ABSTRACT

STRATEGIC CONTINGENCY PLANNING

By

Karen Scott-Martinet

Fall 2006

The objective of this study was to develop a strategic contingency
planning model to be used to fully incorporate emergency management and
business continuity into organization structures. (For the purpose of
this study, Emergency Management and Business Continuity were
collectively referred to as "contingency planning.") Presently,
contingency planning is mainly done on an operational or tactical level.
Current thinking suggests that contingency planning should be an active
part of organizations' overall strategic planning processes as well.
Organizations will ultimately be better prepared for future disasters
and crises.

STRATEGIC CONTINGENCY PLANNING

####  A THESIS

Presented to the Professional Studies Department

California State University, Long Beach

In Partial Fulfillment

of the Requirements for the Degree

Master of Science in Emergency Services Administration

By Karen Scott-Martinet

B.A., 1994, University of Hawaii, West Oahu

Fall 2006

Copyright 2006

Karen Scott-Martinet

ALL RIGHTS RESERVED

TABLE OF CONTENTS

Page

CHAPTER

1\. INTRODUCTION 1

Purpose of this Study 2

Significance of this Study 3

Approach 4

Limitations 4

Definitions of Key Terms 5

2\. REVIEW OF LITERATURE 10

Emergency Management 12

Business Continuity Planning 21

Strategic Planning 31

Scenario Futuring 34

Summary 39

3\. PLANNING METHODOLOGIES 41

Emergency Management 41

Business Continuity 47

Strategic Planning 51

Scenario Futuring 55

Summary 63

4\. NEW MODEL 65

The Strategic Contingency Plan 65

Finding the Gaps 67

The Wider View 69

The Business Case 70

Implementation and Metrics 72

Summary 73

5\. RECOMMENDATIONS AND CONCLUSION 74

Recommendations 74

Conclusion 75

Summary 76

APPENDICES 77

A. SAMPLE FUTURE SCENARIOS 78

B. SAMPLE STRATEGIC EMERGENCY AND CRISIS

MANAGEMENT PLAN 86

C. SAMPLE BASELINE ASSESSMENT PAGE 91

D. SAMPLE RELATIONSHIP DIAGRAM 93

E.  SAMPLE CONTINGENCY PLANNING SITUATION

> ASSESSMENT 95

BIBLIOGRAPHY 97

CHAPTER 1

INTRODUCTION

Emergency management and business continuity planning (collectively
referred to as contingency planning) are vital programs for any
organization that wants to survive and prosper. Contingency planning can
be a time-consuming, costly process and, consequently, it is used in
public and private sector entities to varying degrees. In the absence of
proper planning, a crisis or disaster could devastate an organization,
its people and its assets. Various estimates of failure rates of
businesses after a disaster abound. While there is no way to confirm
these statistics, they seem to suggest that contingency planning will
improve the odds of an organization's survival.

Due to the fear of terrorist attacks, cyber crime, pandemics and the
increasing costs of natural disasters, more organizations than ever
before are considering contingency planning to help protect their
people, assets, and facilities. As organizations become more complex,
disruptions can cause greater and more frequent impacts. The terrorist
attacks on the World Trade Center in New York in 2001, the Phuket
Tsunami in 2004 and the devastation left behind by Hurricanes Katrina,
Rita, and Wilma in 2005 have shown how these impacts can affect the
entire world.

A challenge for organizations is lack of knowledge about how to
effectively implement a contingency planning system and incorporate it
into the entity's strategic plans. "Strategic planning is the process of
formulating and implementing decisions about an organization's future
direction. This process is vital to every organization's survival
because it is the process by which the organization adapts to its
ever-changing environment, and the process is applicable to all
management levels and all types of organizations" (Kerzner, 2001, p.
15).

Contingency planners are now asserting that contingency planning is a
value-added component that can be a competitive advantage in the
marketplace as well a means of helping organizations save money.
Processes that are deeply analyzed in terms of continuity will usually
be more secure, and new ways of working may emerge to help streamline
operations. Contingency planning can be useful when forging alliances
with external organizations or during acquisition phases. Contingency
planning should be part of an organization's quality cycle as well.
"Business continuity and disaster recovery have gained somewhat in the
eyes of top corporate management since the start of the 1990s. As the
industry has slowly evolved from what could almost have been called a
'black art' to something starting to resemble a disciplined science,
basic business principles have begun to become increasingly relevant"
(Rothstein, 2003, p. 1).

[Purpose of this Study]{.underline}

In this study, the fields of emergency management, business continuity,
strategic planning and scenario futuring were critically analyzed with a
goal of developing an integrated strategic contingency planning model.
This model will assist organizations in bringing their contingency
planning program to a strategic level. Contingency planning can be fully
integrated with day-to-day business processes if a new mindset is
promulgated in the organization. Contingency planning no longer needs to
be an isolated, specialized process; rather it should be integrated into
the foundation of an organization. An organization is normally in
business to stay in business, so practicing contingency planning is a
logical component of successful business operations. Not-for-profit and
public sector entities also need to prepare for continuity of services
in order to assist constituents and citizens. "By including the
continuity strategies in the company's strategic plan, they are
naturally reviewed periodically and updated when the strategies of the
company change. The business continuity strategies become part of the
corporate culture and a natural part of management thinking.
Additionally, since this new element has been added to the company's
existing planning program, the marginal cost associated with maintaining
it is substantially reduced" (Stagl, 2003, p. 39).

[Significance of this Study]{.underline}

Contingency planning is a systematic process that is usually not fully
integrated with normal business processes and traditionally focuses more
on the tactical and operational side of planning. A well-developed
contingency planning system might consist of policies, procedures,
checklists, guidelines, plans, and other documents and resources.
Components of contingency planning such as first response, a command
structure, crisis management and business resumption are typically
addressed.

When a company conducts its strategic planning, the information and
expertise available in the contingency planning department are not
utilized or utilized fully when contingency planners are not invited to
participate in the process. Contingency planning is usually an overhead
component, not (seemingly) contributing much to the bottom line.
Contingency planners, by using strategic methods and business concepts,
will enhance their ability to be recognized and accepted as vital
strategic team members and gain top level support.

This study was designed to demonstrate how contingency planning can
better fit into a corporate or public sector model. Integrating
contingency planning into the fundamental structure of the organization
will help the entity to survive more effectively. When the entity's
players put their all pieces together, the entity will be better
protected and better prepared.

[Approach]{.underline}

The approach used in this study was to provide a background in
contingency planning processes and then show how strategic planning
processes can be applied to make a more effective contingency planning
program. Chapter 2 presents a review of literature in the emergency
planning, business continuity, strategic planning and scenario futuring
fields to provide a foundation for the study. Chapter 3 is comprised of
an examination of the existing planning methodologies of emergency
management, business continuity, strategic planning and scenario
futuring. In Chapter 4, these comprehensive planning methods are
synthesized into a more integrated strategic contingency planning
process. Chapter 5 presents the conclusion and recommendations.

[Limitations]{.underline}

This study does not specifically address the information technology (IT)
aspects of contingency planning due to the complexity and emergent
nature of information systems products. IT departments may have very
detailed plans in place to recover hardware, software, telecommunication
and other systems. These preparations are usually known as *disaster
recovery plans*. It is incumbent upon business continuity personnel,
however, to ensure that their IT departments are fully aware of critical
systems and recovery priorities. Without the three-prong approach of
emergency management, business continuity and disaster recovery,
organizational recovery may be severely impeded.

This study also does not specifically address the security of the
organization. Security and contingency planning often go hand-in-hand in
organizations. Many security features such as fences, controlled access
systems, cameras, etc. are taken into consideration when doing
contingency planning. However, the security field, which is
technologically complex, is beyond the scope of the present study.

[Definitions of Key Terms]{.underline}

*Business Continuity Management Program*: An ongoing management and
governance process supported by senior management and resourced to
ensure that the necessary steps are taken to identify the impact of
potential losses, maintain viable recovery strategies and plans, and
ensure continuity of products/services through exercising, rehearsal,
testing, training, maintenance and assurance. (DRJ Editorial Advisory
Board, 2005)

*Business Continuity Team*: Designated individuals responsible for
developing, execution, rehearsals, and maintenance of the business
continuity plan, including the processes and procedures. Similar terms:
disaster recovery team, business recovery team, recovery team.
Associated term: crisis response team. (DRJ Editorial Advisory Board,
2005)

*Business Impact Analysis (BIA)*: The Business Impact Analysis is a
process designed to identify critical business functions and workflow,
determine the qualitative and quantitative impacts of a disruption, and
to prioritize and establish recovery time objectives. Similar terms:
Business Exposure Assessment, Risk Analysis. (DRJ Editorial Advisory
Board, 2005)

*Crisis Management*: The overall coordination of an organization\'s
response to a crisis, in an effective, timely manner, with the goal of
avoiding or minimizing damage to the organization\'s profitability,
reputation, or ability to operate. (DRJ Editorial Advisory Board, 2005)

*Crisis Management Team*: A crisis management team will consist of key
executives as well as key role players (i.e. media representative, legal
counsel, facilities manager, disaster recovery coordinator, etc.) and
the appropriate business owners of critical organization functions. (DRJ
Editorial Advisory Board, 2005)

*Damage Assessment*: An appraisal or determination of the effects of the
disaster on human, physical, economic, and natural resources. (NFPA,
2004, Section 3.3.2, p. 1600-4)

*Disaster*: A sudden, unplanned calamitous event causing great damage or
loss as defined or determined by a risk assessment and business impact
analysis; 1) Any event that creates an inability on an organizations
part to provide critical business functions for some predetermined
period of time. 2) In the business environment, any event that creates
an inability on an organization's part to provide the critical business
functions for some predetermined period of time. 3) The period when
company management decides to divert from normal production responses
and exercises its disaster recovery plan. Typically signifies the
beginning of a move from a primary to an alternate location. Similar
terms: Business Interruption; Outage; Catastrophe. (DRJ Editorial
Advisory Board, 2005)

*Disaster/Emergency Management Program*: A program that implements the
mission, vision, and strategic goals and objectives as well as the
management framework of the program and organization. (NFPA, 2004,
Section 3.3.3, p. 1600-4)

*Disaster Recovery Planning*: The technological aspect of business
continuity planning. The advance planning and preparations that are
necessary to minimize loss and ensure continuity of the critical
business functions of an organization in the event of disaster. Similar
terms: Contingency Planning; Business Resumption Planning; Corporate
Contingency Planning; Business Interruption Planning; Disaster
Preparedness. (DRJ Editorial Advisory Board, 2005)

*Emergency*: An unexpected actual or impending situation that may cause
injury, loss of life, destruction of property or cause the interference,
loss or disruption of an organization's normal business operations to
such an extent that it poses a threat. (DRJ Editorial Advisory Board,
2005)

*Emergency Management/Emergency Planning*: "When disasters threaten or
strike a jurisdiction, people expect elected leaders to take immediate
action to deal with the problem. The government is expected to marshal
its resources, channel the efforts of voluntary agencies and private
enterprise in the community, and solicit assistance from outside the
jurisdiction if necessary. In all states and most localities, that
popular expectation is given force by statute or ordinance. Governments
can discharge their emergency management responsibilities by taking four
interrelated actions: mitigation, preparedness, response, and recovery.
A systematic approach is to treat each action as one phase of a
comprehensive process, with each phase building on the accomplishments
of the preceding one. The overall goal is to minimize the impact caused
by an emergency in the jurisdiction." (FEMA, 1996, p. 12)

*Five Phases of Emergency Management*:

1.  Prevention (proposed language): Activities taken to avoid or to stop
    a disaster/emergency from occurring.

2.  Preparedness (Section 3.3.9): Activities, programs, and systems
    developed and implemented prior to a disaster/emergency that are
    used to support and enhance mitigation of, response to, and recovery
    from disasters/emergencies.

3.  Response (Section 3.3.11): In disaster/emergency management
    applications, activities designed to address the immediate and
    short-term effects of the disaster/emergency.

4.  Recovery (Section 3.3.10): Activities and programs designed to
    return conditions to a level that is acceptable to the entity.

5.  Mitigation (Section 3.3.7): Activities taken to eliminate or reduce
    the probability of the event, or reduce its severity or
    consequences, either prior to or following a disaster/emergency.

> (NFPA, 2004, p.1600-4)

*Gap Analysis*: A survey whose aim is to identify the differences
between BCM/Crisis Management requirements (what the business says it
needs at time of an event and what is in place and/or available. (DRJ
Editorial Advisory Board, 2005)

*Hazard*: A natural, technological or social phenomenon that threatens
human lives, livelihoods, land use, property or activities. Some hazards
may result in a single disaster impact, others are recurrent on a
regular (i.e., seasonal) or irregular (random) cycle. The majority are
recurrent rather than unrepeatable events. Many types of hazard impact
can be characterized by a magnitude-frequency relationship in which the
larger the impact the lower its frequency of occurrence. (Alexander,
2002, p. 312)

*Hazard or Threat Identification*: The process of identifying situations
or conditions that have the potential to cause injury to people, damage
to property, or damage to the environment. (DRJ Editorial Advisory
Board, 2005)

*Incident*: An event, series of events, or set of circumstances that
interrupts normal operating procedures and has the potential to
precipitate an emergency or crisis. (Gillis, 1996, p. 4)

*Incident Response*: The response of an organization to a disaster or
other significant event that may significantly impact the organization,
its people, or its ability to function productively. An incident
response may include evacuation of a facility, initiating a disaster
recovery plan, performing damage assessment, and any other measures
necessary to bring an organization to a more stable status. (DRJ
Editorial Advisory Board, 2005)

*Mission-Critical Application*: An application that is essential to the
organization's ability to perform necessary business functions. Loss of
the mission-critical application would have a negative impact on the
business, as well as legal or regulatory impacts. (DRJ Editorial
Advisory Board, 2005)

*Operational Risk*: The risk of loss resulting from inadequate or failed
procedures and controls. This includes loss from events related to
technology and infrastructure, failure, business interruptions, staff
related problems, and from external events such as regulatory changes.
(DRJ Editorial Advisory Board, 2005)

*Risk Assessment/Analysis*: Process of identifying the risks to an
organization, assessing the critical functions necessary for an
organization to continue business operations, defining the controls in
place to reduce organization exposure and evaluating the cost for such
controls. Risk analysis often involves an evaluation of the
probabilities of a particular event. (DRJ Editorial Advisory Board,
2005)

*Risk Categories*: Risks of similar types are grouped together under key
headings, otherwise known as 'risk categories'. These categories include
reputation, strategy, financial, investments, operational
infrastructure, business, regulatory compliance, outsourcing, people,
technology and knowledge. (DRJ Editorial Advisory Board, 2005)

*Risk Mitigation*: Implementation of measures to deter specific threats
to the continuity of business operations, and/or respond to any
occurrence of such threats in a timely and appropriate manner. (DRJ
Editorial Advisory Board, 2005)

*Scenario*: A pre-defined set of Business Continuity events and
conditions that describe, for planning purposes, an interruption,
disruption, or loss related to some aspect(s) of an organization's
business operations to support conducting a BIA, developing a continuity
strategy, and developing continuity and exercise plans. Note: Scenarios
are neither predictions nor forecasts. (DRJ Editorial Advisory Board,
2005)

*Stakeholder*: "Although there are several ways to classify
stakeholders, the most common method is as follows:"

*Financial Stakeholders*

> Stockholders
>
> Financial institutions (suppliers of capital)
>
> Creditors

*The Product/Market Stakeholders*

> Primary customers
>
> Primary suppliers
>
> Competitors
>
> Unions
>
> Government agencies
>
> Local government committees

*Organizational Stakeholders*

> Executive officers
>
> Board of Directors
>
> Employees in general
>
> Managers
>
> (Kerzner, 2001, p. 5)

*Strategic Planning*: The process by which the guiding members of an
organization envision its future and develop the necessary procedures
and operations to achieve that future. (Goodstein, Nolan & Pfeiffer,
1993, p. viii)

*Strategy*: Strategy is about positioning an organization for
sustainable competitive advantage. It involves making choices about
which industries to participate in, what products and services to offer,
and how to allocate corporate resources. Its primary goal is to create
value for shareholders and other stakeholders by providing customer
value. (de Kluyver and Pearce, 2003, p. 1)

*System*: A set or arrangement of things so related or connected as to
form a unity or organic whole. (Neufeldt, 1994, p. 1359)

*Workaround Procedures*: Interim procedures that may be used by a
business unit to enable it to continue to perform its critical functions
during temporary unavailability of specific application systems,
electronic or hard copy data, voice or data communication systems,
specialized equipment, office facilities, personnel, or external
services. (DRJ Editorial Advisory Board, 2005)

CHAPTER 2

REVIEW OF LITERATURE

Interest continues to grow in the fields of emergency management and
business continuity (together referred to as *contingency planning*).
The Department of Homeland Security (DHS) encourages organizations to be
prepared for anything that may happen. Though much of DHS's focus since
2001 has been on terrorism, the multiple hurricanes, earthquakes,
floods, and other disasters in 2005 re-focused the country's attention
on natural disaster preparedness. A contingency planner needs to know
how personnel, facilities, assets and resources will be impacted by
disaster and what will be needed in order to prepare for, respond to and
recover from the disaster more quickly. Once the factors are identified
and documented, planners can prepare for and mitigate in advance, or at
least know more readily what may need fixing after the fact. In order to
do all this, contingency planners need to understand the organization\'s
current structure and what has been projected for the future.
Contingency planners must look at the organization in terms of a system,
with many interrelated parts. "Inefficiencies in planning translate very
easily into loss of life, injuries or damage that could have been
avoided" (Alexander, 2002, p. 5).

