Session No. 5

# Course Title: Business and Industry Crisis Management, Disaster Recovery, and Organizational Continuity

# Session 5: Vulnerability Analysis and Risk Assessment, Risk Management, and Risk Communications

## Time: 1 hr

**Objectives:**

1.  Discuss selected business crisis case studies as they relate to the
    crisis management and business continuity model presented in session
    4.

2.  Define the basic terms associated with risk concepts.

3.  Explain the interrelationships of risk assessment, risk management,
    impact assessment, and risk communications within the model of
    risk-based decision making.

**Scope:**

The session should start with a discussion of the case studies (Pinto,
Tylenol, and Perrier) as they relate to the model presented in session
4. Additional information concerning the Pinto and Tylenol crises is
included for the instructor to consider and present as a guide for the
discussions. The Perrier case study is presented in the text in
sufficient depth to provide a framework for discussion. The remainder of
the session will provide an overview of basic concepts and
inter-relationships of risk assessment, risk management, risk
communications, and impact assessment within the model of risk-based
decision making.

**Readings:**

*Student Reading:*

Barton, Laurence. 1993. *Crisis in Organizations: Managing and
Communicating in the Heat of Chaos.* Cincinnati, OH: South-Western
Publishing Co. Pages 72--92.

Boniface, Duane. 1996. "Risk-Based Decision Making Guidelines."
Unpublished. Introduction. Copy attached.

Federal Emergency Management Agency. 1996. *Emergency Management Guide
for Business and Industry*. Washington, DC: Federal Emergency Management
Agency. "Section 1: 4 Steps in the Planning Process," pages 9--24.
Available on the FEMA Web site at
<http://www.fema.gov/library/bizindex.htm> or in published form from
FEMA, Publications, P.O. Box 70274, Washington, DC 20024.

*Instructor Reading:*

Boniface, Duane. 1996. "Risk Based Decision Making Guidelines."
Unpublished. Copy attached. Introduction.

Federal Emergency Management Agency. 1996. *Emergency Management Guide
for Business and Industry*. Washington, DC: Federal Emergency Management
Agency. "Section 1: 4 Steps in the Planning Process," pages 9--24.
Available on the FEMA Web site at
<http://www.fema.gov/library/bizindex.htm> or in published form from
FEMA, Publications, P.O. Box 70274, Washington, DC 20024.

Gioia, Dennis A. 1992. "Pinto Fires and Personal Ethics: A Script
Analysis of Missed Opportunities." *Journal of Business Ethics*. Vol.
11. Pages 379--389.

Murray, Eileen, and Shoen, Saundra. 1992. "Lessons from the Tylenol
Tragedy on Surviving a Corporate Crisis." *Medical Marketing and Media.*
Vol. 27, No. 2. Pages 14--19.

**General Requirements:**

None.

**Objective 5.1** **Discuss selected business crisis case studies as
they relate to the crisis**

**management and business continuity model presented in session 4.**

**Requirements:**

Lead a class discussion of the Pinto, Tylenol, and Perrier case studies
as they relate to ineffective or effective strategic crisis management.

Complete the modified experiential learning cycle for this objective.
Include the question, how does the use of case studies contribute to the
students' learning?

**Remarks:**

I.  **Pinto** case study (factual information extracted from the article
    by Gioia).

### Background. 

1.  Pinto was introduced in 1970 as the **2000:2000 concept** -- a car
    that weighed 2,000 pounds and would sell for \$2,000. These upper
    limits of weight and cost were reflected in design decisions
    contributing to the construction of an inherently unsafe automobile.

2.  The **design and production time was cut** from an industry average
    of 43 months to 25 months in order to get the product in the market
    as soon as possible.

3.  **Design defects,** upheld in court decisions, included a gas tank
    of very thin metal that in a rear end collision could sandwich
    between the rear bumper and axle and rupture, making the vehicle
    susceptible to fires.

4.  More than **50 deaths** of drivers and/or passengers due to fires
    were attributed to the design defects and over **100 lawsuits** were
    filed against Ford.

