Weaving Weather Into Your Business Continuity Program

While business continuity managers are working on their “2020 bingo card” of risks – a pandemic, increasing global unrest, stuttered supply chain, etc. – it’s important to not forget about the ever-prevalent threat of severe weather. Surely tornadoes, hurricanes, and so on are in the back of a manager’s mind, and surely there is some mention of them in your company’s business continuity plan, or BCP. However, while they may exist in your BCP, they may not be woven into your program. As human-caused climate change continues to influence our weather patterns, severe weather events are becoming more frequent and more impactful.

• According to NOAA’s National Centers for Environmental Information (an excellent resource for more information), the total cost of weather and climate disaster events in the U.S. from 2017-2019 exceeded $460 billion – averaging $153.3 billion a year.
• In 2019, there were 14 disasters that cost at least $1 billion. As of July 8^th, 2020, there have been 10 weather/climate disasters in the U.S. with losses of $1 billion.
• While the annual average for 1980-2019 is 6.6 events costing $1 billion (CPI-adjusted), the annual average for 2015-2019 is 13.8 events (CPI-adjusted).

Severe weather events are no longer a risk that can just be addressed in a BCP − they should be directly considered with regards to essential business operations, supply chain operations, key processes, and more. Severe weather events need to be scoped for their impact and duration. Here are a few excellent examples:

• It’s currently typhoon season in the eastern Pacific Ocean. If you have a supply chain vendor in Qingdao, China and Yantai, China, a single Super Typhoon in the Yellow Sea could shut both of the plants down (at best) temporarily. If all the metal fillings you use for a machine part come from those factories, you can no longer produce that part. Do you have other vendors lined up in case of an emergency? What other processes or products will be impacted by the loss of that one part or metal fillings? Are your supply chain vendors resilient themselves? Have they prepared for the risk of a Super Typhoon?
• Wildfire season has begun across most of the United States. If you have a satellite office in Redding, CA, a wildfire in the nearby mountains (similar to the Carr Fire of 2018) could threaten not only the office, but your employees’ homes and lives as well. Is there a plan in place for offloading duties and operations to another office in case employees have to evacuate en masse? How will your organization support them for the duration of the disaster? How can your organization become more resilient to the growing threat of wildfires?
• Severe winter weather tends to peak in the Midwest around January/February. If the National Weather Service is calling for a strong winter storm to roll in around 3 p.m., do you let your employees go home early to avoid the bad weather? Do you not call them in at all and have them telecommunicate safely from home? If the office/city/employees are snowed in for several days, is there an infrastructure in place for short-term telecommunications? How will business operations be impacted? Can key processes be moved to another, unimpacted location in the meantime?

Now, you don’t have to scrap your tried-and-true plans and responses (if you have them) in your BCP. Rather, it’s paramount to invest time into reviewing and analyzing how severe weather disasters are woven into your program. Some best practices to consider may be:

• If you have remote employees, encourage them to monitor their area for severe weather. If a remote employee is experiencing severe weather, make sure to check up on them. Is their power out? Do they need assistance? Do they need to step away from the computer in order to seek shelter?
• Performing a risk assessment for each weather threat for every one of your organization’s sites. Focus on major threats first (like wildfires in California) or group like sites (say, Chicago and Milwaukee); both of these options make excellent building blocks for further improvement and discussion.
• Conduct business impact analysis refreshes to understand essential business functions and processes that should be addressed first during a disaster.
• Plan tabletops and other exercise simulations to run through weather disaster plans, discover gaps in response, and determine how to improve for next time.

As severe weather events increase in impact and frequency, and organizations face increased vulnerability and risk, it’s important to weave these disasters into your incident management plan. It’s a long road, and the process won’t just happen overnight, but it needs to happen. Be prepared. Be observant. Start today.