Strategic planners look at both short- and long-range issues and help
organizations develop a roadmap for the future. Markets, competitors and
products are emphasized; other resources are analyzed in terms of how
they support those items. Some threat analysis is done; however, the
focus in strategic planning is narrower than that of contingency
planners. Risks such as a drop in market share or a change in a popular
product may be analyzed. Sometimes, loss of an important customer is
considered. Strategic planners may not be aware of, or have access to,
the additional threat and risk analysis information that contingency
planners consider when developing continuity plans. "The most important
contribution that contingency planning can make to an organization is
the development of a process for identifying and responding to
unanticipated or less-likely events" (Goodstein, et al., 1993, p. 310).

An Internet search in July 2005 of major U.S. business schools revealed
that none of the MBA programs had core or elective classes in either
business continuity or emergency management, though they had many
courses dealing with strategy and marketing. And, very little literature
is available to show how contingency planning can be integrated into the
strategic planning process. However, current thinking in the field
suggests that contingency planning should be viewed as a strategic
initiative to increase stakeholder value. "Understanding
vulnerabilities, surveying global risks, and implementing safeguards and
contingency plans are not just about avoiding the costs of disaster. By
integrating risk management into strategic planning, companies can turn
smart risk-taking into a competitive advantage" (Laudicina, 2005, p.
196).

Planning is a forward-thinking process. No one can accurately predict
the future, so best guesses are made based on previous information and
studies of recent events. The process of scenario futuring assists in
the strategic planning process by allowing planners to simulate multiple
outcomes based on the same basic inputs and a study of emerging trends.
By varying the inputs to some degree and examining the resulting
stories, an organization may find ways to better survive, no matter what
the future holds.

[Emergency Management]{.underline}

Modern emergency management developed from the civil defense and civil
protection efforts that began in the 1940s to protect civilians against
the effects of warfare and nuclear exchange. In the 1970s, the field
expanded to include response to disasters caused by natural,
technological and human forces (Alexander, 2002, p. ix). Examples of
natural events are earthquakes, hurricanes, and floods. Technological
events include dam failures, hazardous materials release, and structural
collapse. A human-caused event could be a terrorist act, such as flying
a jet into a building; launching a destructive computer virus; or
blowing up a bus.

Emergency management has traditionally been viewed as a four-phase
approach: preparedness, response, recovery and mitigation. In 2004, the
Department of Homeland Security recommended a change to five phases:
prevention, preparedness, response, recovery and mitigation. Prevention,
preparedness and mitigation are closely related. They all deal with the
concept of eliminating or at least minimizing impacts of a disaster or
incident. *Prevention* relates to making more informed decisions, such
as determining where earthquake faults and flood plains are in order to
avoid building in those areas. Prevention can also take the form of
increased security measures on a property. *Preparedness* is used
commonly in reference to educating and training residents or personnel,
pre-planning, and identifying resources in advance. *Mitigation* can be
carried out before or after an incident. Strapping down equipment,
installing hurricane clips on roofs, and building storm shelters are all
examples of mitigation. Implementing any of these phases involves money
and time, so they may be given insufficient attention in some
organizations.

*Response* generally refers to the immediate actions taken after an
incident to save lives and protect assets. Lessening or eliminating
subsequent impacts also falls in this category, such as putting out a
fire in one building before it spreads to an area filled with explosives
or cleaning up a hazardous material spill before it causes more
contamination of the environment. *Recovery* starts almost immediately
with response and includes the clean up and return to normal, or better
than normal. Recovery can be a short or long process depending upon the
incident. If an organization has to recover from a major fire, for
example, the recovery process may include extensive, lengthy medical
treatment for victims, interactions with insurance companies and fire
inspectors, or closing a site and relocating the entire business.

In the past, there were no national or international emergency
management standards adopted by all organizations to detail specifically
what is required in order to have a successful emergency management
program. This situation is rapidly changing, however. In the United
States, the 2004 National Response Plan (NRP), as well as Homeland
Security Presidential Directives (HSPD) 5 (2003) and HSPD 8 (2003),
expanded the roles and responsibilities of federal, state and local
organizations. The National Response Plan (Department of Homeland
Security, 2004) specified that:

> The purpose of the NRP is to establish a comprehensive, national,
> all-hazards approach to domestic incident management across a spectrum
> of activities including prevention, preparedness, response, and
> recovery. The NRP incorporates best practices and procedures from
> various incident management disciplines---homeland security, emergency
> management, law enforcement, firefighting, hazardous materials
> response, public works, public health, emergency medical services, and
> responder and recovery worker health and safety---and integrates them
> into a unified coordinating structure. (p.2)

The NRP also addressed the private sector and encouraged that sector to
follow governmental guidelines:

> Private-sector owners and operators, particularly those who represent
> critical elements of infrastructure or key resources whose disruption
> may have national or major regional impact, are encouraged (or in some
> cases required under law) to develop appropriate emergency response
> and business continuity plans and information-sharing and
> incident-reporting protocols that are tailored to the unique
> requirements of their respective sector or industry, and that clearly
> map to regional, State, and local emergency response plans and
> information-sharing networks. (p.x)

# The National Fire Protection Association (NFPA), an international codes and standards organization, issued the *NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs*, *2004 Edition*. This NFPA standard provided guidelines for organizations so that their emergency management and business continuity planning will be more complete. This document attempted to organize emergency management and business continuity planning for both the private and public sectors. The American National Standards Association (ANSI) has accepted the NFPA standards. The International Standards Organization (ISO) is reviewing this information, as well. In the NFPA 1600 standard (NFPA, 2004), Section 5.3.3 of the *Hazard Identification, Risk Assessment, and Impact Analysis* section specified that: 

The entity shall conduct an impact analysis to determine the potential
for detrimental impacts of the hazards on conditions including, but not
limited to, the following:

1.  Health and safety of persons in the affected area at the time of the
    incident (injury and death)

2.  Health and safety of personnel responding to the incident

3.  Continuity of operations

4.  Property, facilities, and infrastructure

5.  Delivery of services

6.  The environment

7.  Economic and financial conditions

8.  Regulatory and contractual obligations

9.  Reputation of or confidence in the entity (p. 1600-5)

Category 1 (health and safety of persons in the area), category 2
(health and safety of responders), and category 6 (the environment) are
usually covered in a city's emergency operations and response plan, or
other documents based on OSHA or state regulations. In private entities,
an emergency response plan, crisis management plan, or other documents
may serve the same purpose. The other NFPA 1600 standard categories (3
to 5, 7 to 9) are usually part of a business continuity or continuity of
operations plan.

Although these standards are now more widely accepted by public and
private organizations as guides, very little information is available to
specifically address how to integrate emergency management processes
into normal business processes. In the past, emergency managers were
seen as a response group rather than as being proactive in assisting to
protect the organization. New thinking on the part of emergency managers
as well as other organizational departments is needed to recognize that
emergency management contributes to long-term survival of the entity.

[Emergency Management Personnel]{.underline}

> According to FEMA (2003), core functions (those performed during
> emergencies) are:

1.  Direction and control

2.  Communications

3.  Warning

4.  Emergency public information

5.  Evacuation or in-place sheltering

6.  Mass care

7.  Health and medical

8.  Resource management (p. 9.6)

There are three main personnel groups under the emergency management
umbrella. One group is first responders. These include the front line,
on-scene field personnel who handle the actual incident itself, in the
response and initial recovery phases. This category is dominated by
fire, law enforcement and emergency medical responders. Other
specialized personnel may also be part of the first responder group,
notably those who deal with explosives or hazardous materials.

An incident commander or unified command manages the scene during
initial response. The Incident Command System (ICS), a hierarchical
management structure, is generally used in these circumstances to most
effectively deal with resources, operations, planning, logistics, etc.
ICS can be used no matter how large or small the incident itself is. The
ICS system has been integrated into the 2004 National Response Plan
under the National Incident Management System (NIMS).

There are differences between field responders in private and public
sector organizations. In a local city government, the first responders
may be city employees or personnel contracted through the county or
state. Most private sector organizations rely on city or other
government services. Some very large private organizations have their
own, or contract for, private security and fire services. Even if a
private organization has its own first responders, at some point public
law enforcement, fire service agencies and other agencies may become
involved. For example, if a private organization has a hazardous
materials spill, a contractor may clean it up, but the Department of
Health, Environmental Protection Agency, and other groups may have to
come on property to clear the area for use. If a criminal event occurs,
law enforcement agencies might come on site and take charge.

When a city's first responders are unavailable, an appropriate agency
may be called from a nearby city to assist. These mutual aid agreements
between cities are normally in place ahead of time. If an incident is
too large for a city and its mutual aid partners to handle, the county
and state may send additional personnel to assist. Private sector
organizations may also have mutual aid agreements with other local
private sector companies. If a regional disaster occurs, local city or
other public sector responders may be temporarily unavailable to private
organizations, and the private entity will have to make do with the
resources available on site.

Volunteer groups may also be considered part of the first responder
personnel chain. In an urban incident, one or more volunteer agencies
(such as the American Red Cross) are usually available to assist those
in need. These resources may not be available to private sector
organizations, which typically rely on internal human resource
departments to care for personnel. Cities may also have Community
Emergency Response Team (CERT) members (or similar groups) to assist in
a crisis. CERT members are private citizens who have been trained to
help in areas such as light search and rescue, traffic control, fire
suppression and first aid. Private sector organizations may also have
CERT-type teams comprised of employee volunteers. These employee
volunteers may be trained by their organizations or on their own time.

The second personnel group under the emergency management umbrella is
the crisis management team (CMT) in the private sector and the emergency
operations center team (EOCT) in the public sector. \[Note: these terms
vary according to organization.\] The personnel in these groups are the
managers, executives and staff members who determine how to care for
displaced employees, make policy decisions, gather the cost information,
and start planning the recovery and mitigation portions of the incident.
Crisis management and EOC teams normally do not participate directly in
field activities; rather they meet away from the field and look at the
bigger picture. They do, however, support the field operations by
providing additional resources as field personnel request them.

CMT/EOCT members use special facilities called crisis management rooms
(CMR) or emergency operations centers (EOC) where they meet when
responding to, and recovering from, an incident or disaster. A CMR or
EOC may be a dedicated facility or a conference or office room that can
be quickly reconfigured during an event. These rooms typically contain
communication, computer and office equipment and supplies. They also may
contain maps, plans, status boards, forms, televisions, radios,
emergency food, water, and other items. Alternate CMRs/EOCs may also be
established in case the primary room is not available.

CMT and EOCT members use liaisons to keep track of events in the field.
The news media may approach field personnel with questions. As part of
the ICS, a field public relations liaison confers with the CMT/EOCT
members regarding information to be released. The field Incident
Commander, through a logistics liaison, may request additional resources
for response activities, and other liaisons may relay information to the
teams as to the status of injured personnel, damaged facilities, and
stopped work.

Both field responders and CMT/EOCT members are active in preparedness,
prevention and mitigation phases. First responders spend a great deal of
time training, exercising and doing outreach to help prevent or minimize
incidents. For example, fire departments are very active in educating
the public about safety as well as doing structural fire inspections and
maintaining their equipment. CMT/EOCT members also must train and
exercise to protect personnel, assets, and facilities. Plans are
developed in advance to assist in this process. Organizations may have
pre-plans in place, such as following: where to temporarily house and
feed evacuated persons, how to allocate disaster supplies, how to handle
the news media, and how to pay for additional response items. The CMT
may also coordinate with, or become, the business continuity/resumption
team in the private sector. EOCT members may also be instrumental in
getting local governments back to normal.

The third personnel group, emergency managers or emergency planners, use
various types of analyses, modeling, scenarios and other methods to
better prepare their organizations to survive a crisis or disaster. FEMA
(2003) shows the planning done by emergency managers falling in the
following twelve main categories:

1.  Hazard identification and risk assessment

2.  Hazard mitigation

3.  Resource management

4.  Planning

5.  Direction and control

6.  Communication and warning

7.  Operations and procedures

8.  Logistics and facilities

9.  Training

10. Exercises, evaluations, and corrective actions

11. Public education and information

12. Finance and administration (p. 9.7)

Generally, emergency managers ensure that the systems and training are
in place to facilitate the CMT/EOCT members in a crisis.

[Business Continuity Planning]{.underline}

After the response portion of an emergency has begun, business
continuity teams (BCT) begin implementing business continuity plans so
the organization can resume normal business operations as quickly as
possible. Section 3.3.1 Business Continuity Program in the NFPA 1600
standard (NFPA, 2004), defined business continuity planning (BCP) as:
"An ongoing process supported by senior management and funded to ensure
that the necessary steps are taken to identify the impact of potential
losses, maintain viable recovery strategies and recovery plans, and
ensure continuity of services through personnel training, plan testing,
and maintenance" (p. 1600-4).

The BC team uses business continuity plans developed ahead of time.
These plans can include a risk analysis, a business impact analysis,
detailed instructions for recovering processes and a business resumption
plan. A business continuity plan for a large corporation may cover
multiple national and international offices and affect thousands of
people. Plans may also be developed for sole proprietorships and small
businesses. In all cases, BCP takes time, effort, and other resources to
properly implement.

In the private sector, business continuity planning is a more common
practice, at least among the larger and/or regulated organizations. "BCP
addresses the operating risk question of how best to be prepared and to
respond to a major disruption to business activities caused by
significant loss of access to facilities, computing systems, critical
vendors and/or people" (Penz, 2003, p. 28). A number of private sector
business continuity manuals, magazines, courses and professional groups
are now available to help business continuity planners do their jobs.

However, until the last few years, very little literature was available
for local government planners that laid out the specifics of a city
business continuity planning process. If a city organization itself
fails due to a disaster, the residents may not get timely protection and
help, and recovery efforts may be delayed. If a city has business
continuity plans in place, as well as emergency operations plans, there
will be a greater chance of rapid response and a quicker return to
normal operations. The concept of *continuity of operations* (COOP) has
emerged to fill this gap. COOP is business continuity planning for the
public sector. "COOP planning is simply a 'good business
practice'---part of the fundamental mission of agencies as responsible
and reliable public institutions" (California Courts, 2003, p. 3).

An associated concept, Continuity of Government (COG) has been in
circulation for quite some time. "Continuity of Government has been
defined as the preservation, maintenance, or reconstitution of the civil
government's ability to carry out its constitutional responsibilities"
(California Courts, 2003, p. 2). COG ensures that if something happens
to a governmental leader, there is a succession chain pre-defined to
replace that leader to minimize the impact on normal operations. COG
planning is a fundamental part of our government structure and is
exemplified by the succession chain for the President of the United
States. As part of business continuity in the private sector, executive
succession planning fulfills a similar function.