5.  From the court cases, it was discovered that **Ford was aware** of
    the design problems before the Pinto was introduced to the market.
    (Ford was in compliance with the pre-1976 Federal Motor Vehicle
    Safety Standards for gas tanks. New standards which the Pinto did
    not comply with were proposed in 1968, but were not adopted until
    1976 due to automotive manufacturers' opposition.) But the company
    had made an **economic decision** not to correct the defect during
    production or through voluntary product recall.

```{=html}
<!-- -->
```
a.  An internal Ford memorandum, revealed in subsequent court cases,
    contained the **economic calculations** (cost/benefit) used by Ford
    in their decision making.

b.  The calculations as presented by Gioia were: The cost to repair the
    12.5 million vehicles with Pinto-like gas tanks was projected at
    **\$137 million** (\$11 per vehicle) while it was estimated that
    court cases would cost about **\$50 million** ((180 deaths x
    \$200,000/per death) + (180 burn injuries x \$67,000/burn injury) +
    (2,100 burned cars x \$700/car) = \$49.53 million).

```{=html}
<!-- -->
```
c.  The figure of **\$200,000 per death** was the commonly accepted
    automotive industry figure in the early 1970s. Gioia attributes the
    economic calculations and the \$200,000 figure to a 1997 article
    by M. Dowie.[^1] Dowie states in his article, "A 1972 report of the
    National Highway Traffic Safety Association (NHTSA) decided that a
    human life was worth \$200,725 (the cost to society every time
    someone is killed in a car accident), and the figure was rounded off
    to \$200,000 by Ford." Additionally, Dowie's article presents a
    breakdown of the various costs and considerations used by NHTSA to
    establish the \$200,725 figure.

```{=html}
<!-- -->
```
6.  **The impact** on Ford.

```{=html}
<!-- -->
```
a.  A 1978 California jury awarded a record-breaking settlement of
    **\$125 million** in a lawsuit tied to a Pinto accident.

b.  In a 1978 Indiana case, a grand jury **indicted Ford on charges of
    reckless homicide** in a case involving the deaths of three
    teenagers who died in a fire when their 1973 Pinto was struck in the
    rear. The jury ultimately found in favor of Ford, but significant
    and lasting public relations problems resulted for Ford.

c.  Between 1977 and 1980 Pinto's **market share** had decreased by
    almost 60%, and in 1978, 2 million pre-1977 Pintos were ordered
    recalled by NTHSA. In 1980, Ford decided to withdraw Pinto from the
    market.

### Discussion questions.

1.  What was the **crisis** facing Ford?

2.  Remember the **questions,** from session 4 (overhead 4-11), that
    will be asked of a manager when an organization is involved in a
    crisis. How will Ford answer these questions?

3.  Ford made tactical decisions concerning the design of the Pinto and
    their reaction to the problems it caused based upon a certain
    economic analysis (\$50 million to deal with the problem in court
    versus \$137 million to correct the defect). Were this economic
    analysis and the resulting decisions consistent with a **long-term
    (strategic) consideration** and plan of how the Pinto problems would
    effect the Pinto product and the economic survivability and success
    of Ford in general?

4.  If you were the head crisis management and business continuity
    professional for Ford, what would you say to **convince the CEO**
    that the analysis and decisions were flawed?

```{=html}
<!-- -->
```
II. **Tylenol** case study (factual information extracted from the
    article by Murray and Schoen and from Barton's text).

```{=html}
<!-- -->
```
A.  **Background.**

```{=html}
<!-- -->
```
1.  The **facts.**

```{=html}
<!-- -->
```
a.  September 1982, Chicago, Illinois -- an unknown murderer poisons
    Extra-Strength Tylenol capsules with cyanide, causing **seven deaths
    and a reported 250 illnesses.** The FBI declares the poisoning an
    act of terrorism.

b.  Johnson & Johnson is **determined to be blameless** in the deaths
    and illnesses but does not undertake any public relations campaign
    to disclaim their culpability.

```{=html}
<!-- -->
```
2.  The **response** by Johnson & Johnson.

```{=html}
<!-- -->
```
a.  Instead of attempting to pass the blame, the company placed the
    focus on **getting to the bottom of the deaths** and illnesses by
    making public statements that they were committed to solving the
    crime and posting a \$100,000 reward for capturing the murderer(s).

b.  Consumers across the nation were alerted through the **media not to
    consume any Tylenol product,** not just capsules. All Tylenol
    capsules (over 31 million bottles, with a value of **\$100
    million**) were recalled. Toll-free information hotlines were
    established. Discount coupons for Tylenol products were widely
    distributed. Consumers were offered the opportunity to exchange any
    Tylenol capsules they had previously purchased for Tylenol tablets.

