Yesterday, I shared some Golden Nuggets on the benefits of exercising your Crisis Teams and why we exercise. Today, I am going a little deeper on another major hidden and often overlooked benefit that exercises create.
Whether this is for Crisis Teams, Incident Management teams (or whatever you like to call your team), Business Continuity Teams, and especially Information Technology Disaster Recovery (ITDR) teams. Frequent, repeated exercises build confidence.
Confidence among the team(s) themselves, confidence in managers and executives of the business, and confidence from your customers and business partners. The most important place to build this confidence is among the teams that are doing the recovery work.
As you might expect, a lack of conducting exercises among your teams has the opposite effect. It can cause your team to break down and literally destroys their confidence, which also negatively impacts recovery times and overall recovery.
Let me provide some deeper insight by using an example from some previous work I did.
Several years ago, I was consulting for a major airline assisting some of the IT teams to develop Disaster Recovery Plans, getting them to move beyond tabletop walkthroughs and doing “functional” exercises, as well as documenting the exercise to get credit during an audit.
It is important for me to state here that this was a project based on an internal audit outcome. I was working with the bottom performers on remediation based on that audit. These were groups that either:
Had zero plans in place
Never conducted an ITDR exercise beyond a tabletop walkthrough
Conducted a functional exercise but didn’t document it properly and received no credit for doing the exercise
I want to talk about a particular group within that project that I worked with and why they never conducted anything more than a tabletop walkthrough, and why they lacked confidence and were afraid to even think of doing anything functional.
During my first meeting with this group, I specifically asked the simple question:
Why haven’t you done a functional failover exercise in the past?
The reply may come as a surprise to many of you but didn’t surprise me at all. The response they provided to me was that they weren’t allowed to do anything beyond a tabletop walkthrough.
My follow-up question to them was, who said that they were not allowed to conduct a functional exercise?
The Response: “The Business” (specifically operations).
After some discussion, I learned that the “business side” in the operations leadership felt that the systems and application were too critical to do a functional failover exercise while the application was running in production.
However, the systems and application weren’t deemed or signed off as an application that was too critical to for such an exercise. Yet, every time the team submitted a request to conduct a functional failover exercise operations would reject it and say it was too critical.
Normally, with a set of systems and or applications that the business deems too critical to complete these failover exercises they elevate them as such, and the business signs off on it as well as accepting the risk of not having these exercises done.
Not really the best decision as there are ways to do these exercises even while in production. But that is not the purpose of this story.
You see, this team not only lost confidence but felt a distrust in their capabilities from business leadership. So much so. that after working with them in both the development of a runbook and tabletop walkthrough that when I proposed having them submit permission to conduct a functional failover exercise, I was told, “there’s no point, they’ll never sign off on it.”
I told them, let me worry about that, you just pick a date and submit the request.
Behind the scenes, I was working with my engagement manager to either get the business to approve the request, or bump the criticality up to properly accept the risk, and sign off on it.
We got the approval.
Over the next 30 days, I worked with that team on their runbook to ensure that every step was in there and that they knew how to properly document and track the failover exercise, including backout procedures.
When the day of the exercise came, they performed wonderfully and did everything right.
They hit a glitch late into the exercise and couldn’t do a 100% successful failover. But did achieve the following:
They learned a lot. They ran into several issues during the exercise and were able to overcome them and move forward
They properly documented what they were doing. Conducting log capture, taking screenshots of before and after states, taking notes as they moved through the process for later use
Completed an after-action and discussed lessons learned, things that went wrong, and things that went well
All of this, even though the outcome wasn’t a successful failover during the exercise. They learned immensely during the exercise. They learned they could depend on one another to complete their assigned tasks. And the business learned they could trust the team to do the failover exercise, without disrupting the production environment.
The most important part. They were happy as a team and gained massive confidence in their own capabilities. This allowed them to continue to conduct exercises, gain further confidence and learn new skills.
In the end, a successful exercise isn’t always about a successful failover or other such success. In fact, you can learn a great deal when you fail. And when you learn and build the lessons into your plans, that is when the real success comes.
That, and the confidence you gain will boost you and your team during the next exercise or incident.
So. Get out there. Exercise and build confidence in yourself and your team.
The reasons why we exercise are often varied yet sometimes misunderstood by many. Below I will share some of the many reasons why we exercise and perhaps you’ll gain some insights into Why We Exercise.
Let me let you in on a little secret – A Golden Nugget – even the professionals make mistakes.
This is at all levels, in all industries, it even holds true in sports.
But what I am talking about specifically here are first responders and emergency managers. We all make mistakes.
Why am I telling you this? Perspective!
First Responders and Emergency Managers consistently drill, practice, and run exercises regularly. Yet they still make mistakes. They also have great outcomes, but they do make mistakes.
After each exercise, drill, or real incident they hold a debriefing. This is done whether it was a tabletop or a large-scale multi-agency functional exercise or a real incident.
The debriefing covers:
What went well
What went wrong
How can we do better
This worked great and we should implement it more
What did we learn – Lessons Learned
What are your takeaways
Let’s revisit and have a conversation on what we need to improve on
The reason why they exercise so often is because make mistakes. It’s also part of training and educating. Taking corrective action and using criticism and critique in a positive way. The repetition of doing assists both actual memory and muscle memory. Some actions also become habit. These habits can be both good and bad. It’s also an excellent way of highlighting bad habits so they are corrected.