"Today, COOP planning remains an important requirement. While terrorism
may be the threat that is leading to the increase in planning efforts,
COOP and COG planning will help ensure government services in the face
of any hazard" (Davis, 2003, p. 16). It is vital that the business end
of a city continue to function in an emergency situation so that the
residents of the city can be best served. It is vital that private
businesses remain intact as well. People depend on business for jobs,
which pay for all the other necessities of life. Governments rely on
businesses to pay taxes, which keep the cities going.

\[Note: In the remainder of this section, the term BCP will be used to
include both private and public sector business continuity planning,
unless otherwise stated.\]

In light of terrorism and ever more costly natural disasters, there has
been increased interest in BCP, but many organizations still do not give
it sufficient consideration. Organizational leaders that ignore business
continuity planning may rationalize that they are immune from disasters
said Smith (2003, p. 40). A common refrain is: Look how long we have
operated without a disaster (usually thinking of an earthquake, fire,
etc.). Alternatively, the thought of disaster may be so overwhelming
that paralysis sets in and nothing gets planned for (Kaplan, 1996, p.
141). Some leaders assume that things are in better shape than they
really are or that the government or insurance carrier will repay the
losses.

Even though BCP seems costly to implement, the potential risks are much
more expensive. "Simply put, the benefit of a well-constructed
continuity plan is to minimize the likelihood that, in the event of a
major disruption, the organization is so adversely impacted that it
either ceases operation or is acquired" (Penz, 2003, p. 29). Possibly
the biggest obstacles to implementing a business continuity program are
a shortage of resources and knowledge about the BCP process. While the
benefits can be difficult to measure and quantify, a company that
realizes now---critical files could be destroyed, customers could be
injured, vendors could vanish, and the organization disappear---and acts
now, will be more likely to stay in business.

A company may fail to consider the risks it takes by selling a single
product or using a sole supplier. Or, management may think that systems
such as risk management and business interruption insurance are already
in place and sufficient. Or, they do not consider where the business
will operate and what will happen to employees if a fire destroys the
company's facilities. Possibly the executives do not look far enough
into the future or contemplate alternate operational scenarios such as
the risks of their customer base changing or a key executive being lost.
A major side benefit in completing a BCP analysis of an entire company
can be exposing the whole range of strengths and weaknesses in the
system, allowing the organization to rebuild from the inside out.

Business planners may be tempted to use a generic BCP template for their
organization. But, every entity is different and plans must be
customized to fit the needs, according to Smith (2003, p. 41). Business
continuity planning requires immediate, and long-term, resources. Each
business unit must be analyzed. New equipment may be needed, including
the following: a better computer backup process, new security system, or
alternate communications. Companies may need more insurance coverage,
better software, a fire-and impact-resistant safe, ergonomic furniture,
fences -- the list can be overwhelming. Training and exercising the plan
also costs money, time, and resources. Leaders have to allocate scarce
resources to a project that may be long and complicated.

Disaster recovery started in IT departments many years ago, and the
notion persists that BCP involves only backing up computers and
protecting the equipment. In fact, BCP is much more than that (Toigo,
2000, p. xi). Now that technology is so widely distributed throughout
organizations, the IT department is not always the lead on BCP. When
putting a BC planning team together, representatives from each
department are needed on the team. It is also important that the message
about BCP reaches everyone in the company and that the message is
consistent. If BCP is not coordinated from the top, Security may do one
plan, IT another, and Risk Management a third, while other business
units struggle to put something together. Without a holistic approach,
the plan may fail.

Many cities and other organizations do not have plans in place for where
to conduct business if normal facilities are unusable. Some city public
works, municipal, and recreational personnel may be able to operate in
the field, via radios, vehicles, and outlying facilities. However, City
Clerk, finance, administration and other city personnel require office
space, computers, and other equipment. Damage to major city facilities
and infrastructure may necessitate a relocation of personnel for an
indefinite period of time. Koehler (2003) posed a very possible scenario
for a major earthquake affecting a metropolitan area and some possible
consequences:

In slightly over a minute, most city and county agencies/departments
found themselves without a place to sit, communications, information
systems, files, work area, equipment, supplies, forms, contacts, and all
the other resources they normally used on a daily basis to deliver
program services. In the adjacent parking lots, parks, and streets,
clusters of agency/department staff gathered. Without exception, all of
them are trying to figure out what to do and where to go. They can't use
their emergency plans because the plans stop after the response related
tasks. None of the plans contained information on recovery or resumption
of agency functions. Each city agency is now left on their own to start
figuring out what needs to be done and how to do it. In other words,
they're starting a planning process instead of commencing to recover, as
they should be doing. In many cases, this planning process is further
hampered by the loss of staff. Later on, many agencies/departments will
find that there was a substantial loss of data that can never be
recovered. In the meantime, citizens will soon be calling and arriving
at various city and county agency/department locations seeking
assistance. To exacerbate the situation, the demand for services will be
coming at a time when they need them the most. However, it will be at a
time when they are least ready to deliver. (p. 56)

Some entities currently distribute their operations throughout a number
of facilities and to other cities, states, or countries. After the World
Trade Center bombing in September 2001, companies realized the wisdom of
not putting all their eggs into one basket. The business environment,
whether in the public or private sector, is a complex system. Personnel
have become very dependent upon electronics and other technology,
including computers, printers, Internet connections, telephones, fax
machines, cash registers, calculators, air conditioning, lights, cable
television, and much more. Organizations must look at alternative
methods of operating if the physical workplace or vital infrastructure
is severely disrupted.

One approach is to develop *hot sites*, which are pre-designated and
pre-set up sites where an entity can perform operations at some level.
Hot sites usually contain backup software, computers,
telecommunications, and possibly office space as well. In contrast,
*cold sites* are usually off-site areas where a company can put
equipment and computers necessary for employees to work at some
minimally acceptable level. According to Kirvan (2003):

> A major part of business investment is infrastructure. The term
> includes a broad range of facilities, systems, and technologies. The
> absence or inability of a firm's infrastructure to function can
> seriously impact business, which makes protection measures a vital
> point of consideration. The following elements must be addressed:
>
> Buildings and land
>
> Highways and access roads
>
> Electrical power and protection
>
> Security
>
> Telecommunications
>
> Information systems
>
> Heating, ventilation and air conditioning (HVAC) systems
>
> Water supplies
>
> Waste removal and treatment
>
> Illumination
>
> Furniture
>
> Office supplies and equipment (p. 52)

Cities may also depend upon volunteer agencies to provide assistance to
residents at some point. Depending on the crisis, county, state and
federal agencies may also offer services to the public. Because they
typically offer first-line response, cities must get back to normal as
quickly as possible. This means that records must be recovered and
accessible; data must be restored from good backups; and facilities must
be usable. Pre-planning is essential to ensure that computer and
communications systems can be quickly restored, or that practical
work-around solutions are in place. Delivery of services also should
include services to city personnel who will need their paychecks,
benefits, safe working conditions, and proper equipment. Employees may
need shelter in place; may need to be provided with food, water, and
sanitary facilities; and may need someone watch their children so they
can help the public.

Though city governments, as public agencies, are non-profit, they still
need a revenue stream in order to function and provide services to
residents. If a city is affected by a disaster, tax revenue will drop,
expenses will increase, and businesses may close. In the private sector,
a business may get business resumption insurance and lines of credit to
help bridge the gap between disaster and normalcy. They may plan to make
or provide alternate products or services if unable to perform business
as usual. City governments may not have all the same options, but
similar planning should be devoted to emergency funding and disaster
costs. Federal and state disaster reimbursement regulations are
increasingly stringent, and cities are required to pay most of their own
recovery costs.

Institutions, such as the Securities and Exchange Commission, Federal
Deposit Insurance Corporation, Federal Reserve and others are already
mandated to have business recovery plans in place per Barnes (2001,
p.3-4). Some leaders do not fully comprehend the liability issues they
may face in the future if plans are not put into place now. If critical
information is lost or contracts go unfilled, organizations may be
subject to fines and other legal actions (Toigo, 2000, p. xiv). The
risks for a disrupted city government include non-compliance with
mandatory procedures, defaulting on loans, and liability for injuries or
death of personnel or residents (Reiss, 2001, p. C-3). Rules and
regulations govern council, committee, and commission meetings, but some
or all of the processes to ensure compliance may be temporarily
unavailable. Ultimately, non-delivery of services to the public may mean
that the city has failed in its primary mission.

"Today disasters are defined differently than they have been in the
past. Disasters still include those events that can physically damage
the company's assets (buildings, equipment and finished goods), but
today disasters include intangible events---events that do no damage to
any physical assets, but damage a company's image or integrity" (Stagl,
2003b, p. 41). Several years ago, Johnson & Johnson immediately pulled
their Tylenol brand pain reliever from store shelves and took action to
mitigate the incidents of poisoning caused by tampering of the product.
The Exxon Valdez incident was handled differently---with denial and
outside blame. These are just two examples of radically different ways
that corporations have responded to crisis. In one case, the
organization maintained its reputation and integrity. In the other case,
the Exxon Valdez crisis still lingers as a bad example of corporate
response.

Digital assets are being attacked more frequently. Hackers and others
are stealing or destroying company information. Newspaper articles often
appear about personal data being stolen and used by identity theft
rings. Organizations are faced with the challenge of protecting their
image as trustworthy entity as well as continuing operations with
missing or compromised data.

Public entities are not immune from the consequences of negative public
perceptions. Public officials are spokespersons for the city. Newspapers
frequently quote politicians who have said something inappropriate
either in jest or in earnest. In Los Angeles County, elected officials
in a number of cities have been indicted, recalled, or otherwise legally
chastised. When a city's reputation is tarnished, it may not attract the
residents and businesses it hopes to, leading to deterioration in the
residents' quality of life. An effective business continuity plan will
include measures to mitigate possible damage to the city, such as
procedures for clearing all media announcements through the legal
department, special training in crisis communications for elected
officials, and restrictions on who is allowed to speak for the city.
Kaufman and King (2003) stated:

A world-class BC program must integrate recovery of business process

> functionality, technology DR (disaster recovery), site level emergency
> response activities and human capital crisis plans. These plans must
> be integrated not only with each other, but also aligned to the
> strategic and economic objectives of the corporation. BC management
> then becomes an important strategic process that, when properly
> implemented, provides a sustainable competitive advantage to the firm.
> (p. 30)

[Strategic Planning]{.underline}

Strategic planning is a method that many organizations use to drive
processes that define the whole company. "Strategic planning allows
organizations to make fundamental decisions that guide them to a
developed vision of the future. The result of this effort, the strategic
plan, serves as the basis for action---a road map that directs all
resources toward an ideal future" (Verardo, 1997, p.1). Strategic
planning positions an organization for long-term sustainability and high
stakeholder value. Strategic planners ask questions such as what
business are we in? What is our corporate culture? And where are changes
taking place in the market? The well-thought out strategic plan also
provides answers to many of those questions with vision and mission
statements, goals, objectives, and action plans.

The strategic plan is the overall guide to the development and growth of
the organization. A strategic plan is a long-range plan, usually done
every three to ten years. Strategic plans can be prepared on many levels
of the organization as well. There may be functional plans, site plans,
business unit plans, and so on. Each lower-level plan rolls up until it
is incorporated into the top-most organization plan. Annual operating
plans are built to support the strategic plan. These annual plans detail
monetary and staffing requirements.

In order to decide where the company is going and how it will get there,
top management, Kerzner (2001) said:

1.  Scans the external environment and industry environment for changing
    conditions.

2.  Interprets the changing environment in terms of opportunities or
    threats.

3.  Analyzes the firm's resource base for asset strengths and
    weaknesses.

4.  Defines the mission of the business by matching environmental
    opportunities and threats with resource strengths and weaknesses.

5.  Sets goals for pursuing the mission based on top management values
    and sense of responsibility. (p. 15)

Resources are limited in most organizations. An organization develops a
budget, based on projected revenues and expenses, and must continually
adjust spending to meet actual income and expenses. Surplus income in a
given period may need to be invested; a lack of funds may require a loan
to keep things going. If capital purchases are part of the strategic
plan, then funds must be put aside for those purchases as well. An
organization that does not plan for the unexpected may fail.

Due to the high labor costs in some areas of the United States,
companies are leaving unfilled positions open and/or authorizing
overtime or compensatory time for existing employees. These methods to
stretch employee resources can leave workers feeling overworked,
stressed, and undervalued. Under these circumstances, there is a greater
chance of employees leaving positions, taking more sick time or
committing acts of workplace violence. Succession gaps and loss of key
employee knowledge creates additional risks in an organization.

When outsourcing jobs to other companies or countries is considered
during the strategic planning process, all risks need to be considered.
Some of the issues that may be encountered include training, retention,
local infrastructure, laws, culture, language barriers, and burnout and
demands of outsourced employees in other countries. A major strategic
concern is how to balance personnel resources to avoid future problems.

Depending on the size of the organization, varying levels of personnel
may have input to the strategic planning process. In a small company,
the owner may determine all strategies. Those who actively participate
in strategic planning for a corporation, for example, may be from
operations, sales, marketing, production, human resources, IT, and
business/financial management. Usually, the top management tier
completes the final plan.

"The element of risk is an important consideration throughout the
strategic planning process. As with many facets of our lives, increased
risk can mean increased rewards but can also mean disaster. How a
business manages risk will be largely determined by the strategies that
are developed and implemented" (Arringdale, 1997, p. 60). Risks can be
categorized as low, moderate, high or very high. The higher the risk
category, the more carefully planning and resource allocation needs to
be done to manage the risk. A risk assessment in conjunction with a
proposal for a new product or service may not include elements such as
disasters, infrastructure vulnerabilities, supply-chain disruptions or
loss of qualified personnel. It may not look at
non-market/non-competitor trends and may not include contingency
planning as a cost element of the proposal. There might not be
mitigation plans in place for risks identified.

As business becomes increasingly global, additional risk factors come in
to play. According to de Kluyver and Pearce (2003):

> Even with the best planning, global strategies carry substantial
> risks. Many globalization strategies represent a considerable stretch
> of the company's experience base, resources, and capabilities. The
> risks a company can encounter in the international business
> environment can be of a *political, legal, financial/economic, or
> sociocultural* nature. (p. 123-124)

Contingency planners, who are not normally included on the strategic
planning team, may add value to the planning process by providing a
different perspective on risk and vulnerability.

[Scenario Futuring]{.underline}

A tool now used in business management is scenario planning. This method
incorporates strategic thinking, imagination, multiple perspectives, and
other factors to create *storylines about potential futures*. "Stories,
by their very nature, look backward. There is a lot to learn from the
past. Nobody wants to go through life in an organization or business
looking in a rearview mirror, however, so stories that look forward, or
*scenarios*, are receiving increasing attention in corporate boardrooms
and government agencies. Using scenarios in the planning process is a
useful strategy for coping with the many uncertainties in today's
globalizing environment" (Neilson and Stouffer, 2005, p. 26).

Scenarios can be developed for any future period. Royal Dutch/Shell
Group (2002, \[Foreword\], ¶ 2), which pioneered scenario planning in
the 1970s, builds scenarios every three years for periods up to twenty
years in the future; other companies may project out five, ten, or
fifteen years. These scenarios are also called "futuribles," a term
coined by Bertrand de Jouvenel (Wagar, 2001, ¶ 3) from the French term
"futurs possibles."

Scenarios are used to discuss hypothetical situations so planners can
see how an incident may impact the organization depending on factors in
play at the time of the incident. Scenarios can also show how multiple
components might fit together. Planning for the future (futuring) is
vital in any organization, including organizations such as the Federal
and State, and local governments. This is especially true in regards to
municipal planning for disasters. Without planning, critical supplies
and resources may not be available when needed, confusion may reign, and
the public may not be effectively served.

Traditionally, planning has followed a fairly linear approach (i.e., we
can project future needs based on what is currently happening). Those
who remain committed to this "default scenario" may experience crises
when the future is drastically altered, leaving them unable to change or
adapt (Hodgson & Tait, 1996, ¶ 3). The future is not readily
predictable, and with increasingly complex interactions influencing us
daily, an improved way of planning was needed. Scenarios can help
organizations recognize impending threats, and mitigate them, before
crises occur.

