As the former head of the Metropolitan Police’s Counter-Terrorism unit, dealing with contingency plans for the worst of worse case scenarios was a daily part of my job. This involved everything from internal police procedure in the aftermath of every conceivable kind of attack, to liaising with businesses about what they could do internally. One of the most common questions I was asked, quite simply was “what can or should we do to keep my business safe?”
A simple question with a dizzying number of answers depending on industry, location, number of employees, existing crisis management scenarios and more. But what can we boil all of these down to? What are the general themes and policies businesses can follow to keep employees safe?
Most of us, counter-terror professionals or otherwise, are familiar with concepts like business continuity plans – Contingencies designed to keep the cogs moving even in the event of complete chaos, but beyond this there’s a more human element, how upper management and the board can fulfil their duty of care to their own employees to ensure they’ve done everything possible to keep them safe in the event of such attacks.
What follows are my own six simple steps any company, large or small, can use as a general guideline to help ensure they’ve done what they can to keep their own employees safe.
This isn’t the sum total of all incident preparedness. This list also assumes you have a good, dependable mass notification system with multiple redundancies in terms of messaging your employees (SMS, E-Mail etc.)
INFORM and ALERT
Probably the most important element is to inform staff and alert them of any impending dangers via some sort of one-way communication channel with multiple-redundancies. This direct communication helps to minimize the sort of rumor-filled misinformation that naturally arises as a result of terror incidents and more importantly, to reassure your employees that the company is indeed aware of current events is monitoring them closely.
CHECK STATUS
This is where the concept of upper management’s duty of care really comes to the fore. Ensure that you have some sort of system that employs a two-way communication channel running alongside the one-way channel mentioned above.
This allows you to ping out a request for a response across multiple messaging methods with a simple question like “are you currently at the muster point?” or “are you safe?” Mass notification and response systems that afford this sort of functionality are invaluable and mean you don’t have to deal with more chaotic response plans that tend to involve individually locating each person at a muster point (note that the muster point approach to crisis management is fraught with its own dangers in this modern age of terrorism regardless).
This also gives the incident manager a clear view of who is safe and who potentially isn’t.
LOCATE NON-RESPONDERS
After the incident manager has issued a call for status response, the most important task is the identification of who hasn’t responded and why.
Most modern mass notification systems allow you to sort responders by their status, which then allows the incident manager contact each one, or each one’s point of contact (for example, their spouse). This appraisal of the status of non-responders is important as it allows the incident manager to tick off people who have been listed as at-risk but who are, say, working from home instead.
In essence, this whole process is designed to prioritize those who may be at most risk.
INSTRUCT & REASSURE
One thing you learn quickly while working in the anti-terror sector of law enforcement is that the panic that will undoubtedly set in must be accounted for in contingency planning. It is human nature, especially in our uncertain climate, to fear for one’s safety when one knows there is an unfolding terror attack taking place nearby.
As a result, the incident manager’s role should not be to broadcast for the sake of alerting and accounting for. He or she should also be prepared to reassure staff that the situation is being dealt with as quickly as is possible and that the best response from staff is to remain calm and listen to his or her alerts and updates.
KEEP INFORMATION FLOWING & ASSIST WHERE POSSIBLE
This is more of a supplementary point to the above, but it’s important enough to deserve its own sub-title.
Misinformation as already stated naturally arises as a result of any terror incident, but it becomes more damaging when the institutions people usually look to for advice and answers are silent. The city of Munich’s recent use of mass notification technology to keep city residents advised of news and information on their search for the gunman meant dubious reports on twitter weren’t allowed to carry as much currency.
The same rules apply to a business’ incident manager, especially if the business is at the forefront of an attack: Namely to keep information flowing to the staff as soon as he or she receives it, and not to be playing catch-up to someone else’s account of what is actually transpiring.
