Tag: risk analysis

A Tsunami of Threats

Share

Too many threatsThe number of threats can be overwhelming.

In just the past 2 weeks we have been bombarded with stories of threats that turned into disasters and near disasters.  I’m sure you’ll remember these:

October 10, 2018Michael makes landfall as a Category 4 hurricane in the Florida panhandle. 50 people dead, billions in losses.

October 15, 2018 – 60,000 without power as PG&E shuts down lines over more wildfire fears.

October 24, 2018– Police intercepted suspected pipe bombs sent to high-profile Democrats, in what New York officials described as an act of terrorism.

October 29, 2018Eleven people were killed and six others were injured on Saturday when a gunman opened fire in a synagogue in Pittsburgh, Pennsylvania.

October 29, 2018 –Boeing jetliner crashes after take-off in Indonesia, all 189 aboard presumed lost.

This is just a short list. There were more. And throughout the country people suffered from local tragedies that didn’t make the national news.

How can we do a realistic job of preparing for so many threats?

Consider a systematic approach.

1-Start with a written list of threats.

In writing our Neighborhood Disaster Survival Series we found ourselves assembling multiple lists of potential threats. Ultimately we put together one list for homes and a different and considerably longer list for businesses.

You can build your own list. Get your team together in front of a BIG white board or easel (plenty of pages of paper) and brainstorm all the threats that you could possibly face. We have done this a number of times in our group, and we usually come up with 20-40 threats. (This is a great exercise to get people engaged. )

2-Narrow it down to threats that are realistic for you and your community.

Go back over your massive list (!) and start paring it down by removing threats that may be POSSIBLE but really aren’t PROBABLE.

Usually it’s simply a matter of replacing emotional response with common sense and some history.

For example, here’s a short list of threats with some thoughts that can get you started on the paring down process.

  • Every day challenges like power outages – the most frequent disaster in the U.S. (and increasing in frequency). In our local neighborhood we have to include water main breaks and gas line breaks and/or shut-offs, because of the age and quality of our infrastructure.
  • Potential localized dangers to your neighborhood, like transportation accidents – particularly high risk in industrial areas. If you live or work near an airport or beside train tracks, near chemical plants or certain industrial processing installations, threats of accident might be high; otherwise, you could probably take these threats off your list.
  • Natural disasters like floods or storms, earthquakes, tsunamis, and wildfires – likely tied to your geographic location. These are always first on everybody’s list, and their likelihood is pretty easy to evaluate.
  • Mass shootings and workplace violence – nearly always the result of personal motives and/or mental illness issues. Very difficult to anticipate or prepare for, but you could be blamed for negligence if you ignore the possibility.
  • Attacks with weapons of mass destruction – suddenly appearing on our list after decades of being absent. We’re talking here about the threat of nuclear explosion or biological or chemical attacks. If you live and work in a major metropolitan area, particularly a government center, your risk would be higher.
  • Cyber attacks – almost 3.25 billion data records were compromised in the U.S. during the first half of 2018; new vulnerabilities are being exploited as data moves to the cloud. As you read this, attacks ranging from simple virus infections to ransom claims are happening to individuals and businesses around the world.
  • Lawsuits – becoming more frequent but one of the easiest threats to protect against.
  • Terrorism – Whether international or domestic, terrorism results in dramatic news coverage. It is still relatively rare in the U.S., but the number of incidents has been rising.

3-Begin preparing for these selected threats.

Pick the most likely threats and start with those. What can you do to find out about the threat in advance? Can you mitigate (lessen) the impact by making changes NOW? What processes, tools and people might you need to recover once the threat has materialized? What’s the plan for assembling these resources, training, etc.?

Warning: Don’t let your emotional reaction prejudice your efforts.

During the “threat analysis” exercise you may find that people’s individual biases and emotional reactions are likely to emerge. Their experiences may make it tough for them to think dispassionately about a given threat.

Moreover, research has shown that most people seem to find man-made disasters more frightening and rate them as more severe than natural disasters. Terrorism tops the list for emotional reaction, even though it is very low on the probability list.

Try not to let these biases get in the way of making good decisions as to which disasters you actually prepare for!