In the wake of the World Trade Center disaster on September 11, 2001,
scenario futuring in the emergency management area appears to be on the
rise, at least in regards to terrorism (as evidenced by the increasing
number of magazine and Internet articles focusing on this approach).
Scenario futuring, in this context, can also be used for other disaster
situations, and it can potentially help with prevention, preparedness,
and mitigation efforts, if sound strategies are adopted. In emergency
management, scenario planning can be used to help a municipality or a
corporation understand and view itself in a new light and perhaps plan
more effectively for the future in many areas, not just disaster
response. Disaster impacts can last for years and complicate traditional
future planning (Alexander, 2002, p. 2).

After developing and analyzing scenarios, strategies can be implemented
to guide the organization towards a survivable future. As Wilkinson
(1994) pointed out:

Scenario planning derives from the observation that, given the
impossibility of knowing precisely how the future will play out, a good
decision or strategy to adopt is one that plays out well across several
possible futures. To find that "robust" strategy, scenarios are created
in plural, such that each scenario diverges markedly from the others.
These sets of scenarios are, essentially, specially constructed stories
about the future, each one modeling a distinct, plausible world in which
we might someday have to live and work. (¶5)

Past crises and best guesses about the future have normally provided
material for contingency planners to make decisions for the future. The
future is usually assumed to be relatively consistent with the current
state; alternate futures are not examined or tested.

However, by using the scenario futuring method, planners can take a
varying number of factors into consideration and document or discuss
multiple, possible futures. By examining these potential futures,
scenario planners may gain insights into underlying issues, forces, and
trends. Using scenario futuring in contingency planning allows a much
more detailed look at problems that may occur in the future. Examining
the organization's preparedness levels in light of several possible
futures will help identify unforeseen issues.

The term *scenario planning* can mean different things, depending on how
it is being used. When used in disaster exercise design, for example, a
design team may decide to base their exercise on the idea of "an 8.5
earthquake occurring at 8:00 a.m." This initial premise is then fleshed
out into a more complex story or scenario. Based on that scenario, a
major and minor events list is created; problem messages and expected
actions are developed, and so forth. Another use of scenario planning is
*war-gaming* as done by military organizations. Military planners may
create several scenarios, based on anticipated enemy actions, and
current resources, then decide what needs to be done in order to "win"
the game.

*Scenario futuring* expands on those concepts. Instead of developing one
scenario, any number may be developed. This aspect makes the process
similar to war-gaming, but these scenarios can be based on
uncertainties, possibly projected farther into the future, and encourage
long-range thinking, among other things. Most likely, none of the
futuribles will play out exactly as scripted. However, once the various
scenarios are written, planners can look for ways to manage or operate
that will allow them success in as many of those futures as possible.
According to Royal Dutch/Shell Group (2002, \[Foreword\], ¶ 2),
scenarios are not prophecies or preferences. They are challenging,
coherent, and credible alternative stories about the future
incorporating a spectrum of ideas. They are designed to help us
challenge our assumptions, focus on key uncertainties, understand
drivers and dynamics, and test our strategies and plans.

Since it is difficult, if not impossible, to operate an organization
without outside influence, how does the organization plan for the
future? How do the planners and managers and leaders know what the
economy will be like next quarter or next year? How do they know what a
new president will be like, or what laws Congress will pass in the next
five years? How do they know what consumers will want or what the next
hot trend is? How do they determine the best path for their organization
to take that will guarantee at least some measure of continuity and
success? The answer to these questions is that they don't. All they can
do is make the best plans they can, based on current knowledge. The
better run, or perhaps luckier, organizations will be able to adapt
quickly to change. Others won't. If an organization puts energy into
developing future scenarios, they will likely have an improved chance of
succeeding in the long-term. "Crafting and analyzing futuristic
scenarios can help strategic leaders establish a clear sense of
direction" (Neilson & Stouffer, 2005, p. 30).

When a city develops an Emergency Operations Plan, a number of hazards
and planned responses are documented. Each hazard, though, is treated as
equally destructive each time it may occur. There are seldom any
provisions for the continuing changes (political, demographic, etc.)
that occur in the city itself over time. And, in some cases, little
attention is given to preventive and mitigating factors that may be put
into place ahead of time. Cities are concerned with day-to-day
operations and policies, yet need to be the best prepared since they are
the first responders to local events, regardless of any other
extenuating circumstances that may exist.

[Summary]{.underline}

The review of literature provides a background in planning fundamentals
for non-professional contingency planners as well as those unfamiliar
with strategic planning and scenario futuring. Emergency management
traditionally focuses on preparing to respond, responding, and
protecting people and structural assets; the main goal is protecting
life and safety of the environment. Business continuity planning focuses
on protection of operational assets and recovery from a disaster; the
main goal is to get the business revenue streams back to normal as
quickly as possible. Both contingency planning elements, however, seek
to prevent or mitigate as much as possible before a disaster and to
improve readiness to respond and recover.

Bradford and Duncan (2000) asserted that "there are three questions that
lie at the heart of business strategy:

1.  What are you going to sell?

2.  Who are your target customers?

3.  How can you beat or avoid competition?" (p. 21)

These questions guide the growth and development an organization,
whether it is a governmental or private entity. A city, for example,
will sell its political views, safety, cleanliness, and other products
to the customers (residents) in an effort to keep the residents and
revenues in the city. Some cities offer incentives to attract new
business or offer residents a lower tax rate to beat the competition
(other cities). "Strategic planning focuses largely on managing
interaction with environmental forces, which include competitors,
government, suppliers, customers, various interest groups and other
factors that affect your business and its prospects" (Safranski & Kwon,
1991, p.i).

Risk and uncertainty are inherent in business operations. "Many
strategic choices involve future events that are difficult to predict"
(de Kluyver & Pearce, 2003, p. 25). Risk management personnel deal
mainly with buying insurance and financial mitigation. Risk is also
considered when developing contingency plans. Scenarios help to put the
ideas of risk into a manageable, understandable format so that
preventive and mitigating elements can be put into place. Scenarios
"help communicate future visions in a concise manner. They challenge
present thinking and foster the art of strategic conversation among
stakeholders to anticipate some of the unexpected eventualities of
increasingly chaotic and asymmetric domestic and global environment."
(Neilson & Stouffer, 2005, p. 30).

CHAPTER 3

PLANNING METHODOLOGIES

This chapter examines the common planning processes of emergency
management, business continuity, strategic planning, and scenario
futuring. Each of these processes aims to help the organization prosper
and/or survive.

[Emergency Management]{.underline}

In the emergency management field, a concept called all-hazard planning
is widely used. Since any incident can trigger secondary impacts,
Alexander (2002, p. 26) said, a holistic view of the organization and
its facilities is needed. By putting systems into place that work in a
wide variety of disasters, and by planning for the worst case scenarios,
the entity is much more likely to survive.

When starting an emergency management program, a study should be done to
determine what systems and resources are currently in place so planners
have a baseline of the entity and its capabilities. The next step is to
develop a hazard assessment. "Before developing an emergency plan, it is
important to assess which hazards are significant in the area that the
plan will cover" (Alexander, 2002, p.24). The hazard assessment
contemplates the possible internal and external threats to the site; the
vulnerabilities of people, assets, and property; and the resources
available to reduce to the threats.

Typically, potential threats to a site are listed and rated on a scale
as to the likelihood and frequency of occurrence. Associated impacts to
life, assets and operations are added to those ratings. Resources
available to handle those threats may decrease an overall score. That
is, the more able an entity is to respond to the threat, the lower the
actual losses may be. Threats are then ranked from highest score to
lowest. An organization may choose the top ten or twenty threats and
examine ways to mitigate or prevent their occurrence.

In California, for example, an earthquake may be the top threat for a
site. An earthquake has the potential to destroy facilities, cause
injuries or death, and affect an organization for a long time in the
future. Additionally, there may be secondary impacts, such as a fire
starting when a heat source is knocked over by a tremor. An organization
in another state may see flooding as the biggest threat to their site.
Casavant (2003) suggested that frequency, duration, and geographic
location of the event are also factors in determining risk. He also
pointed out that:

> After determining the probability of an event occurring, you should
> also determine the liability and cost. A high-probability,
> low-liability event such as temporary loss of electrical utility may
> not warrant much consideration. However, a low-probability,
> high-liability event such as an extended loss of utility must be
> planned for. A third component to consider is cost. Is the cost of the
> emergency event elimination or reduction worth the trouble? Is the
> return on investment worthwhile? (p.100)

There are various ways to handle threats. They can be accepted, avoided,
mitigated or transferred. According to Watson (2004):

> *Acceptance* of risk occurs when an organization determines that the
> probability, vulnerability and potential impact of a particular hazard
> are low enough to justify taking no action at all. Conversely,
> *avoidance* occurs when an organization concludes that an activity is
> so fraught with peril that it must avoid the situation altogether.
> *Mitigation* occurs when an organization decides that safeguards can
> be cost-effectively developed in such a manner as to reduce the risk,
> vulnerability and impact of a potential hazard. Finally, an
> organization may *transfer* some of its financial risks by simply
> purchasing insurance. (pp. 31-2)

Emergency planning can be classified into two types of planning:
short-term and long-term. Short-term planning is usually done before an
incident occurs to ensure that response components are ready when needed
(Alexander, 2002, pp.9-10). Responders who are cross-trained in ICS
positions know that no matter who responds, or how many, the system will
function. Facilities and public works departments can have maps
available and know where key systems such as HVAC (heating, ventilation
and air conditioning) shut-offs and electrical rooms are located. Many
entities are required by law to have pre-fire plans in place. Crisis
management teams know where to report and how to work together. Even
though a disaster or incident may present itself as unique, there are
common elements that may be addressed each time, to varying degrees,
such as communications, financial impacts, evacuations and so forth.
Planning ahead of time will speed the response phase and move the
organization more rapidly into the recovery phase.

Long-term planning issues in recovering from a disaster or incident can
be very complex and take a long time to accomplish (Alexander, 2002, p.
8). A disaster could change an entire city (such as New Orleans after
Hurricane Katrina) or organization. After the 1994 Northridge,
California earthquake, some residents and existing businesses left that
area, while new people and new businesses moved in. The demographics of
the area changed radically and the city had to adjust its revenue and
expense predictions, which impacted the way the city operated, the
services it could offer and its recovery plans.

After a major incident, there is increased and active attention paid to
the incident and its impacts. This is the best time to get funding and
mitigation measures put in place. But mitigation measures may take a
long time to implement. A big challenge for emergency management is
sustaining the interest and resources during this time. Other challenges
for long-term planning are reacting to an isolated incident versus using
an all-hazard approach to mitigation and avoiding additional
vulnerabilities.

Among the documents developed as part of emergency management are
emergency operations or crisis management plans. These plans are used to
guide the organization through the preparedness and response phases and
generally contain similar information as shown here from the contents of
a public sector plan from the California Governors Office of Emergency
Management (1999):

1.  Basic Information

    a.  Planning process

    b.  Agency responsibilities

    c.  Promulgation and approvals

    d.  Plan update, distribution and training processes

    e.  Legal authorities and references

    f.  Emergency organization structure and plan of succession

    g.  Vital record protection

```{=html}
<!-- -->
```
1.  Hazard assessment including planning requirements

2.  Overview of functional roles and responsibilities

3.  Emergency operation center

4.  Recovery operations

5.  Disaster assistance and financial considerations

6.  Attachments or appendixes detailing

    a.  Specific plans for dealing with common situations, such as
        medical care, sheltering and the news media

    b.  Analyses and inventories of supplies

    c.  Checklists for specific operations (pp. ii-v)

Periodic training exercises can be held to simulate crisis and to
provide feedback on systems before an actual disaster occurs. Following
an exercise or an actual crisis or disaster, an analysis is done to
determine what went right and what went wrong (lessons learned), and
what changes can be made to avoid similar issues in the future (after
actions). Reviewing the lessons learned from exercises or crises, and
what was done to mitigate them, provides a foundation for future
planning. As Kaplan (1996) stated "every disaster is unique, and through
that uniqueness, many important lessons are learned" (p. 316). An
organization may look for patterns---do the same communication issues
occur during each exercise? Are the personnel lists current each time?
Examining the general areas where problems seem to occur can help point
out potential weak spots. Information about past events may be available
to contingency planners such as: eyewitness accounts, research reports
done by personnel in the organization, books and articles written about
the disasters, and feedback from first responders and victims.

When doing a review of lessons learned, Kaplan (1996) also says to
"identify specific areas of concern, who's responsible for correction,
documenting response, and date of completion" (p.316). After actions
should be prioritized and implemented, depending on resources available
and urgency of the action. A fire Life Safety Code violation, for
example, may need to be fixed immediately. Contingency planners may
follow up on these after actions by performing drills or tests of those
specific areas, or re-testing the entire planning system again.

Emergency planning processes start with a review of existing conditions
and end with testing, maintenance, and feedback. All systems need to be
tested and practiced, frequently, before an incident occurs. Emergency
plans must be reviewed as often as necessary to ensure they are
up-to-date. And feedback is essential for re-analyzing all the emergency
management systems.

[Business Continuity]{.underline}

Business continuity (BC) plans are developed to assist in recovery, and
implementation is started when an incident is contained or even sooner.
Leaders immediately begin thinking about the costs of the outage and
effects on personnel. When entities first develop BC plans, they follow
five main stages in the development process. (Barnes, 2001, p. 19) The
first step is to obtain leadership support for the process.

Next, various analyses are done which address issues such as recovery
time objective (RTO) and recovery point objective (RPO). The RTO, as
defined by DRI, International in the DRJ Editorial Board Glossary (2005)
is "the period of time within which systems, applications, or functions
must be recovered after an outage (e.g. one business day)." The RPO from
the same source is "the point in time to which systems and data must be
recovered after an outage as determined by the business unit." The
Business Impact Analysis uses this information.

Third, risks are examined. Fourth, each portion of the entity develops
specific instructions to reconstitute their processes. Lastly, the plans
are tested. Once the cycle is established, BC plans need to be tested
and updated as the entity changes.

Organizations should do a risk analysis. This document identifies
various risks to the entity. In many ways, risk analysis is similar to
the hazard assessment done in emergency planning; however, risk analyses
are more quantitative documents. For example, a risk analysis may show
estimated dollars lost each day when operations are completely down,
costs of overtime to re-establish functions, and cost-benefit analyses
of mitigating or controlling particular hazards. It may also try to
quantify intangibles such as company image and reputation. Long-term
effects on stock prices and investments in the event of a disaster may
also be considered. Section A.5.3.3 (7) in the NFPA 1600 standard (NFPA,
2004) states:

An economic and financial impact analysis allows the quantification of
the impacts without considering the cause of the disaster/emergency.
This analysis is closely related to the process of identifying essential
or critical functions or processes and helps decide where to place the
emphasis in the planning efforts.

The analysis examines potential economic and financial loss resulting
from disruption of the functions, processes, or services over time. The
purpose of an economic and financial impact analysis is to arrive at a
general loss expectancy that demonstrates what is at risk and to guide
measures to mitigate the effects of a disaster/emergency. (p.1600-10)
[]{.mark}

The business impact analysis (BIA) is an important, related document. A
BIA is an in-depth document examining all systems (personnel,
operations, and equipment) currently in place to achieve the business'
mission. Systems are ranked in order of importance for the continued and
satisfactory operation of the entity. The maximum amount of time those
systems can be down without irreparable harm to personnel, the public,
the environment, or the entity is also assessed. Any systems deemed
critical (to the organization) would be restored first. Someone using an
Automated Teller Machine (ATM), for example, expects to get cash 24
hours a day, 7 days a week. So a bank may determine the ATM is a
critical system with a downtime goal of zero minutes. Banks must run
redundant and/or parallel systems in order to reduce the chances of
being out of service. Along with determining which services and
processes must be restored first, an entity must look at the internal
and external interdependencies between systems.

