In a world where unexpected disruptions can strike a company at any time, the importance of emergency preparedness has never been more apparent. Disruptions such as natural disasters, cyberattacks, or third-party failures are unpredictable events that impact both American and international companies, and those companies must be ready to respond quickly and effectively. But the question remains, how prepared are organizations? And are there differences between the ways in which American companies prepare for crises compared to international organizations?
Fusion Risk Management surveyed 1,000 employees of organizations across the globe to see how companies are preparing for disruptions, where they may be falling short, and what this means for the future of risk management, business continuity, and operational resilience.
Emergency Preparedness
Most employees believe their companies are prepared to handle disruptions, but there is always room for improvement, especially as technology advances and the number of crises increases. Among American employees, 28% believe their companies are not prepared, and about 1 in 4 international employees agree.
One area in which companies may improve upon is establishing a written emergency preparedness plan. While 76% of American employees reported that their organization has a written emergency preparedness plan, 24% said they do not. Globally, more employees (82%) said their companies are prepared with a written plan; however, 18% of global workers report their company has no plan. Having no plan in place means that you will be caught off guard by the next disruption, and your employees and operations will be likely be impacted, so having no plan is no longer an option.
When asked about the biggest threats their companies face, survey respondents nationally and internationally agreed that cyber threats and attacks are the most significant concern, followed by natural disasters and massive tech failures.
Are companies prepared to face these types of threats? Although it’s clear organizations are aware of the risks posed by both natural and human-caused events, it’s vital to take the necessary steps to prepare, such as by having written emergency preparedness plans and implementing business continuity and operational resilience programs.
In America, most organizations have written plans to address natural disasters (83%), cyber threats and attacks (65%), and active shooters (62%). International companies also have written plans for cyber attacks (68%) and natural disasters (62%), but the third most popular type of written plan is for a potential tech failure (50%).
While these statistics demonstrate progress, they also reveal that some companies may be neglecting crucial areas of preparedness. Organizations must continuously assess their vulnerabilities and gaps in preparedness to ensure their written plans cover all potential risks.
Emergency Training for Employees
An emergency preparedness plan is only as good as its ability to evolve with emerging threats. Yet, many companies struggle to regularly update their plans. In the U.S., 53% of organizations update their emergency preparedness plans annually, while only 9% do so twice a year. Alarmingly, 28% of companies aren’t testing or updating their plans regularly at all. With the number of disruptions that we’ve experienced these past years, testing and exercising should be a main priority for continuity and resilience teams.
Internationally, there’s a slightly better record, with 49% of organizations updating their plans annually and 19% doing so twice a year. Nearly 1 in 5 international employees state their companies do not regularly test or update their plans. While this number is lower than in the U.S., it still goes to show that globally, organizations must begin testing and exercising their plans more regularly in order to truly be prepared for anything.
In addition to having a written emergency preparedness plan, employees need to be well-trained for potential emergencies. Yet, there are discrepancies globally in the training offered. Only 59% of U.S. employees have participated in an emergency drill or simulation, while internationally, 71% have had this experience.
The most common drills or simulations national and international employees have experienced were those for natural disasters (67% for American companies and 47% for international). In the U.S., 43% of employees have undergone an active shooter drill, and 28% have practiced in case of a cyber threat or attack. Internationally, 37% have had drills for cyber threats and 24% have had drills in case of theft. Only 1 in 10 international employees report having had an active shooter drill or simulation. These low numbers highlight a significant gap in preparedness, hindering employee safety and operational continuity in the face of such an event.
One other troubling statistic is the lack of training some employees receive. More than 1 in 5 American employees said they receive no emergency preparedness training at all, compared to 15% of international employees. This gap in training not only puts employees at risk but can also expose organizations to greater vulnerability during crises.
The Convergence of Risk Management and Employee Experience
Disruptions aren’t something that rarely happens. Nearly half (48%) of American employees and 55% of international workers have weathered an emergency while at their current companies. So, what are companies doing to prepare for future crises?
When asked about their company’s “Achilles heel” in risk management, 29% of U.S. employees cited inadequate staff training, followed by insufficient communication channels during a crisis (26%), as some of the biggest challenges. Another 1 in 4 said there’s low awareness or buy-in from employees when considering risk management.
Internationally, the trends were similar, where 27% pointed to inadequate training and a lack of clear communication during a crisis. Additionally, 23% said another challenge their company faces is not having proper backup systems in place for critical operations.
In order to not be surprised by the next disruption, prioritizing risks has proven to be crucial in any preparedness strategy. In America, 56% of companies prioritize risks based on likelihood and impact, while 25% have no formal prioritization process. Internationally, 51% of companies also prioritize risks based on likelihood and impact, while only 14% have no formal prioritization process. Prioritizing your risks adequately ensures that your organization will be more prepared for whatever the future holds.
Another way companies may prioritize and manage risks is through a third party. However, more international organizations (70%) partner with external experts or consultants for risk management, while only 54% of American companies report doing so. Relying on external expertise could offer an advantage and different viewpoint, helping organizations navigate complex risk landscapes more effectively and ensure they aren’t overlooking significant threats.
Training and preparation can only take you so far when an emergency happens, and most employees internationally and nationally have experienced some sort of disruption. The most common types of emergencies employees have faced include natural disasters (44% in the U.S., 26% internationally) and cyber attacks or threats (29% in the U.S., 32% internationally).
One of the most recent disruptions that many companies faced globally was the CrowdStrike incident. According to survey respondents, 29% of American employees were affected by the outage while 23% of international employees were affected. Following the incident, of those American employees affected, 34% said their companies have since implemented a new preparedness plan, while internationally, 59% reported implementing new preparedness plans.
Emergency preparedness is no longer a “nice-to-have” but rather a critical aspect of business continuity and risk management. By investing in training, communication, and proper risk strategies, organizations can better protect themselves, their operations, and their employees from the challenges and threats they’ll face in the future.
Methodology
In August 2024, we surveyed 500 American and 500 international full-time employees of large private and public companies in various industries to understand how prepared their organizations are to handle emergencies or risks.
Respondents were 49% female, 49% male, and 2% non-binary with an age range of 18 to 73 and an average age of 36.
For media inquiries, contact media@digitalthirdcoast.net.
Fair Use
When using this data and research, please attribute by linking to this study and citing fusionrm.com.
Authors
