which data and information has been saved in accordance with standard disaster policies, but it is likely the plans that existed in this areas will suffice.
Facility protection is more difficult to understand. In hindsight, it's easy to say the building specifications were inadequate, but scenario planners at the time must have considered it commercially unfeasible to build the level of building resilience required to prevent the towers coming down.
The biggest cost and impact was in the loss of people. While it is entirely possible that the disaster recovery sites might have worked well, it is extremely unlikely that any organisation planned for loss of so many of its key individuals at all levels of their organisations or for the psychological consequences on those who are left. We know wardens managed the internal evacuation on all floors and it is a self-evident fact that evacuation plans existed, but the rest is not easy to ascertain.
In future, marshals are likely to insist on evacuation at all costs. However, some individuals may not be sufficiently able-bodied to walk down so many stairs without rest. It was therefore entirely reasonable to allow people to rest in holding stages on certain floors at the WTC.
Other evacuation plans include pre-designated routes and exits, a means of communicating efficiently with all residents, an assembly area located a sensible distance from the buildings (the UK Home Office recommends a minimum of 500m, but this may be increased in the light of recent events), training of staff with particular responsibilities and thorough discussion of the plans and training with the police, emergency services local authority and neighbours.
Business protection and resumption planning is another key aspect of risk management for such an event. It is a normal part of business continuity and contingency management to assess and plan for the risks of incapacity of some or all of the senior management and is also common practice to assess the risks of denial of access to one or more buildings.
Even assessment of the size of a potential cordon around the disaster area is a normal part of good contingency and crisis planning, along with liaison with local and emergency services to estimate the required number of police, emergency service and medical workers and other ancillary professionals.