After a disaster, structures may be damaged. Temporary housing or
shelter for citizens may be needed. Building engineers and inspectors
must have processes in place to inspect properties and determine
soundness. City planning departments must have processes in place to
issue necessary permits for demolition and construction on public or
private property. The public works department must have processes in
place to safely remove debris, and this process must include
environmental hazard controls. If a city does not know what the most
important and interlinked processes are, the businesses and residents
will not get the services they require. The BIA must document all the
entity's processes and prioritize those that will be restored first.

A business process map may also be developed as part of the BIA. This
map details each process completely and includes information such as
manual workarounds; system, personnel and other resource needs;
restoration priorities; and interdependencies between processes. With
the complexity of modern systems, it is also critical to know what
outside dependencies exist and what continuity plans upstream and
downstream vendors have in place to support the entity's processes as
well.

The risk analysis, business impact analysis and business process map are
parts of an overall document called the business resumption plan (BRP).
Like an emergency operations plan, the BRP typically also contains the
following elements:

1.  A listing of the legal and regulatory authorities guiding the plan
    along with leadership acceptance of the plan

2.  Roles and responsibilities of recovery personnel and departments

3.  Various attachments or appendices such as:

    a.  Detailed plans for restoring computer networks and
        telecommunications

    b.  Process cross-references

The business resumption plan can be viewed as a recovery, mitigation and
prevention document and must be funded and implemented in order to work.
A BRP may be written for a department, a site or an entire organization.
Regardless of how it's done, though, it is imperative that all
organizational processes and systems be examined so that recovery
strategies can be developed and put in place for those deemed critical.
Customers or residents who are dependent on a business or city may not
be able to afford or survive the downtime. "The benefit of strategic
business continuity planning (BCP) is that management realizes the cause
of the problems is not an immediate concern. The immediate concern is
the delivery of a needed product or service for the customer. After the
customer is taken care of, management can address the cause of the
problem" (Stagl, 2003, p. 41).

As with emergency management, regular testing, maintenance, and feedback
are important to the business continuity program. Processes and systems
can change very rapidly, so on-going training and updates to the BRP are
necessary.

[Strategic Planning]{.underline}

Goodstein, et al. (1993) said:

> Our definition of strategic planning---"the process by which the
> guiding members of an organization envision its future and develop the
> necessary procedures and operations to achieve that future"---requires
> a greater emphasis on process consultation that other models typically
> require. Applied Strategic Planning is very different from mere
> long-range planning, for it is not just an extrapolation of the
> present. This envisioning process has special importance for strategic
> planning in today's turbulent environment. It allows the organization
> to take charge of its own destiny and create its own future rather
> than passively wait for the future to arrive. (pp. viii-ix)

A review of literature revealed that a number of methods for developing
a strategic plan are in use. However, the following six steps appear
common to the various approaches:

1.  Develop vision and mission statements

2.  Create a strategic model

3.  Perform an audit of the organization

4.  Do a gap analysis

5.  Complete action plans

6.  Implement the plans and test the system

In the first step, the organization develops their vision statement by
developing value statements, brainstorming ideas, or other methods.
Visioning is a creative process. A vision may be developed by a leader,
a committee, or the entire organization. Once developed, the vision must
be shared and agreed to. A vision statement says what the organization's
overall goal is for example *"We* *will make the highest-quality toys in
the world so children can dream and create as well as play*.*"*

A mission statement is an expansion on the vision statement; what is
being done now, or will be done, to achieve that vision, such as *"We
hire ethical, competent personnel and provide them with the tools,
resources, and training they need to accomplish their tasks. We use
environmentally friendly raw materials and ensure that all products are
recyclable."* When creating the vision and mission statements,
[]{.mark}Goodstein, et al. (1993) suggested, "an organization must
answer four primary questions:

1.  *What* function(s) does the organization perform?

2.  For *whom* does the organization perform this function?

3.  *How* does the organization go about filling this function?

4.  *Why* does the organization exist?" (p. 17-18)

Step two involves strategic modeling, a way to more concretely show the
organization's desired future state, in line with the vision and mission
statements. In order to do this modeling, agreement on the desired
future is necessary. The planning team can then work backward to
determine actions needed to achieve that future.

The third step is to do an audit of the organization. This is where the
vision and reality intersect. "It is important that the envisioning of
the future precede any in-depth analysis of the organization's current
performance and capacity. Otherwise, such an analysis is likely to limit
the options that the planning team considers. Visions not based on
reality are hallucinations. The performance audit is intended to prevent
hallucinations" (Goodstein, et al., 1993, p. 24). An organization's
current resources, performance and market must be examined. For example,
what is the company's culture? How stable is the workforce? How is our
cash flow? What is the company's reputation? Are we growing or
shrinking? Who are the customers? Who are the competitors? How many
products are carried and how profitable is each line? Are we known for
quality or price? "Any data that can help the organization to better
understand its present capabilities for doing its work should be
included in the performance analysis" (Goodstein, p. 25).

Typically, the audit step involves examining the organization through
use of a SWOT analysis (strengths, weaknesses, opportunities and
threats). Organizational strengths may include longevity, experience of
personnel and security of assets. On the other hand, weaknesses can
include lack of a change mentality, being asset-rich and cash-poor, and
a high employee turnover rate. Opportunities generally take the form of
a competitive advantage of some sort such as a one-of-a-kind product,
lower manufacturing costs, or breakthrough technology.

Threats are considered when developing strategic plans, though usually
not in the same manner that contingency planners view them. While a
contingency planner may view a threat as being a natural or
technological event, strategic planners may look at threats more in
terms of competitors and loss of market share. Other factors can impact
an organization and be classified as threats, for example, pending state
or federal regulations, zoning laws, economic trends, and so forth.

Next, a gap analysis is developed by comparing the results of the audit
against the strategic model, that is, between reality and the desired
future state. Also determined are the specific steps that must be taken
to close those gaps. Resources are not infinite and must be prioritized
said Goodstein (1993, p. 263). If the gaps cannot be realistically
closed, the strategic model may need revision.

Next, an action plan is created. This document serves to assign specific
tasks, budgets and deadlines along with responsibility for getting them
done. The process is to:

1.  *Develop goal*s: Goals should contain quantitative as well as
    qualitative elements (Arringdale, 1997, p. 47). The SMART method may
    be used to help develop the goals---simple/specific, measurable,
    achievable/attainable, realistic, and time-bound.

2.  *Determine objectives for the goals*: Objectives detail how a goal
    will be accomplished. For example, in order to increase sales by 6%,
    the organization's objectives may be to: increase production of
    product XX by 30,000 units in six months; decrease overhead costs by
    1% within 2 months; and restructure the production line to increase
    efficiency in 90 days.

3.  *Outline strategies to achieve the objectives*: A strategy is a plan
    for accomplishing something specific such as the achievement of an
    objective. Examples of product strategies include developing new
    products, improving product quality, or eliminating certain products
    from a line. A financial strategy might be to establish new credit
    policies.

4.  *Develop tactics to achieve the strategies*: Tactics are very
    specific steps to be taken to accomplish strategies. If a strategy
    is to develop a new product line, then tactics may include
    researching new materials, hiring a development team and conducting
    a customer survey.

At each level of the action plan, allocated resources and timelines will
be broken down further. For example, the organization may set a goal of
increasing sales by 6% within five years. An objective may be to
increase sales by 1.5% the first year, and one of the strategies to
accomplish that objective is to develop an annual "special customer"
sale program. The tactics to achieve that strategy will include
advertising, increasing customer contacts, salesperson incentives and so
forth.

To complete the strategic planning process, the plan must be implemented
and tested. A strategic plan is a detailed map of how to get to where
the organization wants to go. It requires dissemination to, and
commitment from, all levels of the organization. It requires allocation
of resources, including time, money, and people. It requires action at
every level, or the strategic plan will just become another piece of
paper and the organization will never get to its desired future state.
It requires measurement to see the progress being made. And, it requires
feedback and fine-tuning.

[Scenario Futuring]{.underline}

[Trends and Factors -- The Heart of the Scenarios]{.underline}

In order to build scenarios, it is necessary to research trends and to
identify factors that affect the organization and its processes. One way
to identify trends and factors is to create a relationship diagram. For
example, when looking for factors that affect a selling price, a
relationship diagram can be drawn to help establish relationships and
importance. The factors that influence many other factors can be used in
the scenario planning process.

Another method of finding trends and factors is to perform a STEEP
analysis (looking at categories such as society, technology, economics,
the environment and politics). "The key thing to watch is not events
(sudden developments or one-day occurrences) but trends (long-term
ongoing shifts in such things as population, land use, technology, and
governmental systems)" said the World Future Society (2004, p. 32). For
every broad trend, there are deeper issues driving it. To use an iceberg
analogy, the visible portion we see above the water line represents
actual events, current ideas and breakthroughs. Just below the ocean's
surface, are trends, patterns and connections. The bottom of the iceberg
is the unknown and unseen structure and subtle influences.

The trend of rising oil prices is one that many pay attention to. For
example, a rise in the price of oil affects transportation industries
such as the airlines. The airline companies may raise prices, cut
services, change routes, and/or go out of business in response to
increased costs. High oil prices also affect worker commutes, home
heating, businesses that make deliveries, food prices, and much more.
High oil prices can also provide a stimulus for companies to develop
alternate fuel sources, which in turn could cause a lowering of oil
demand and an increase in new technology investments. An increase or
decrease in Presidential approval ratings can affect research and
development options.

A trend towards an aging population affects factors such as medical
care, housing, and education, all of which must be considered in the
public sector. Other examples of factors important to a local government
might be solidarity of city council members, national politics,
public/private attitudes towards emergency management and readiness of
response personnel. Each organization must determine what driving
factors are important to them and what trends to attend to.

Factors associated with trends can be classified as stable or uncertain
for purposes of developing scenarios. Looking at a variety of factors in
different lights can increase the power of the scenarios created.
*Stable factors* are assumed to be relatively constant in the projected
future period, no matter what the scenario. Stable factors may undergo
change, but for the purposes of the scenario period, they are viewed as
stable or changing at a predictable rate. Some examples of these stable
factors may include an on-going assumption of the progression of
technology or increasing globalization and information dissemination. A
city may consider its demographics and geography to be fairly stable or
predictably changing in their scenarios. Public obligations, such as
bonds and loans usually have a fixed period, so they can be factored in
as a constant, depending on the scope of the scenario. Existing
infrastructure will probably be in place for determined period, as well.

*Uncertain factors* become turning points in scenarios. For example, the
Berlin Wall might have been considered a stable factor until it suddenly
came down. Similarly, the population base in a city might drastically
change. This has happened as industries rose and fell, and residents
follow the jobs elsewhere. Communities may get older or see an influx of
young families. A disaster's impacts on a young, fit, affluent
population are different than those on a mostly low-income senior or
special needs population. Could the geography of the area change? Yes,
if a cataclysmic event occurs. (For example, think of the effects of
earthquakes or asteroids.) For the purpose of scenario futuring, a
planner could consider geography of the area as a stable factor, but
view demographics as uncertain. "The further out we look into the
future, the more uncertainty enters into our consideration" (Van der
Heijden, 1997, p.4).

[Developing Scenarios]{.underline}

A number of methods are used to develop scenarios. Commonly, they
involve soliciting ideas from a diverse group of people to identify
driving forces and trends, then writing and testing the stories. Methods
can range in complexity. One method is to use software packages that
help scenario planners build extremely detailed scenarios by rating
critical factors and using complex mathematical formulas to determine
probabilities. Another method of creating scenarios is to simply choose
two or three possible futures and generate scripts for each. For
example, Schwartz (1996) said, "scenarios often (but not always) seem to
fall into three groups: more of the same, but better; worse (decay and
depression); and different but better (fundamental change)" (p.19).

A third method involves putting major uncertain factor continuums into a
simple matrix format (Schwartz, 1996, pp. 243-244). If a two-axis matrix
is used, there will be four possible combinations to start building
scenarios from. The simple framework used in the present study is based
on Schwartz's model and will illustrate the important elements of
creating scenarios:

1.  Analyze trends and identify factors important to the organization

2.  Determine the time period and develop scenarios

3.  Assess how the organization fares in each scenario

An organization's vision and mission statements can serve as the basis
for the scenarios that will be developed for the organization. The
following example shows how this framework can be used. The vision
statement used in this example is: *We will make the highest-quality
toys in the world so children can dream and create as well as play*. The
mission statement used in this example is: *We hire ethical, competent
personnel and provide them with the tools, resources, and training they
need to accomplish their tasks. We use environmentally friendly raw
materials and ensure that all products are recyclable.*

[Analyze trends and identify factors important to the
organization:]{.underline} Start with a relationship diagram to help
visualize a major issue or question an organization has related to its
strategic plan. Then use the STEEP analysis to examine trends and
factors in more detail. Any number of factors can be determined for the
trends being analyzed.

1.  Social -- what is the trend of the toy market?

    a.  Value to parents (value to price ratio)

    b.  Sophistication (simple or complex designs)

2.  Technological -- what are current toy design trends?

    a.  Color (bright or subdued)

    b.  Production (handmade or machined)

3.  Economic -- what is the trend for new businesses?

    a.  Start up costs (high or low)

    b.  Skilled worker pool (growing or shrinking)

4.  Environmental -- what is the trend for eco-friendly products?

    a.  Recycling (important or not)

    b.  Raw materials (available or restricted)

5.  Political -- what is the business climate trend in this area?

    a.  Laws and regulations (restrictive or lax)

    b.  Competition (many or few)

[Determine the time period and develop scenarios:]{.underline} Since
scenarios take place in the future, the organization should determine
how far out in the future the scenarios will be based. A strategic
planning cycle can used or another time period. The time period should
be long enough to be meaningful and applicable. There are cases,
however, where an extreme time period may be used, as in decisions about
storing nuclear waste (Benford, 1999, p.38).

Once applicable trends and factors have been identified, take several
important, uncertain factors related to the organization's plans and put
each on a continuum line. A continuum, for example, could be based on
how sophisticated a new toy would have to be in order to successfully
compete---with simple on one end, and complex on the other---and all
other possibilities in between. Another continuum might be
competition---a highly competitive market or no competition for this
type of product at all.

The toy company in this example wants to know what class of toy to make,
so they look at two main factors -- the complexity of the toy design,
and the current or anticipated competition for that product. The Y-axis
(sophistication) might be labeled "Simple design" on one end and
"Complex design" on the other. The X-axis (competition) could be labeled
"Very competitive" on one end and "No competition" on the other. This
type of matrix, then, serves as the basis from which to generate and
name four basic scenarios. Scenarios are much like short stories and are
given descriptive names to identify them.

1.  Simple design-Very competitive "Mass Quantities"

2.  Simple design-No competition "Starter Toy"

3.  Complex design-Very competitive "Latest Fad"

4.  Complex design-No competition "Rodeo Drive"

To add complexity, additional axes could be added to the matrix,
allowing many more scenario choices. An axis labeled "Start-up costs"
could be added to show cost elements. Or, one called "Production" might
be added to measure a handmade toy against a machined toy.

Once the matrix has been assembled, the stories are written. Any other
identified factors (stable or uncertain) can be added to the story line.
The time line for these stories might be five years in the future. For
example:

*Mass Quantities*: The ToyCo executives decided not to issue a dividend
on the common stock this year. The company has taken a beating in the
market due to competition in the last two years and there was no sign of
a let up. Recyclable toys are common-place and now an industry standard.
ToyCo's design department was working hard on new concepts to help the
company recover market share but nothing special was in the works. After
the Democrats returned to power in the spring of 2009, the economy
started booming.

*Starter Toy*: ToyCo's products had won several major design awards in
the last few years. Due to the patented processes used, competition was
scarce. However, a major competitor planned a big announcement for the
following month. ToyCo executives had heard rumors of a better toy
design. Fortunately, their own product development department had some
great new ideas in the final testing stages. Another big project in the
works was a joint venture with a major recycling firm. The ToyCo
products were not easily broken or given up by the children but when
they were, the new venture would allow kids to get a big discount on new
ToyCo products if the old ones were sent directly to the recycling firm.