c.  The company **chairman appeared on nationwide TV** adds and
    interviews to discuss the Johnson & Johnson response.

```{=html}
<!-- -->
```
d.  A model **public relations program** addressing the concerns of
    consumers, employees, stockholders, the media, and the government
    was launched.

```{=html}
<!-- -->
```
3.  The **outcome.**

```{=html}
<!-- -->
```
a.  More than **80,000 news stories** appeared. Media coverage was
    generally very positive because of Johnson & Johnson's forthright
    approach to the crisis.

b.  Within two months (November 1982) Johnson & Johnson **reintroduced
    Tylenol** capsules to the market with a triple-seal,
    tamper-resistant package.

c.  Within three months (December 1982) Tylenol tablet sales **rebounded
    to 80%** of the pre-crisis level. Within two to three years,
    Extra-Strength Tylenol had regained and surpassed its pre-crisis
    market share.

d.  Barton states (p. 85) that the cost of this crisis to Johnson &
    Johnson was between \$500 million and \$1 billion.

```{=html}
<!-- -->
```
4.  **Additional considerations.**

```{=html}
<!-- -->
```
a.  Johnson & Johnson had no formal crisis management plan in place at
    the time of the tampering incident but instead turned to its
    long-established company credo, **"The first responsibility is to
    the customer,"** to guide its response.

b.  Some 16 years after the crisis, the actions of Johnson & Johnson are
    still held up **as a standard** against which other major incidents
    have been measured.

```{=html}
<!-- -->
```
B.  **Discussion question.**

```{=html}
<!-- -->
```
1.  Although Johnson & Johnson did not have a formal crisis management
    plan in place, how did their **established credo** serve as a plan
    for guiding their decisions and actions?

2.  Estimates of the total cost to Johnson & Johnson, for an incident in
    which they were held blameless, range as high as \$1 billion. In the
    short and long terms, did the decisions to spend this amount make
    **good business sense?**

3.  How did Johnson & Johnson's handling of the crisis **differ** from
    the approach followed by Ford in the Pinto crisis?

```{=html}
<!-- -->
```
III. The **Perrier** case study.

```{=html}
<!-- -->
```
A.  **Background.**

```{=html}
<!-- -->
```
1.  Barton provides **sufficient detail** for considering the Perrier
    case**.**

2.  Although generally praised for the manner in which the crisis was
    handled, Perrier has also been **criticized** for offering excuses
    and shirking accountability (claiming the incident was the result of
    an isolated occurrence). They were also criticized for failing to
    conduct a general recall of the product immediately (Perrier was
    originally recalled in North America and was not recalled in Europe
    until benzene contamination was discovered there also).

```{=html}
<!-- -->
```
B.  **Questions.**

```{=html}
<!-- -->
```
1.  How did Perrier's and Johnson & Johnson's handling of their crises
    **differ?**

2.  Barton (p. 88) states that the Perrier contamination did not result
    in any cases of illness in the United States, but that 110,000 cases
    of illness have been caused by contaminated tap water in recent
    years. Rather then spend over \$40 million to counter the crisis,
    why didn't Perrier just **make the comparison** between the safety
    of their product and tap water?

**Supplemental considerations:**

Although the Barton case studies emphasize communications and not the
entire business crisis management and continuity model, they are
available within the text and are easily supplemented by providing the
additional information in the remarks section. The articles concerning
the Pinto and Tylenol crises were chosen as a reference since they lay
out factual information and are relatively recent (1992) and available.
The factual information is included for the instructor to present to the
students. Attempts to locate and fully cite the actual NHTSA report
assigning the \$200,725 value to a human life were unsuccessful. In a
phone interview on September 9, 1998, Dennis Gioia stated that he has
complete faith in the calculations and figures presented in Dowie's
article and that the \$200,000 figure used by Ford was commonly accepted
in the automotive industry in the early 1970s.

Discussions should be guided to emphasize the strategic and integrated
approach of Johnson & Johnson versus the approach of Ford (short-term
focus on profits and inattention to public reaction) and Perrier (better
than Pinto's but not as good as Johnson & Johnson's).

**Objective 5.2 Define the basic terms associated with risk concepts.**

**Requirements:**

The terms, some previously defined (session 2) and some new, should be
presented to the students by lecture with time allocated for discussion
as necessary.

Complete the modified experiential learning cycle for this objective in
combination with objective 5.3.

