Reduce the impact

What comes to mind when you think about London? Perhaps a cosmopolitan multi culture capital city with a thriving tourist and a global business community? Maybe even that of the home of The Royal Family or perhaps the Summer Olympics of 2012? Whatever it is then I am certain that it is not a place of mass killings of innocent persons causing terror, fear and widespread panic. The London Bridge attack claimed eight innocent lives in 2017, on a warm summers evening when this evil atrocity was committed.

Terrorism changes the way we think and act especially within major cities like Paris, Berlin, Brussels, Christchurch, Manchester, Barcelona and London – all to which and others have been provoked into a feeling of insecurity due to recent terrorist atrocities. These cities are all popular tourist locations that were not previously associated with acts of terrorism yet each location and others across the globe now face the real threat that they could be next, striking anxiety and fear to residents and visitors alike. 

Of course, the objective of terrorists is to cause mayhem and long-term disruption through whatever means with a total disregard to life, destroying everyday lives for ordinary people, organisations, culture and society suffers as a consequence. The manner in how we cope with such threats and the impact varies depending upon our situations. 

As individuals, we learn to adapt, continuing our day to day lives as normal, we are free of will to make our choices. However, for organisations it is different, they can be better prepared to assist employees deal with disruptive events to mitigate such threats and risks as a duty of care. 

Business continuity planning in its very concept enables preparation and assurances on how organisations can provide a duty of care to employees and key stakeholders. Safeguarding assets and assuring the business can and will continue with minimal disruption despite the scale of the disaster. 

Looking at the statistics, this sense of fear may at first seem justified as during 2016, there were over 26,000 people around the world who were killed as a result of terrorist attacks according to “Global Terrorism Index” of the “Institute for Economics and Peace”. However, 94 percent of all deaths caused by terrorist attacks occurred in the Middle East, Africa and South Asia in 2016. Only six percent happened in Europe. Overall the number of victims is declining worldwide. In Europe it has grown as there has been more terrorist’s incidents now than the previous 14 years combined. 826 people lost their lives within 630 attacks. While compared to other regions this number is extremely low, however every single loss of life from terrorism is one too many regardless of where it is conducted.

London Bridge attack 

From the first received emergency services call it took just eight minutes for the attackers to be shot dead by the armed police, an exceptional response given the time of day and a tribute to the armed police response unit and all the emergency services. In addition, to the exceptional response and professionalism of the emergency service, were the heroic acts performed by everyday people to thwart these vile and murderous individuals.

Tragic events unfolded within just nine minutes from when the hired van mounted the pavement on London Bridge. 

How did some employers provide a duty of care to their employees to know of the safe wellbeing of their employees? Employees that may have been working weekend shifts or on 24x7 operational support at offices, as well as those workers who will have been working in pubs, restaurants and fast food outlets within the area.

In addition, the strong likelihood of denial of access to buildings and offices due to police cordons being setup for forensic investigation after the attack.

There was also the challenge of collecting information about the event and the impact that this would have on operational matters not just denial of access to buildings but on other operational matters. Collecting and sharing information in a secure manner so that senior executives and crisis teams could make informed decisions to navigate around the potential business disruptions.

Challenges

While having well-prepared plans and an automated call cascade structure in place it is important that the contact information of the stakeholders to be communicated with, is current and up to date. Therefore, it is key that contact details are regularly updated and maintained and where possible either a seamless and integrated interface with HR database or a simple user-maintained interface for employees to update their own records should be provided. 

At the initial stages of any incident authorised persons need to alert and provide situational awareness updates to the crisis teams and assess the likely impact that the incident will have on individuals and the business as a whole will be the highest priority prior to any mass notification to all employees.

Given that the event occurred late on a Saturday evening the risk to office workers was minimal but for workers in the restaurant and food industry and the public at large thee was high risk. When, how, could or should an employer reach out to employees to identify if they are safe and well depends on the business type and location, however a duty of care goes a long way.

When the terrorists were shot, The Metropolitan Police immediately issued “Run, Hide, Tell Notices” while also asking the public to remain calm and vigilant with all buildings in the immediate vicinity being evacuated and placed under lock down as was the nearby underground and mainline railway stations. 

Given the panic and disruption the primary concern for all was that of saving lives and only once the Police had lowered the threat levels was it truly possible for companies to determine what impact there would be to their employees and business operations.