*Latest Fad*: Even though the ToyCo products were difficult to make, it
seemed the competitors were everywhere. ToyCo had enjoyed a few years of
a captured market but those days were gone now. ToyCo executives had to
make a decision on what to do next. The economy was fairly flat and
there were few signs of improvement. Starting up a new product line was
very risky. The search for Osama bin Laden was still going on and the
country wondered whether we would ever get out of Iraq and Afghanistan.
ToyCo was considering outsourcing all its operations to a foreign
country.

*Rodeo Drive*: Only the elite could afford the ToyCo product. It was
considered a status item even after five years of being on the market.
Sales statistics showed that the product may have reached its peak
though. The CEO and other top executives were recently indicted on
charges of fraud. It seems that the recyclable toys were not totally
recyclable and some raw materials were illegally obtained. To correct
these problems, it would take a big capital investment in new equipment.
The company was liable for fines and customers might return products. On
the plus side, the product could be upgraded if the investment was made.
A proposed Senate regulation would limit the import of a key product
ingredient.

[Assess how the organization fares:]{.underline} The purpose of
developing scenarios for strategic modeling is to allow the best
possible chance of organizational survival and growth, no matter what
the future brings. Once the scenarios are written and analyzed, better
choices can be made about how to proceed in the future. By looking at
each scenario, discussions can be undertaken to determine how the
organization could improve its odds of survival under each scenario. If
the entity finds ways to survive in any of those futures, they will have
improved the strength of the organization.

During the next strategic planning phase, the organization revisits the
scenarios to see what has changed and what new elements need to be
considered, then updates the scenarios. The entity can create new
scenarios each planning period. And, if the entity finds new
opportunities in the scenarios, they can work backwards to develop a
guide for the future.

[Summary]{.underline}

This chapter examined the planning processes associated with emergency
management, business continuity, strategic planning and scenario
futuring. All these processes analyze past and current states and
project into the future. Combining these processes can help reduce loss
of life, property and assets in any organization.

CHAPTER FOUR

NEW MODEL

In this chapter, a strategic contingency planning model is presented.
The model combines the four processes previously analyzed (emergency
management, business continuity, strategic management and scenario
futuring) under a new methodology.

[The Strategic Contingency Plan]{.underline}

In order to move contingency planning to a higher priority in the
organization, it is necessary to apply strategic management and scenario
futuring processes to the normal planning processes of emergency
management and business continuity. The strategic contingency plan is
based on the organization's overall strategic plan. The organization's
existing documents---vision statement, mission statement, values
statement, and so forth---should be used as a basis for developing
similar documents for the strategic contingency plan. The organization's
vision and mission statements may be created once and used throughout
the company's life or revised as times change. So, too, will be the case
for the strategic contingency plan's vision and mission statements. They
may not need be modified unless the organization's do. Everything in the
strategic contingency plan should support the organization's goals and
use the organization's formats.

The contingency planning department needs to become a business partner
and assess risks based on what's best for the organization. Contingency
planners can bring strategies to the table, showing how the entity can
benefit from mitigation and minimize losses. Contingency planning
practices can be distributed throughout the organization, at all levels
of personnel, to increase resiliency. Pauchant and Mitroff (1992) state:

> The same basic set of processes are involved in both crisis management
> and strategic management. Managers in crisis-prepared organizations
> have learned this fundamental lesson: crisis management concerns the
> totality of their organization as well as their relation with their
> environment and is an expression of the organization's fundamental
> purpose or strategic vision. To say it another way, if an organization
> is not positioned well with regard to crisis management, then it is
> probably not well positioned to compete successfully in the new global
> economy. (p.126)

In Chapter 3, the following method for developing a strategic plan was
described:

1.  Develop vision and mission statements

2.  Create a strategic model

3.  Perform an audit of the organization

4.  Do a gap analysis

5.  Complete action plans

6.  Implement the plans and test the system

When applying this process to contingency planning, the following
variation on this method will be used:

1.  Develop vision and mission statements

2.  Complete assessments and analyses of the organization to identify
    gaps

3.  Use scenarios to expand perspective

4.  Complete a business case

5.  Implement the plans and test the system

[Finding the Gaps]{.underline}

A detailed audit of the organization is needed to identify strengths,
weaknesses, opportunities and threats and create a baseline. Among the
audit documents used are the *hazard assessment*, the *business impact
analysis*, the *risk analysis*, and the *baseline assessment*. The
hazard assessment, developed as part of regular emergency management
processes, analyzes and ranks threats to the organization in terms of
impacts to people, property and assets. The business impact analysis
(BIA) identifies the organization's processes, priorities and
restoration requirements. It should also document interdependencies. A
risk analysis quantifies mitigation, downtime, restoration and other
costs. A risk analysis may also document critical assets (such as
buildings and equipment) and replacement costs. These various analyses
are sometimes prepared without reference to each other due to the
absence of a direct channel between emergency management and business
continuity departments. Risk managers may or may not be involved with
either group. It is helpful to compare all documents to ensure a
complete picture of the entity is created.

The baseline assessment is developed to determine the contingency
planning elements currently in place and those needed. A simple way to
do the baseline assessment is to list all the components of a
contingency planning system. Under major elements the organization
considers important, add sub-categories. This assessment can be
developed for contingency planning documents, as well as physical
components, to determine compliance with organizational and regulatory
requirements. The baseline assessment can also be used to compare
elements across multiple sites.

The purpose of doing the baseline assessment is to determine how well
prepared for crisis an entity really is. An entity may be more prepared
than originally thought, or less so. The baseline assessment is a direct
measure of readiness, and this audit document helps highlight
implementation priorities and gaps where resources need to be applied.
Audit documents can be used as annual tools and expanded on as needed.

Gaps that are a high priority and deal with life safety or property
protection should be analyzed first. There may be alternatives or
workarounds for the missing items. If not, the planner must make it
clear to top management how implementation will support the
organization's goals. But, no matter how urgent the contingency planner
thinks a gap is, a cost/benefit or other justification must be made.
According to Rothstein (2003):

> For top management to dedicate funds and resources to contingency
> planning, more than a demonstrable need must be shown: some basic,
> common-sense questions must be answered to put this effort in
> perspective with other organization investments, priorities and
> initiatives. In other words, the contingency planner must learn to
> compete for scarce resources and funding. To be successful, the
> contingency planner must be able to succinctly and precisely answer
> these questions:

1.  What are we getting for our time and money?

2.  How can we be assured that it will be effective?

3.  What are the consequences if we do not do this at all, or put it off
    for a while?

4.  What are the alternatives? (p.2)

Every gap to be filled needs to be tied to a strategic initiative or
earnings driver or to provide some other stakeholder value in order to
have resources allocated. This may be a challenging notion for many in
contingency planning due to their lack of business management
experience. When proposing a remedy to fill a gap, the contingency
planner needs to make a business case, answering questions similar to
those Rothstein cites above. It is beneficial for the planner to
understand the structure and complexities of the organization in order
to answer those questions successfully.

[The Wider View]{.underline}

Once the gaps are identified and methods to close them determined,
scenario futuring can be used to look for additional weaknesses or
vulnerabilities in the contingency planning system. "The uncertainties
in today's world stem from fast-changing technologies, new business
processes, political shifts, terrorist attacks, and other sources, and
business leaders need to anticipate them in order to cope with them
successfully. One way to do that is through scenarios." (Neilson &
Stouffer, 2005, p. 26) Creating scenarios aimed at examining parts of
the contingency planning system can help an organization be more
resilient. (See Appendix 1 for sample scenarios.) If the scenarios
reveal additional gaps, the planner can add the findings to the baseline
assessment other audit documents.

Widening the view of potential problems may help an organization be
better prepared for any crises that occur in the uncertain future.
Corporations today are using "just-in-time" inventories, lean processes,
and other resource-saving methods. They may depend on a sole supplier,
or be a critical supplier to another company. Without imagining multiple
futures, the organization could very well find itself in trouble.
"Disasters, particularly catastrophic ones, can do more than impose
deaths, injuries, and dollar losses. They can also redirect the
character of social institutions, result in permanent new and costly
regulations for future generations, alter ecosystems, and even disturb
the stability of political regimes. Costs like these rarely, if ever,
are counted as part of disaster impacts" (Mileti, 1999, p. 90).

[The Business Case]{.underline}

A business case is used to justify the allocation of resources to remedy
a gap. It should tell executives why the project is needed and how it
solves the issue or provides opportunity to the organization; what the
solution is; how it benefits the organization and when it will be
implemented; what happens if nothing is done; and what resources are
needed to accomplish the task (Maluso, n.d.). A business case also
supports the contingency planning vision and mission statements.

Once written, the business case can be more easily analyzed for
completeness. A weak business case means the contingency planner should
re-visit their assumptions and logic. Once a strong business case is
presented to management, it will compete with other projects for
resources (i.e., time, money, and personnel). The business case can be
used as a metric during the project's life span and developed for each
gap identified or for the contingency planning program as a whole.
Objectives, strategies and tactics will follow. There are many formats
for preparing a business case. Here is one format:

> Title: *Comprehensive Contingency Planning Program Development*
>
> Purpose: This business case examines the costs and benefits to the
> company of further developing its contingency planning program.
>
> Summary: Team A performed an in-depth audit of the existing
> contingency planning system in the organization, and researched
> external standards. A list of gaps has been identified and prioritized
> based on life safety issues. Our recommendation is that the
> organization fund an on-going contingency planning program aimed at
> bringing our planning levels up to, or better than, industry
> standards. The annual commitment requested is \$500,000.00.
>
> Methods: Team A performed a baseline assessment to measure performance
> at all sites. Additionally, a hazard assessment, business impact
> analysis and risk analysis were completed by emergency managers,
> business continuity personnel, and the risk management organization.
> These documents were cross-referenced to ensure that all systems and
> processes in the company were accounted for. The Team also
> cross-referenced the documents to the NFPA 1600 standard and other
> external standards.
>
> Impacts: Many of the identified gaps directly impact personnel. If the
> project is not funded, there is a greater chance that employees or
> visitors may suffer injuries if a crisis occurs. Additionally, the
> Team found that few mitigation measures are in place to secure
> equipment and furnishings in the event of an earthquake. Some gaps can
> be postponed for a period as there are workaround procedures are in
> place. Additional insurance for the facilities is also an option.
>
> Benefits: By implementing this program to enhance our contingency
> planning program we will show our employees how valued they are to us.
> As part of this program, we will increase employee awareness of
> potential disasters and help them be more prepared, both at home and
> at work. Another benefit is to our customers. They can be more assured
> that we will do everything so that we can provide them the best
> possible service and support. This program will also provide a
> competitive advantage as none of our competitors currently are
> planning at the levels we are.
>
> Implementation: In the following section, the plan has been detailed.
> Each gap is identified and an action plan for it developed. A timeline
> has been created, a point of contact chosen, and an estimated cost
> developed for each gap.
>
> Conclusion: Team A recommends that the contingency planning program be
> funded and supported by top level management as the safety of our
> personnel and assets is vital to operational resiliency.

[Implementation and Metrics]{.underline}

Obtaining organizational support to implement the strategic contingency
plan is vital. Without support, this plan, no matter how well prepared,
may be put aside. Plans are normally developed for multi-year time
periods based on urgency and resources available. It may not be possible
to implement all that is needed or desired.

Measuring the effectiveness of the strategic contingency plan can be
done in several ways. Audit documents can be updated by stakeholders on
an annual basis to measure progress. Holding exercises and drills is a
way to measure effectiveness of training and gap remedies. A contingency
planning budget can be established for the organization and costs
tracked. Employee and volunteer surveys can be conducted. Each business
case should be reviewed periodically during the project and important
changes brought to management attention. A *lessons learned* summary can
also be prepared for a business case.

[Summary]{.underline}

Strategic contingency plans should cover all levels of an organization
and be a top-down initiative; however contingency planners may need to
push their plans up the chain to compete more effectively with other
departments. The benefits of streamlining and improving organizational
processes may help justify costs for strategic contingency planning.
When all components of an organization are analyzed through the
contingency planning lens, inefficiencies become more apparent. For
example, a business process may have more interdependencies or steps
than really needed. When the process is documented in the business
impact analysis, these issues will come to light.

Some losses, such as of property and assets, are reasonably measurable.
Other losses such as human fatalities, destruction of historical
artifacts and loss of image, are not so easy to measure. It is more
cost-effective to mitigate and prevent loss ahead of time, which is why
contingency planning is becoming vital to organizational survival. In
fact, contingency planning is so essential to business success, that it
can be viewed as a corporate asset with strategic business value.

CHAPTER FIVE

RECOMMENDATIONS AND CONCLUSION

Because people, money and time are scarce, it is economically
advantageous to look to contingency planning for mitigation and
preventative measures. The organization's strategic plan will benefit
from having a contingency planning component, according to Pauchant and
Mitroff (1992, p. 151). Contingency planning should be considered a
mission critical system.

If an organization *is* affected by a disaster or major crisis, advance
knowledge and preparation will help the entity recover more quickly.
This chapter presents recommendations for implementing strategic
contingency planning and conclusions.

[Recommendations]{.underline}

Organizations deal with resource allocation issues daily. There is
always competition for resources. Contingency planning initiatives, no
matter how well the business case is presented, may be given low
priority in the budget process. New ways to fund contingency plans are
needed, such as allocating a specific amount per revenue dollar to the
contingency planning program. Developing and performing to
best-practices and industry standards will help drive visibility. Even
relatively small actions, such as purchasing disaster supplies in bulk
across an entire large corporation, can save money and time.

Contingency planning processes should be included in the organization's
overall strategic plan and in its annual operating plans (AOP). For
example, an entity may have the corporate strategic goal of developing
and training employees. The strategic *contingency* goal may be to teach
employees about preparedness. In the first year of the contingency AOP,
an announced evacuation drill may be a goal. The second year contingency
AOP might include the goal of providing low-cost emergency supplies to
employees. Emergency management document reviews and business continuity
plan updates also should be part of the AOP, as well as regular training
exercises and annual audits.

[Conclusion]{.underline}

Strategic contingency planning for local governments is especially
needed as there is a tendency to rely on State and Federal governments
to cover losses. It is becoming more difficult to get disaster funds due
to stricter accounting and record keeping requirements. If a city
prepares itself, and its citizens, for disaster, it will recover more
quickly, and losses will be less. Incorporating contingency planning
ideas such as prevention and mitigation into daily practice may help
prevent loss of life and property. For example, city planners with a
greater understanding of hazards may not allow a housing development to
be built in a flood plain, or they will require better building
materials to be used in storm areas. FEMA (2000) stated:

> Local governments have a variety of techniques available to influence
> the location, type, intensity, design, quality, and timing of
> development. Many of these tools can be used to mitigate natural
> hazards and enhance your community's resilience and ability to recover
> from hazards. How well your community integrates mitigation objectives
> with community growth and development, and balances competing
> priorities, will determine the extent to which your community has a
> sustainable future. (p. 16)

A variety of business tools such as strategic planning and metrics can
be adapted to help mature the contingency planning profession.
Contingency planning processes are of strategic importance and, as such,
need to fit into the organizational structure more coherently.
Organizations are facing greater challenges in an increasingly
interconnected world, and contingency planning can help ensure the
entity's operations continue. It is time for contingency planning to be
an active part of an organization's overall strategic planning process.
The organization will be better prepared for future disasters and
crises.

[Summary]{.underline}

In this chapter, recommendations and a conclusion were presented. The
objective of this study was to develop and present a strategic
contingency planning model to help integrate emergency management and
business continuity more fully into normal business processes. This
objective has been achieved through a comprehensive review of
literature, examination of methodologies and development of a new model
that builds upon existing structures as well as incorporating fresh
ideas.

APPENDICES

APPENDIX A

SAMPLE FUTURE SCENARIOS

APPENDIX A

SAMPLE FUTURE SCENARIOS

If a two-axis matrix is used, there will be four possible combinations
to start building scenarios from. For this example, the question to be
examined will be: "What will happen to our city if a major earthquake
(8.5 or higher) hits in ten years?" Out of the many factors that can be
considered, two important uncertainties are chosen: public/private
attitudes towards emergency preparedness, and the economy. The Y-axis
might be labeled "Why Bother?" on one end and "Be Prepared" on the
other. The X-axis could be labeled "Deep Recession" on one end and
"Prosperity" on the other.

