[Editor’s note: This case study comes to us courtesy of our colleague David J. Discenza, president of Discenza Business Continuity Solutions.]
The Situation:
A Fortune 100 financial services firm located in lower Manhattan, NY, requires each of its business units to run an annual table-top exercise of its business continuity plan. In the past, the Service Continuity organization would provide an exercise to each of the business units and schedule the exercise to run on certain date. This particular year, the Service Continuity organization left it up to the individual business units to create their own scenario and schedule the exercise.
I inherited a plan that had not been well maintained and was missing key elements. In addition to updating and improving the plan, I now had to create, run, and evaluate the table-top exercise.
The opportunity:
Past exercises had included civil unrest in a country where the firm has offices and a pandemic event in a US city where the firm has several offices. What had never been tested was the loss of the corporate headquarters building in lower Manhattan. The situation presented the opportunity to test that scenario.
Action:
What would cause this company to lose its headquarters? The scenario had to be realistic enough that the participants, the senior leadership of the business unit, would take the exercise seriously. I ruled out a terrorist attack. The company was located close to where the World Trade Center attack of 2001 occurred and did lose the use of its building for several months. This scenario needed to cover a shorter period.
Solution:
It had been decades since a hurricane had hit the New York City area. A hurricane hitting at the right time, high tide, and in the right location would funnel water up into New York Harbor and would flood lower Manhattan. Flooding the basement of the company’s building would cause a loss of power, telephones, and the heating and ventilation system since those controls were all located there.
Working with the property management firm and the New York City Office of Emergency Management, I developed a scenario in which a Category 2 hurricane struck New York City at a time coinciding with high tide. The eye of the hurricane would come ashore in New Jersey so that the strongest winds, those on the east side of the storm, would push a wall of water up New York Bay and into the harbor. All lower Manhattan would be flooded. The subway system and the PATH trains, which carried passengers under the Hudson River Between Manhattan and New Jersey, would be flooded. The conduits which carried the telephone and electrical cables in Manhattan would be flooded as well. We would lose our building for two weeks.
Result:
The exercise was scheduled and run with full participation of the leadership team. The exercise uncovered several gaps in our plan. The task of identifying solutions to these gaps was assigned to various members of the team with specific target dates for completion. At the end of the exercise, one of the Senior Vice Presidents chided me for “going over the top” with the scenario. I didn’t argue with him but I did say that this sort of thing could happen and it was best to be prepared.
Fifteen months later Superstorm Sandy happened. Although Sandy had been downgraded from a hurricane by the time it made landfall, the damage done eclipsed what had been imagined in the scenario. Lower Manhattan did flood, causing the loss of our building for nearly two months. While the subways came back on line faster than even the subway authority thought would happen, the PATH system did not, and a large segment of our employee population lived in New Jersey. The electrical grid suffered tremendous losses and many of our employees were without heat, power, and internet.
Because we had practiced this scenario, our business unit activated the business continuity plan ahead of the storm’s arrival. Employees were sent home with their laptops and told to expect to work from home for the foreseeable future. Work was reassigned to offices around the world. The result? Our business unit didn’t miss a beat, continuing to operate normally through the period when our headquarters was unavailable. Superstorm Sandy proved why it’s important to exercise plans: to be certain that the team knows how to invoke the plan, to make certain the plan works, and to find and fix any gaps.
Written by David Discenza, CBCP
President
Discenza Business Continuity Solutions
www.discenzabcs.com