Virtual crisis room

One fine example of managing this event was from one of the largest independent private equity and real estate fund administrators in the world Augentius. The company HQ office was in the immediate vicinity of the attack by being on London Bridge itself. With it being a Saturday evening there were no staff on site and thus the buildings security was able to easily initiate an immediate evacuation at the request of the police and close the office.

While emergency services treated casualties and police gathered forensic evidence, it soon became clear that there would be a high likelihood that there would be a denial of access to the office premises on the Monday morning and therefore Augentius activated its disaster recovery and business continuity plans, which primarily consisted of staff being relocated to workplace recovery centre or being told to work from home and the initial communication of this event was via FACT24 an emergency notification solution. 

The first step within the business recovery plans was to initiate FACT24 to inform the Incident Management Team of the incident itself and to determine appropriate actions and decisions to enable the business to have minimal disruption. Given the time of the event it was decided that continually monitoring of the situation should be performed throughout the following day, Sunday.

By late Sunday afternoon it became apparent that access to the office on Monday morning was unlikely. As part of their continuity plans, Augentius had developed IT systems that enabled and supported remote working from the office facility and therefore loss of building access did not result in loss of IT. 

But David Bailey, Marketing and Communications Director from Augentius, who led the firm’s response admits, “Terror attacks weren’t front of my mind when we developed our business continuity plans. After all, most disruptions are caused by plumbers or builders drilling through cables.”

The Incident Management Team met virtually by activating an alarm via a simple and easy mobile app which was configured to automatically bring in Incident Management Team members into a recordable conference call, without need to distribute bridge numbers and pin codes. In addition, the IMT members could also securely exchange messages, images, media references and other related content via a secure mobile messenger app and thus creating a virtual crisis room.

The IMT decided to invoke the recovery centre so measures began to be put in place on the basis that the building would continue to remain “out of bounds” for the next 24 hours. This included the activation of the Disaster Recovery site and the preparation of IT systems to allow staff to work from home.

As a consequence of the telephone conference call it was decided that all London based staff were to be alerted using the FACT24 notification solution, sending such communication messages via telephone voice, SMS and email, informing the staff of the likely invocation of DR procedures and the advice that they should not travel into the London office until further notifications were given. Early on the Monday morning after continued situation updates the IMT issued a further notification to London based employees informing them that DR plan was operational, and that the office was indeed closed, and home or recovery centre working was to be put in place.

Later that Monday morning, some 60% of Augentius client service staff were either remotely logged into the company’s systems from home or working from the DR site with over 95% being fully operational by 10am. A successful recovery given the limited time to prepare and make the necessary decisions to invoke the Business Continuity Plans. 

Post event crisis management

Throughout the days following the incident organisations were experiencing ongoing challenges, ongoing updates being posted to incident room logs and further telephone conference calls being conducted in order to define the necessary actions and decisions to be taken.

Many organisations were impacted by the police cordon that had been put into force on the Sunday and which resulted in denial of access to offices. The police cordon remained in place for several days however most offices in the London Bridge vicinity were operable by the Wednesday afternoon.

Decisions were made to alert all employees as soon as possible and then to provide continual situation updates on when access to the office would be resumed, a combination of recovery workplaces, home working and utilising other office locations were all to be put into force. In some instances, staff telephone information hotlines were established to enable employees to remotely dial in for the latest situation updates freeing up the time of those involved to manage the incident.

Such an approach enables the staff to be focussed on dealing with the event and the operational matters of recovery rather than being caught up in having to continually update staff or other executives on the current status of events.

By the end of the week many organisations who were well prepared had closed both their actual and virtual crisis rooms along with telephone information hotlines returning to normal business operations.

The tragic loss of innocent lives and the associated post-traumatic stress for scores of persons many of whom were heroes on the night can never be changed, those lost should never be forgotten. 

Handling the risks

You can never be sure on what event may require employee safe and well communications to be issued, terrorist, natural catastrophe or fire. However not being prepared and able to communicate with ease in auditable manner is not an option for forward thinking organisations in today’s world.

So the final conclusion to take from this tragic event is be prepared like a well prepared mountaineer who is scaling what would seem to be unsurmountable mountain peak, they are equipped with the right tools and equipment to ensure their difficult challenge can be met and at no point do they sacrifice taking things by chance.

John Davison is the Managing Director of F-24 UK Ltd