  --------------------------------- -------------------------------------
  Deep Recession                    Be Prepared

  Why Bother?                       Prosperity
  --------------------------------- -------------------------------------

From this matrix, then, is the basis to generate and name four basic
scenarios:

1.  Deep Recession-Be Prepared "*We Will Survive*"

2.  Deep Recession-Why Bother? "*Double Trouble*"

3.  Prosperity-Be Prepared "*Quick Recovery*"

4.  Prosperity-Why Bother? "*The Calvary is Coming!*"

To add complexity, additional axes could be added to the above matrix,
allowing many more scenario choices such as "Isolated/Widespread" to
indicate the scope of disaster. Another would be "Many/None" as a scale
of previous disasters in a certain time frame that would affect funds
and resources available. Or continuums based on the nearness of a city
to the epicenter of a quake, whether a tsunami was generated or not, how
many aftershocks might occur, population density, etc. Based upon the
four scenarios listed, projecting to 2016, the following are examples of
what some simple scenarios might look like.

1.  Deep Recession-Be Prepared "*We Will Survive*"

> Wars on terrorism linger, exacerbated by an attack on Disneyland in
> the summer of 2007 and the Sears Tower in 2009. (The destruction of
> the "HOLLYWOOD" sign in 2006 was thought to be a terrorist incident,
> but never proven.) The economy, both nationally and globally, was
> still in a slump. Exports were down. Terrorist activities in other
> parts of the world were keeping U.S. corporations from investing in
> foreign plants and facilities and our borders were mostly closed to
> immigrants. People in the United States were afraid, and many groups
> had sprung up to teach survival skills to citizens. A few of these
> groups were militia based. A large percentage of the groups, however,
> based their programs on ones developed by the American League for
> Emergency Response and Training \[ALERT\], which encouraged people to
> be prepared for anything, and keep America strong. Though many cities
> could not afford to fully staff their emergency service operations,
> volunteer police and firefighters helped keep things running. The
> California Worker's Program used laid-off personnel to retrofit and
> shore up infrastructure where it could. Because there was so much
> unemployment, homeowners took in boarders to make ends meet. With many
> people living in a house, it was natural for internal systems to
> spring up to ensure things ran smoothly and resources were shared.
> Practicing emergency response became part of that system to ensure
> everyone was safe and accounted for. Many people used Microsoft's
> *Home Preparedness 2008* software to help track supplies, contacts,
> and family members. *Your Business Preparedness, edition 2kx*, had
> been out since 2006, and came standard on Dell computers.
>
> The earthquake registered 8.5 on the Richter scale and hit the City of
> Los Angeles at 8:00 a.m. Mutual Aid was very limited, the National
> Guard stretched, but some Federal troops responded within a few days
> to assist in the recovery effort. Resources were scarce and secondary
> fires could not be fully contained. Most of those who lost their lives
> were homeless people living in unsafe buildings. The city would be
> long in recovering.

2.  Deep Recession-Why Bother? "*Double Trouble*"

> The United States is still in a war on terrorism. This war has dragged
> on and off for almost 15 years as new "evildoers" are identified.
> Nuclear threats from foreign countries surfaced from time to time.
> Homeland Defense created a big brother mentality where citizens spy on
> each other and technology has provided the means for the government to
> track individuals constantly. The economy is barely moving;
> unemployment, poverty, crime, and homelessness continue to rise.
> Another corporate accounting scandal headlines the news. FEMA's
> educational, consulting, and mitigation programs were long ago
> discontinued. Many regional disasters in the past few years have
> strained the already limited resources and funds of the Federal
> Government, volunteer groups and private citizens. Local governments
> are realistically on their own to recover from disaster. But since
> local government resources and funds are also in short supply, citizen
> and business emergency planning education has not been done, and the
> populations are poorly prepared. Highly experienced public safety
> personnel (fire, police, and EMT) have long since retired and there
> are not enough (nor properly trained) personnel to replace them.
> Erosion is widespread due to the rains from global warming.
>
> An 8.5 earthquake hits the City of Los Angeles at 8:00 a.m. Despite
> the exorbitant price of oil, the freeways are still crowded since
> public transportation options have drastically decreased. Poorly
> maintained trucks filled with hazardous materials overturn and explode
> or leak. Schools are in chaos since their programs have not been
> maintained. Dams break and landslides are triggered. Casualties and
> injuries are high. Several powerful aftershocks hit. Terrorists use
> this opportunity to attack the United States several times in the days
> following the big earthquake.

3.  Prosperity-Be Prepared "*Quick Recovery*"

> The Department of Homeland Security continued to house FEMA. Due to
> strong support from the country, FEMA was expanded and empowered with
> programs to educate and prepare all sections of the country for
> possible disruptions, whether from terrorists or natural or other
> disasters. Nearly every city has active Community Emergency Response
> Teams \[CERT\] programs, and schools regularly drill the students.
> Indeed, forms of first aid, CPR, and other emergency response
> activities are required curriculum in all grades. Technology for the
> emergency field has dramatically improved and its benefits were shown
> after the killer Hurricane Martha struck Florida in 2010. Many
> citizens affected by that disaster had previously, and voluntarily,
> had GPS/data chips implanted in their shoulders, enabling tracking
> devices and thermal imaging scans to locate them in the rubble. Robots
> were used successfully to move debris and free victims. Florida had
> also been stricter in determining what could be built in areas
> typically hardest hit and engineers had come up with new designs for
> hurricane resistant homes. Some land areas had been returned to
> wetlands. Since the economy had been very strong and stable for
> several years, more funding was available to train emergency service
> personnel and keep them equipped with the latest communication and
> rescue devices. Interoperability issues between public safety services
> were no longer a problem. Community members were invited to
> participate in full-scale exercises put on by the cities and counties.
> Businesses owners worked closely with continuity and city planners so
> that they would be able to protect their employees and customers and
> survive after a disaster. Extra consideration was given to special
> needs populations to ensure their safety. Throughout the country,
> prevention, mitigation, and preparedness were practiced, not just
> preached. Even basic services were more protected, thanks to
> technology.
>
> When the 8.5 earthquake struck the City of Los Angeles at 8:00 a.m.
> that morning, the people were ready. Loss of life and property were
> minimal. Former Governor Arnold Schwarzenegger, an outspoken advocate
> of preparedness, vowed that Los Angeles would very quickly "be back!"

4.  Prosperity-Why Bother? "*The Calvary is Coming!*"

The war on terrorism ended in 2007, and the national and global
economies are going well. Communications have improved between the
United States and the Middle Eastern countries, and countries all over
the world have joined the efforts to discourage terrorism. The Federal
budget deficit has been shrinking, due to several years of prosperity.
Oil prices are stable because Norway, Russia, Mexico, and Canada have
become major players. Alternate energy sources are also becoming
practical and cost-effective to use. Some manufacturing and outsourcing
has been moved back to the U.S. from foreign soil as a precaution
against future terrorist actions. FEMA continues to function as it did
in 2006. Many local cities have become complacent, due to few natural or
other disasters in the last 8 years. There is still some shortage of
emergency service personnel due to retirements. Since things have been
fairly quiet in the world, few are paying much attention to business or
personal preparedness.

At 8:00 a.m., the 8.5 earthquake hits the City of Los Angeles. Some old
sections of freeways collapse. Buildings and homes are damaged and many
people hurt. Government buildings are destroyed and public records are
lost. Recovery is possible only with the help of many outside agencies
and volunteers. The President declares a state of emergency and federal
funds are released. Movie stars are photographed helping out at Red
Cross shelters and local hospitals. Telethons seem to go on non-stop as
religious and entertainment leaders sob for money on television.
Donations pour in from all over the world. California's economy is
strained.

APPENDIX B

SAMPLE STRATEGIC EMERGENCY AND CRISIS MANAGEMENT PLAN

APPENDIX B

SAMPLE STRATEGIC EMERGENCY AND CRISIS MANAGEMENT PLAN

Vision: To achieve emergency and crisis management excellence in support
of our Company's vision, values and key behaviors by ensuring
fundamental systems are in place across the Company.

Mission: We will establish a collaborative emergency and crisis
management environment within the Company by sharing knowledge and
developing personnel. We will elevate the standards of protection for
people, assets and property.

Title: *Emergency and Crisis Management Strategic Plan*

Purpose: This business case examines the costs and benefits to the
company resulting from increased employee preparedness, strengthened
processes and systems and centralized knowledge throughout the
organization.

Summary: The Process Team reviewed the existing emergency and crisis
management system in the organization and researched external standards.
A list of gaps has been identified and prioritized based on life safety
issues. Our recommendation is that the organization fund an on-going
emergency and crisis management program aimed at bringing our planning
levels up to, or better than, industry standards. The annual commitment
requested is \$500,000.00.

Methods: The Process Team performed a baseline assessment to measure
performance at all sites. Additionally, a hazard assessment, business
impact analysis and risk analysis were completed by emergency managers,
business continuity personnel, and the risk management organization.
These documents were cross-referenced to ensure that all systems and
processes in the company were accounted for. The Team also
cross-referenced the documents to the NFPA 1600 standard and other
external standards. Future scenarios were developed to determine where
additional gaps might be.

Impacts: Many of the identified gaps directly impact personnel. If the
project is not funded, there is a greater chance that employees or
visitors may suffer injuries or death if a crisis occurs. The site does
not have regular evacuation drills or consistent training materials to
help employees prepare for a disaster at work or home. Our first
responders have not been trained in search and rescue and do not have
personal protective gear for hazardous materials calls. The Company's
sites contain numerous chemicals and responder lives can be jeopardized.
Planners are isolated and not sharing knowledge. This situation leaves
the Company vulnerable if a planner should leave or be unable to work.
Also, in the event of a major disaster, emergency planner mutual aid
will invaluable.

The Team also examined the City's hazards, response capabilities and
infrastructure to determine if there were additional issues that might
affect our Company. The Team found that aging infrastructure, including
weak water pressure in hydrants, is of major concern. Based on various
scenarios, the Company could be heavily impacted by the City's
weaknesses. This warrants further review to determine options.

Benefits: Implementing this program will enhance our emergency and
crisis management program as we show our employees how valuable they are
to us. As part of this program, we will increase employee awareness of
potential disasters and help them be more prepared, both at home and at
work. Another benefit is to our customers. They can be more assured that
we will do everything so that we can provide them the best possible
service and support. This program will also provide a competitive
advantage as none of our competitors currently are planning at the
levels we are.

Implementation: In the following section, the strategic plan has been
detailed. Each gap is identified and an action plan for it developed. A
timeline has been created, a point of contact chosen, and an estimated
cost developed for each gap.

Metrics: The proposed program will cost \$500,000 per year or less than
\$11.00 per month per employee. Phase 1 will be completed in two months,
Phase 2 will be completed in 3 months, and Phase 3 will be completed in
7 months. Action plans and budgets will be developed to track all
progress.

Conclusion: The Process Team recommends that the emergency and crisis
management program be funded and supported by top level management as
the safety of our personnel and assets is vital to operational
resiliency.

*Goals:*

-   Increase employee preparedness by providing disaster information and
    holding regular evacuation drills each year.

-   Strengthen processes and responder systems within 6 months.

-   Develop a centralized knowledge base within 12 months.

*Objective 1:* Prepare coordinated employee educational campaigns

> *Strategy 1.1:* Develop overall theme and message
>
> *Tactic 1.1.1:* Prepare and disburse materials
>
> *Tactic 1.1.2:* Consolidate and update web information
>
> *Tactic 1.1.3:* ...
>
> *Strategy 1.2:* Establish annual training goals
>
> *Tactic 1.2.1:* Develop training programs
>
> *Tactic 1*.*2.2:* Establish employee reimbursement program
>
> *Tactic 1.2.3:* Schedule regular evacuation drills
>
> *Tactic 1.2.4:* ...

*Objective 2:* Improve crisis management and emergency response
processes

> *Strategy 2.1:* Develop standards and best practices
>
> *Tactic 2.1.1:* Review gaps at all sites
>
> *Tactic 2.1.2:* Review and streamline all documents
>
> *Tactic 2.1.3:* ...
>
> *Strategy 2.2:* Upgrade first responder equipment
>
> *Tactic 2.2.1:* Determine equipment needed
>
> *Tactic 2.2.2:* Train responders
>
> *Tactic 2.2.3:* ...

*Objective 3:* Codify knowledge across site

> *Strategy 3.1:* Build a network of subject matter experts
>
> *Tactic 3.1.1:* Set up a database
>
> *Action Plan 3.1.1.1:* Determine database format
>
> *Action Plan 3.1.1.2:* Create database
>
> *Action Plan 3.1.1.3:* Test database
>
> *Action Plan 3.1.1.4:* Create reports
>
> *Tactic 3.1.2:* Document planners
>
> *Action Plan 3.1.2.1:* Develop a list of emergency planners
>
> *Action Plan 3.1.2.2:* Interview planners
>
> *Action Plan 3.1.2.3:* Enter skills into database
>
> *Action Plan 3.1.2.4:* Print reports and analyze data
>
> *Action Plan 3.1.2.5:* Initiate cross-company training via telecon and
> net meeting

  --------------- --------- --------- ----------- ----------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- -------
  **Action**      **No.**   **POC**   **Hours**   **Cost**    **J**   **F**   **M**   **A**   **M**   **J**   **J**   **A**   **S**   **O**   **N**   **D**

  Develop a list  3.1.2.1   Sue       1.0         85.00       X                                                                                       
  of all company                                                                                                                                      
  planners                                                                                                                                            

  Interview       3.1.2.2   Joe, Sue  8.0         680.00      X       X                                                                               
  planners                                                                                                                                            

  Enter skills    3.1.2.3   Mary      5.0         425.00              X       X                                                                       
  into database                                                                                                                                       

  Print reports   3.1.2.4   All       20.0        1700.00                     X       X                                                               
  and analyze                                                                                                                                         
  data                                                                                                                                                

  Initiate        3.1.2.5   All       80.0        6800.00                             X       X       X       X       X       X       X       X       X
  cross-company                                                                                                                                       
  training                                                                                                                                            

  Total:                              114.0       \$9690.00                                                                                           
  --------------- --------- --------- ----------- ----------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- -------

APPENDIX C

SAMPLE BASELINE ASSESSMENT PAGE

APPENDIX C

SAMPLE BASELINE ASSESSMENT PAGE

  ------------- -------------- --------------------- --------- ------------ ----------- --------- ----
  Objectives:                                                  Element                             
                                                               Ranking:                           

  1\.                                                          1 = Not                            
  Prioritize                                                   important                          
  elements                                                                                        

  2\. Inventory                                                2 = Some                           
  each site                                                    importance                         
  using matrix                                                                                    

  3\. Identify                                                 3 =                                
  element gaps                                                 Important                          
  (items ranked                                                                                   
  3, 4, or 5)                                                                                     

  4\. Develop                                                  4 = Very                           
  plan and                                                     important                          
  budget to                                                                                       
  close gaps                                                                                      

                                                               5 = Most                           
                                                               important                          

  No.           Category       Element               Average   Site 1       Site 2      Green =   
                                                     Rank      Inventory    Inventory   Yes, in   
                                                                                        place     

  7.00          Emergency                                                               Red = Not 
                Preparedness                                                            in place  

  7.01          Emergency      Address               5         Yes          Yes         Grey = 1  
                Preparedness   disaster-related                                         or 2      
                               needs of disabled                                        ranking   
                               population                                                         

  7.02          Emergency      Emergency             3         Yes          Yes         Blue =    
                Preparedness   preparedness website                                     N/A       

  7.03          Emergency      Emergency power       5         Yes          Yes                   
                Preparedness                                                                      

  7.04          Emergency      Emergency information 5         Yes          Yes                   
                Preparedness   cards                                                              

  7.05          Emergency      Evacuation/assembly   5         Yes          Yes                   
                Preparedness   area maps                                                          

  7.06          Emergency      Employee preparedness 5         Yes          Yes                   
                Preparedness   events                                                             

  7.07          Emergency      Disaster supplies     5         Yes          Yes                   
                Preparedness                                                                      

  7.08          Emergency      Trained disaster      5         Yes          Yes                   
                Preparedness   response volunteers                                                

  8.00          Exercises and                                                                     
                Training                                                                          

  8.01          Exercises and  Exercise              5         Yes          Yes                   
                Training       documentation process                                              

  8.02          Exercises and  Exercise analysis     5         Yes          Yes                   
                Training       process                                                            

  8.03          Exercises and  Exercise planning     5         Yes          Yes                   
                Training       team                                                               
  ------------- -------------- --------------------- --------- ------------ ----------- --------- ----

APPENDIX D

SAMPLE RELATIONSHIP DIAGRAM

APPENDIX D

SAMPLE RELATIONSHIP DIAGRAM

![](media/image1.wmf)

**Possible factors for use in scenarios:**

  ----------------------- ----------------------- -----------------------
  **Workforce**           Hard hit                Light hit

  **Cash Reserves**       Strong                  Weak

  **Products**            Low demand              High demand

  **Economy**             Short recovery          Long recovery
  ----------------------- ----------------------- -----------------------

APPENDIX E

SAMPLE CONTINGENCY PLANNING SITUATION ASSESSMENT

APPENDIX E

SAMPLE CONTINGENCY PLANNING SITUATION ASSESSMENT

+-----------------------------------+-----------------------------------+
| -   Identify Customers            | -   Identify Influencers          |
|                                   |                                   |
|     -   Employees                 |     -   Federal laws such as OSHA |
|                                   |                                   |
|     -   Customers                 |     -   State laws                |
|                                   |                                   |
|     -   Partners                  |     -   Sarbanes-Oxley            |
|                                   |                                   |
|     -   Public sector             |     -   Basel II                  |
|                                   |                                   |
|                                   |     -   NFPA 1600 standard        |
+-----------------------------------+-----------------------------------+
| -   Identify Funding              | -   Identify Challenges           |
|                                   |                                   |
|     -   Contingency planning      |     -   Lack of qualified         |
|         annual budget             |         planners                  |
|                                   |                                   |
|     -   Percentage of revenue     |     -   Inconsistent management   |
|         allocation                |         support                   |
+-----------------------------------+-----------------------------------+

BIBLIOGRAPHY

BIBLIOGRAPHY

Alexander, D. (2002). *Principles of emergency management and planning*.
New York:

Oxford University Press.