**Remarks:**

I.  **Risk concepts.**

```{=html}
<!-- -->
```
A.  The terms "hazard," "risk," "vulnerability," "vulnerability
    analysis," "risk analysis and assessment," "risk management," "risk
    communications," and "business area impact analysis" were **defined
    in session 2.** New terms include:

```{=html}
<!-- -->
```
1.  **Risk tolerance** -- The level of risk that an individual or group
    is willing to accept.

2.  **Risk preference** -- An individual's or group's attitude toward
    risk. Risk averse indicates a fear and avoidance of risk. Risk prone
    indicates an acceptance and seeking of risks.

3.  **Risk perception** -- Individual's or group's beliefs about risks
    which are based upon the information available to them and their
    past experiences, value systems, and the social context.

```{=html}
<!-- -->
```
B.  The **definition of risk revisited.**

```{=html}
<!-- -->
```
1.  The definition of risk presented in session 2 (the exposure to the
    chance of loss; the combination of the probability of an event
    occurring and the significance of the consequence (impact) of the
    event occurring. The formula *risk = Probability x Impact* **remains
    unchanged** for the purposes of this course and the business and
    industry context. Different meanings and interpretations of the word
    "risk" are common in different contexts and are pointed out in the
    hope of eliminating confusion.[^2]

```{=html}
<!-- -->
```
a.  Risk may have the colloquial or intuitive meaning of danger
    (involuntary exposure to harm), peril (voluntary exposure to harm),
    venture (a business enterprise), and opportunity (positive
    connotation -- it is worth attempting something if there is
    potential for gain).

b.  Within the context of insurance, risk includes probability
    considerations but is primarily concerned with the uncertainties of
    these probabilities.

```{=html}
<!-- -->
```
2.  

```{=html}
<!-- -->
```
c.  In the context of health care, statements of health risk refer to
    probability of occurrence, with consequences treated separately.

```{=html}
<!-- -->
```
C.  **Risk assessment.**

```{=html}
<!-- -->
```
1.  In session 3 we conducted a **qualitative vulnerability analysis**
    of this university and discussed methods of improving the
    methodology. Review the ideas presented.

2.  The vulnerabilities identified are then considered/analyzed via the
    function of risk analysis with the goal of determining (quantifying)
    the likelihood (probability) and extent of harm (impacts of
    consequences) that may result for the purpose of making informed
    decisions. Taken together the vulnerability and risk analyses
    comprise the **risk assessment function.**

3.  A risk assessment attempts to provide **answers** to the following
    questions:

```{=html}
<!-- -->
```
a.  What **can** **go wrong?**

b.  What is the **likelihood** that it will go wrong?

c.  What are the **consequences** if it goes wrong?

```{=html}
<!-- -->
```
4.  Within the business context, **business area impact analysis** (see
    model from session 4) is an extension of vulnerability analysis and
    risk analysis.

```{=html}
<!-- -->
```
a.  A business area impact analysis addresses the probability and impact
    (consequence) of identified vulnerabilities on **business functions
    and processes.**

b.  A detailed discussion of **business area impact analysis** will be
    conducted in Session 7.

```{=html}
<!-- -->
```
D.  **Risk management.**

```{=html}
<!-- -->
```
1.  Based upon the results of the risk assessment, business area impact
    analysis, and other factors such as risk perception, laws and
    regulations, personal preferences, etc., and the susceptibility to
    countermeasures, risk management **strategies are formulated and
    decisions made** regarding protective policies and actions that
    reduce the threat to life, property, and the environment posed by
    hazards.

2.  **Risk management** attempts to provide answers to the following
    questions:

```{=html}
<!-- -->
```
a.  What **can be done?**

b.  **What** options are available and what are their **associated
    tradeoffs** in terms of costs, benefits, and other (current and
    future) risks?

```{=html}
<!-- -->
```
3.  

```{=html}
<!-- -->
```
c.  What are the effects of **current decisions on future options?**

```{=html}
<!-- -->
```
E.  **Impact assessment.**

```{=html}
<!-- -->
```
1.  A general term referring to the assessment of specific actions to
    determine their **effect** on the goals that were to be achieved.

2.  In this context, they refer to the collection and analysis of data
    to identify and evaluate the **changes in risk** resulting from risk
    management activities.

```{=html}
<!-- -->
```
F.  **Risk communications.**

```{=html}
<!-- -->
```
1.  The **exchange of information, concerns, perceptions, and
    preferences within an organization and between an organization and
    its external environment which** ties together the goals of an
    organization with the functions of risk assessment, risk management,
    and impact assessment.