Reminder: Plan to repeat.

Analyzing threats is something you’ll want to do more than once, because circumstances change. Build a repeat look at threats into your plan!

Virginia
Your Emergency Plan Guide team

P.S. We were hit this week by another of those “local” disasters. It had to do with a Windows 10 update. Our entire network just threw up its hands and quit.  So while I would normally have offered you our list of over 80 threats to business, I just haven’t been able to make it happen!  If you can’t wait, please just buy a copy of Emergency Preparedness for Small Business and you’ll find that list in the Appendix, along with a multi-page Risk Analysis Worksheet that can help you set priorities!  I’ll report in later about how we recover!

Assessing Threats to Your Business

Share

“What could possibly go wrong?”

Storm with lighteningWhen asked that question about their business . . .

Most people think first about natural disasters.

Here in California, everyone is concerned about earthquakes or (some years) El Niño. Along the coasts, popular threats are hurricanes and, occasionally, tsunamis. That leaves tornados and storms for the rest of the country.

Would you believe that initially, most people overlook the most common natural disaster?!

According to the experts, the most common natural disaster – accounting for about 30% of all disasters in the U.S. — is flood!

But let’s take a broader look at threats.

What about threats that are man-made?

This list will be a lot longer. Here are some more threats to business (or to any community), in no particular order:

  • Unplanned IT and communications outages
  • Cyber attack
  • Data breach or loss (accidental or deliberate from disgruntled employee; loss of mobile device)
  • Power outage
  • Water main break
  • Fire
  • Security breach (including theft)
  • Health emergency (chemical leak or spill)
  • Safety problem (accident, train wreck, explosion)
  • Terrorist act
  • Regulatory change
  • Lawsuit: personal injury, employment practice
  • Loss of key personnel
  • Civil unrest (might depend on your neighbors and/or neighborhood)
  • Supply chain interruption
  • and the list goes on!

 

STEP ONE. What threats does YOUR business face?

One of the first steps in preparing for emergencies in your business or community is to take a look at the threats you are facing. The easiest way is to gather together key people and simply brainstorm, writing down everything you can think of.

For example, your list could start by looking like this:

List of threats

STEP TWO. What’s the likelihood of the threat actually happening?

The next step in your analysis is to rate all the threats you’ve come up with as to their probability of taking place. An easy way to do that is simply give each threat a score from 1-5.

  1. = rare
  2. = unlikely
  3. = possible
  4. = probable
  5. = almost certain

Here’s our sample list with the threats rated.

Probablethreats

 

STEP THREE. What would be the impact of the threat?

There’s a second side to every threat, too. That’s the impact that it would have on your business. For example, some common threats (for example, a break in a water line) might be serious but would probably not threaten the health of the whole organization.

Other threats, like a direct hit from a tornado, might completely destroy the business.

So your threat analysis needs to consider impact.  Again, one way to help direct your preparedness efforts is to add a second score to your list of threats.

The impact score could also be 1 – 5, from lowest to highest impact. For example . . .

Threat probability

STEP FOUR. So which threats do we need to look at first?

By completing the list, you can get an idea of the priorities for your preparedness efforts. Here’s our sample, completed:

Create the total score by adding probability and impact.

Business threat

The higher the total score, the more attention you probably want to place on preparing for that event.

Caution: Danger of Threat Analysis Paralysis

Analyzing your threats can become complicated. In fact, in the wrong hands it can get WAY too complicated!

You don’t have to do it the way this report suggests.

But it IS important to get past that first quick assumption about natural disasters, and take a look at the other threats facing your business. The risks associated with the threats might be reduced by better procedures, better insurance coverage, or simply more awareness.

Completing even a simplified risk analysis will give you a more realistic picture of what could happen and how to protect and prepare for it.

Joe and Virginia
Your Emergency Plan Guide Team

P.S. If you are serious about analyzing the risks to your business, consider purchasing this book. It has a significant security focus, but defines all types of threats and lays out a process to help you make decisions regarding mitigation.  Threat Assessment and Risk Analysis: An Applied Approach. The book is available in hardcover or soft at Amazon, where we’re affiliates, as you know.