Arringdale, D. (1997). *The strategic planning workbook*. Des Moines,
IA: Performance

Publishing.

Barnes, J.C. (2001). *A guide to business continuity planning*. West
Sussex, England:

John Wiley.

Bazerman, M. and Watkins, M. (2004). *Predicable surprises: the
disasters you should*

*have seen coming, and how to prevent them.* Boston: Harvard

Business School of Publishing.

Beck, E.A. (2005). *Strategic planning for business continuity
management.*

> Retrieved November 1, 2005 from the Disaster Resource web site:
>
> [http://www.disaster-]()resource.com/articles/05p-044.shtml

Bell, J. (2004-2005). The role of business continuity in strategic
planning.

*Disaster Resource Guide, 9^th^ Annual*, *38-40*.

Benford, G. (1999) *Deep time: how humanity communicates across
millennia*. New York: Avon Books.

Bennet, A. and Bennet, D. (2004). *Organizational survival in the new
world: a new*

*theory of the form*. New York: Butterworth-Heinemann.

Bobich, B. and Tait, A. (2005). *Focusing BC/DR on shareholder
protection*.

> Retrieved November 1, 2005 from the Disaster Resource web site:
>
> <http://www.disaster-resource.com/articles/05p-038.shtml>

Bradford, R. and Duncan, J.P. (2000). *Simplified strategic planning*.
Worcester, MA:

Chandler House Press

California Courts. *Continuity of government (COG) and continuity of
operations*

> *(COOP): emergency planning guidance for a consolidated approach*.
> Retrieved August 21, 2005 from the California Courts web site:
> [http://www.courtinfo.ca.gov/reference/rfp/documents/\
> disasteratta.pdf#search=\'continuity%20of%20operations](http://www.courtinfo.ca.gov/reference/rfp/documents/disasteratta.pdf#search='continuity of operations)\'

California Emergency Services Act (n.d.). A*rticle 15, section
8635-8644,*

*continuity of government*. Retrieved July 11, 2003 from the California

> Governors Office of Emergency Services web site:
> [http://www.leginfo.ca.gov/\
> cgi-bin/displaycode?section=gov&group=08001-09000&file=8635-8644](http://www.leginfo.ca.gov/%0Bcgi-bin/displaycode?section=gov&group=08001-09000&file=8635-8644)

California Governors Office of Emergency Management (n.d.). *Emergency
management*

> *into the 21^st^ century: the strategic vision*. Retrieved August 6,
> 2006 from California Governors Office of Emergency Services web site:
> [http://www.oes.ca.gov/Operational/OESHome.nsf/Content/\
> 63427B6DEC770E6D88256C2A00626DA5?OpenDocument](http://www.oes.ca.gov/Operational/OESHome.nsf/Content/63427B6DEC770E6D88256C2A00626DA5?OpenDocument)

California Governors Office of Emergency Management (1999). *Emergency
planning*

*guide for local government, volume 1.* Retrieved August 6, 2006 from
California

> Governors Office of Emergency Services web site:
> [http://www.oes.ca.gov/Operational/OESHome.nsf/Content/\
> E539B39F0396DBFC88256C2A00628101?OpenDocument](http://www.oes.ca.gov/Operational/OESHome.nsf/Content/E539B39F0396DBFC88256C2A00628101?OpenDocument)

Casavant, D.A. (2003). *Emergency preparedness for facilities: a guide
to safety*

*planning and business continuity*. Rockville, MD: Government
Institutes.

Copenhaver, J. (2004, June). Excerpts from John Copenhavers' keynote

presentation to the American Industrial Hygienists Association annual

convention, May 11, 2004. *DRI International Quarterly Newsletter, 2-4.*

Cornish, E. (2004). *Futuring: the exploration of the future*. Bethesda,
MD: World Future

Society.

Cox, J. (2005). *Executive summary -- the business case for
enterprise-wide contingency*

> *planning.* Retrieved November 1, 2005 from the Disaster Resource web
> site:
> <http://www.disaster-resource.com/articles/bus-case-enterprise-cox.shtml>

Davis, S. (2003). Developing continuity in government planning.
*Disaster Recovery*

*Journal,* *16(2)*, *16-20*.

De Kluyver, C. A. and Pearce, J. A. II. (2003). *Strategy: a view from
the top*. Upper

Saddle River, NJ: Prentice Hall.

Department of Homeland Security. (2004). *National response plan*.
Retrieved August

> 13, 2006 from the Department of Homeland Security website at:
> http://www.dhs.gov/dhspublic/interapp/editorial/editorial_0566.xml

Depew, P. and Brown, F. (2005). Keeping production lines running.
*Continuity Insights,*

*3(1),* *32-37*.

DRJ Editorial Advisory Board. (N.D.). *Glossary of terms.* Retrieved
October 25, 2005

> from the DRI, International web site: http://www.drii.org/\
> displaycommon.cfm?am=3

Duffy, P. (2003). Defense of the corporate realm. *Continuity Insights,
1(1), 57-58.*

FEMA. (2000) Publication 364: *Planning for a sustainable future: the
link between*

*hazard mitigation and livability*.

FEMA. (2003) *IS 230 -- Principles of emergency management*. Retrieved

06/11/2005 from the Federal Emergency Management Agency web site:

<http://www.training.fema.gov/EMIWeb/IS/is230lst.asp>

Fuhr, R. (2005). Making the case for continuity. *Continuity Insights,
3(4),* *54-57.*

Gillis, T. K. (1996). *Emergency exercise handbook.* Tulsa, OK: PennWell
Publishing.

Goodstein, L. D., Nolan, T.M., and Pfeiffer, J.W. (1993) *Applied
strategic planning: how*

*to develop a plan that really works*. New York: McGraw-Hill.

Haddow, G. and Bullock, J. (2003). *Introduction to emergency
management.* New York:

Butterworth Heinemann.

Hodgson, T & Tait, F. (1996). *Strategic thinking with scenarios.*
Retrieved June, 2002, from
<http://www.idongroup.com/assoc/stratscen1.html>

Jablonowski, M. (2005). Continuity planning dilemmas: fatalism versus
precaution.

*Continuity Insights, 3(4),* *44-47.*

Kaplan, L. (1996). *Emergency and disaster planning manual*. New York:
McGraw

Hill.

Kaufman, N. and King, J. (2003). The case for a chief continuity
officer. *Continuity*

*Insights, 1(4), 30-31.*

Kerzner, H. (2001). *Strategic planning for project management using a
project*

*management maturity model*. New York: John Wiley.

Kirby, J. P. and Hughes, D. (1997). *Thoughtware: change the thinking
and the*

*organization will change itself.* Portland, OR: Productivity Press.

Kirvan, P. (2003). Protecting your critical infrastructure. *Contingency
Planning &*

*Management,* *8(1)*, *52-54.*

Koehler, N. (2003). Getting beyond just an emergency response plan in
the public sector.

*Disaster Recovery Journal*, *16(1)*, *56-58.*

Laudicina, P. (2005). *World out of balance: navigating global risks to
seize competitive*

*advantage.* New York: McGraw-Hill.

Maluso, N. (n.d.a). *Business case tutorial series -- how to write an
effective*

> *business case, module 1: what is the business case?* Retrieved
> December 30, 2005 from the Prosci BPR Online Learning Center web site:
>
> <http://www.prosci.com/tutorial-business-case-mod1.htm>

Maluso, N. (n.d.b). *The business case: the essential elements.*

> Retrieved December 30, 2005 from the Prosci BPR Online Learning Center
> web site: <http://www.prosci.com/bus2.htm>

McCrackan, A. (2004). The unexpected benefits of good business
continuity.

Retrieved 12/10/2004 from the Continuity Central web site:

http://www.continuitycentral.com/feature0156.htm

Mileti, D. (1999). *Disasters by design: a reassessment of natural
hazards in the*

*United States*. Washington, DC: Joseph Henry Press.

Mitroff, I. (2004). *Crisis leadership: planning for the unthinkable*.
Hoboken, NJ:

John Wiley.

Mitroff, I. and Pauchant, T. (1990). *We're so big and powerful nothing
bad can happen*

*to us*. New York: Carol Publishing Group.

Mitroff, I., Pearson, C. M., and Harrington, L.K. (1996). *The essential
guide to*

*managing corporate crises: a step-by-step handbook for surviving major*

*catastrophes*. New York: Oxford University Press.

National Fire Protection Association \[NFPA\] (2004). *NFPA 1600
standard on*

> *disaster/emergency management and business continuity programs, 2004
> edition*. Quincy, MA: NFPA International

Neilson, R. and Stouffer, D. (2005). Narrating the vision: scenarios in
action. *The*

*Futurist, 39(3)*, *26-30.*

Neufeldt, V., Editor. (1994). *Webster's new world dictionary of
American English,*

*(3^rd^ college ed)*. New York: Prentice Hall

Ogilvy, J. (2002), *Creating better futures: scenario planning as a tool
for a better*

*tomorrow*. New York: Oxford University Press.

Pauchant, T and Mitroff, I. (1992). *Transforming the crisis-prone
organization:*

*preventing individual, organizational, and environmental tragedies*.
San

Francisco: Jossey-Bass Publishers.

Penz, A. (2003). Business continuity: the case for senior management
leadership.

*Continuity Insights, 1(2), 28-33.*

Policastro, M. (N.D.). *Introduction to strategic planning.* Ft. Worth,
TX: U.S. Small

Business Administration.

Rainey, K. (Editor). (2004-2005). State of the industry: top ten issues.
*Disaster*

*Resource Guide*, *14-24.*

Reiss, C.L. (2001). *Risk identification and analysis: a guide for small
public entities*.

Fairfax, VA: Public Entity Risk Institute.

Rothstein, P. J. (2003). *Pitching preparedness.* Retrieved October 25,
2004 from the

Rothstein Associates web site:
http://servicelevelbooks.com/articles/pitching.htm

Royal Dutch/Shell Group. (2002). *Exploring the future: people and
connections -- global*

> *scenarios to 2020, public summary*. Retrieved June 2, 2002 from the
> Shell website: http://shell.com/scenarios

Safranski, S. and Kwon, I. (1991). *Strategic planning for the growing
business.*

Ft. Worth, TX: U.S. Small Business Administration.

Salerno, C. (2003). Building disaster recovery from the top down.
*Continuity Insights,*

*1(4), 16-22.*

Schneider, R. O. (2004). An overview of the "new" emergency management.
*Journal of*

*Emergency Management, 2(1), 25-28*

Schwartz, P. (1996). *The art of the long view*. New York: Bantam
Doubleday Dell

Publishing Group.

SEMS Group LA (n.d.). *SEMS multi-hazard functional plan*. Los Angeles:
SEMS

Group LA.

Senge, P. (2004). *Prescence: human purpose and the field of the
future*. Cambridge, MA:

The Society for Organizational Learning, Inc.

Sikich, G. (2003). *Integrated business continuity: maintaining
resilience in uncertain*

*times*. Tulsa, OK: Pennwell Corp.

Sikich, G. (2004). *Making the case for business continuity*. Retrieved
11/05/2004 from

> the Continuity Central web site:
> <http://www.continuitycentral.com/feature0144.htm>

Sikich, G. (2004). *Integrating business continuity criteria into your
supply chain*.

Retrieved 10/26/2005 from the Continuity Central web site:

http://www.continuitycentral.com/feature0138.htm

Smith, D. (2003). BC culture shock. *Contingency Planning & Management,
8(2)*, *40-41.*

Stagl, J. (2003a). Business continuity begins with the customer.
*Continuity Insights, 1(1),*

*38-39.*

Stagl, J. (2003b). Identifying critical capabilities. *Continuity
Insights, 1(2), 40-41.*

Steiner, G.A. (1979). *Strategic planning: what every manager must
know*. New

York: Free Press Paperbacks.

Stringfield, W. H. (2000). *Emergency planning and management: ensuring
your*

*company's survival in the event of a disaster (2^nd^ ed)*. Rockville,
MD:

Government Institutes.

Tait, A. (2004). Prescription for a sustainable global BC/DR program.
*Continuity*

*Insights, 2(4),* *16-23.*

Thompson, P. (2003). What is the executive's role in a disaster?
*Continuity Insights, 1(1),*

27-28*.*

Toigo, J.W. (2000). *Disaster recovery planning: strategies for
protecting critical*

*information (2^nd^ ed)*. Upper Saddle River, NJ: Prentice Hall.

Van der Heijden, K. (1996). *Scenarios: the art of strategic
conversation*. Chichester,

West Sussex, England: John Wiley.

Van der Heijden, K. (1997). *Scenarios, strategies and the strategy
process.*

Retrieved July 30, 2006 from the Nyenrode Library web site:

<http://www.nijenrode.nl/library/publications/nrp/1997-01/1997-01.html>

Verardo, D. (1997). Managing the strategic planning process. *ASTD
Info-line, Issue*

*9710, 16 pp.*

Waddell, W. C. (1986). *The outline of strategy.* Oxford, OH: The
Planning Forum.

Wagar, W. (2001) *What now? Three futuribles.* Retrieved May 1, 2002,
from the World

Future Society website at: http://wfs.org/mmwagar.htm

Watson, S. (2004). How to steer your company to emergency preparedness
in nine steps.

*Continuity Insights, 2(2), 28-32.*

Wilkinson, L. (1994). *How to build scenarios.* Retrieved May 28, 2002,
from the Wired

Magazine website: http://www.wired.com/wired/scenarios/build.htm

Wooten, S. and Horne, T. (2001). *Strategic thinking: a step by step
approach to strategy*.

Sterling, VA: Kogan Page US.

World Future Society. (2004). The art of foresight: preparing for a
changing world.

*World Future Society, 38(3),* *31-37*

Wright, R. (1989). *Systems thinking: a guide to managing change in a
changing*

*environment*. Dearborn, MI: Society of Manufacturing Engineers.

Wycoff, J. and Richardson, T. (1995). *Transformation thinking*. New
York: Berkley

Books.