**Supplemental considerations:**

Note the use of the word "qualitative" in "qualitative vulnerability
analysis" in C. 1. Others may choose to use the term "subjective" since
the analysis involves personal opinions and perceptions that are not
necessarily based on observable phenomena (objective). I have chosen the
word "qualitative" to describe any analysis or assessment which relies
on data or information based on individuals' opinions and perceptions
even if this data and information is expressed in numerical
(quantitative) form. The word "quantitative" as applied to analysis and
assessment is reserved for data and information obtained from actual
measurement. This usage of "quantitative" and "qualitative" is carried
forth in subsequent sessions.

**Objective 5.3 Explain the interrelationships of risk assessment, risk
management, impact assessment, and risk communications within the model
of risk-based decision making.**

**Requirements:**

### A risk-based decision making model tying together the functions is proposed and presented in the article by Lt. Boniface with a larger version provided for use as a student handout and/or overhead projection if desired. As a minimum the students should refer to the article or be provided with a visual presentation of the model as a handout or overhead projection, both of which are included with the course materials. {#a-risk-based-decision-making-model-tying-together-the-functions-is-proposed-and-presented-in-the-article-by-lt.-boniface-with-a-larger-version-provided-for-use-as-a-student-handout-andor-overhead-projection-if-desired.-as-a-minimum-the-students-should-refer-to-the-article-or-be-provided-with-a-visual-presentation-of-the-model-as-a-handout-or-overhead-projection-both-of-which-are-included-with-the-course-materials. .unnumbered}

Complete the modified experiential learning cycle for objectives 5.2 and
5.3 combined.

**Remarks:**

I.  **Risk-based decision making process.**

```{=html}
<!-- -->
```
A.  A model **tying together the functions** of goal setting, risk
    assessment, risk management, impact assessment, and risk
    communications is presented

(overhead 5-1).

B.  The functions are **not accomplished in a pure sequential fashion.**
    The general flow is from left to right (arrows in the center of the
    model), with risk communication an essential component of all
    functions (arrows from communications to each function). Also,
    decisions within each area can, and generally do, effect and
    necessitate a reexamination of the other areas (arrows across the
    top of the model).

C.  The risk-based decision making process is **not a one-time effort.**
    It is an iterative, continual process that should be revisited as
    new information arises.

II\. Organizational goals as the **basis** of risk-based decision
making.

A.  The **goals** of any organization should guide the decision making
    processes of that organization. In the context of business and
    industry decision making, long-term survivability and economic
    success is the fundamental **strategic goal** (objective).

B.  The risk-based decision making process provides a means of
    maximizing the potential for making **optimal decisions**,
    consistent with established goals. If followed properly it ensures
    that all available information is considered.

```{=html}
<!-- -->
```
1.  In the **short term, or tactical sense,** "optimal" decisions are
    not necessarily directly aligned with the strategic goals of the
    organization, but are reflective of the information, values,
    perceptions, and immediate goals for the particular situation.

2.  In the **long term, or strategic sense,** decisions should support
    the strategic goals if the organization is to survive and prosper.

**Supplemental considerations:**

The attached introductory section of the article "Risk-Based Decision
Making Guidelines" by Lt. Duane Boniface, though unpublished in any
journal, was accepted by the United States Coast Guard as a guideline
for risk-based decision making within the marine safety program. It
provides an understandable model for linking together the concepts
associated with risk. Figure 1.2 and the discussion of risk in the
article expand the definition of risk to include sensitivity to
countermeasures in addition to probability and consequences. This course
includes sensitivity as a component of risk management rather than a
characteristic of risk.

The individual functions of risk assessment, risk management, impact
assessment, and risk communications will be expanded upon in subsequent
sessions.

In completing the modified experiential learning cycle for objective 5.2
and 5.3 you may ask the students their reaction to the models used in
sessions 4 and 5. Do they clarify or confuse the material?

[^1]: ^1^ Dowie, M. 1997. "How Ford put Two Million Firetraps on
    Wheels." *Business and Society Review.* Vol. 23. Pages 46--55.

[^2]: ^2^ Jardine, Cindy J., and Hrudey, Steve E. 1997. "Mixed Messages
    in Risk Communication." *Risk Analysis.* Vol. 17, No. 4. Page 490.