When it comes to businesses, crisis teams don’t exercise nearly enough. Many will do this once, maybe twice per year. And if they do, that’s a lot.
But more than just frequency alone crisis teams in the business world need to also take a different approach and outlook. Every exercise should be looked at as an opportunity to learn, expand skillsets, stepping beyond comfort zones, and training for the future.
Additionally, every exercise does not need to be disruptive. It can be as simple as getting in a room, conference call, or zoom/teams/insert your other favorite video conference provider and having a discussion that asks:
What do we do when (insert event or impact)
How will we handle (insert event or impact)
Are we prepared for (insert event or impact)
Have we considered (insert event or impact)
In fact, this can be done far beyond crisis teams. Each of your departments and teams that hold regular team meetings or get-togethers can take 3, 5, 10, or even 15 minutes to discuss topics depending on what is on the regular agenda. This can be done every meeting, every-other meeting, or even quarterly.
You’ll see changes to your planning and preparedness levels. You might even see changes to your long-term culture. Trust me that’s a good thing.
Businesses face challenges in reopening after Coronavirus. Why? Well, there are several reasons, from temperature checks and whether to do them, even if you can. Sourcing cleaning supplies, added security, enforcing social distancing, and finding out employees don’t want to return to work yet.
Below we mention some of these issues and provide some recommendations on how to handle each situation to make your reopening a little bit smoother.
Employees May Not Want to Return to Work Yet
With every disaster or major disruption, there is also a psychological impact. This is particularly true when it comes to the Coronavirus. The biggest reason your employees might not be ready or even refuse to return to work is they may feel unsafe.
Another reason for this is many employers are discovering they have to compete with higher unemployment payments that may be greater than the employee’s actual earnings.
Yet, another often overlooked issue may be how employees get to and from work. Employees that don’t have transportation, may look to avoid public transportation and even carpooling to avoid contact with other people. This may cause them to refuse to return to work.
Recommendations on Employee Safety:
One of the first things you should do when you first begin to consider avoiding challenges in reopening after coronavirus is to set up a series of one-to-one calls with your employees and survey them about returning to work. Find out their concerns, fears, and doubts directly from them. Don’t just assume they will all want to return right away. Some employees may need some extra coaxing.
Another thing you can do to ease this transition is to have employees meet at the worksite to visually observe and experience the proactive steps you’re taking to ensure the safety of not only them but customers and others who may come to the worksite. Have them experience and participate in the cleaning and sanitization process. Let them see and experience social distancing policies. Have them help set up for social distancing by actively measuring out 6-foot distances.
Have them wear their face coverings before entering the worksite and experience what it is like to wear it continuously while working and discussing the proactive steps being taken to overcome the challenges in reopening after coronavirus. Then reassess their comfort level. Do they still have concerns? Can they be addressed further?
Recommendations on Employee Compensation:
You may have to consider offering increased compensation policies or even a one-time bonus incentive to encourage employees to return. If for instance, you implement all the safety measures you can, and many employees still refuse to return consider increasing the hourly pay rate or a one-time return to work bonus. We witnessed businesses that remained open and offered a $2 per/hour increase encouraged people to return and increased the number of new applications for employment
There are currently discussions taking place on having government subsidizing a return to work through incentives. For example –Idaho is paying people $1,500.00 to return to work. Many employers that remained open during the coronavirus increased pay and offered other compensation incentives should employees become ill or perhaps exposed, such as increased sick leave and pay during quarantine periods.
Whether other Local, State, and Federal governments end up providing some type of return to work incentive remains to be seen.
Recommendation on Employee Transportation:
If you have employees that utilize public transportation, they may be concerned about traveling to and from work. This may be a bigger concern than the safety of your worksite. Additionally, some employees that car-pooled in the past may no longer be willing to do so.
While some of your employees may refuse to utilize public transportation altogether during this time, one of the solutions you can implement to reduce challenges in reopening after coronavirus is to allow employees to take public transportation to travel during off-peak times. This will allow them to travel and share contact with fewer people and less crowded transportation. This may take some trial and error since many businesses may implement the same policies. Also, Public transportation may allow for fewer riders, and commute times may increase. Anticipate and allow for this.
You may want to consider informing carpoolers that are not domiciled together to take extra precautions. Such as wearing face coverings while traveling together. Suggest they take other precautions as well, like those the CDC recommends for Ridesharing, taxi, and limo service.
As a last resort, if cost-effective and feasible you may want to consider hiring your transportation for employees. You can either have them expense their transportation or hire a shuttle bus that allows for social distance spacing provide pickup and drop off service for employees.
Social Distancing May be Harder Than You Think
Included in social distancing mandates in some localities is a reduction in the number of people allowed into a worksite. This reduction doesn’t just include customers, it includes your employees as well.
Some businesses will have the added challenges in reopening after coronavirus by having to select which employees can return, and which do not. On top of that, will you be able to have enough staff on-site to handle any customers that need service? Too little, and customers will have to wait longer than what they may deem acceptable. Too many, and your costs increase, and profits decrease. For some businesses, this will be a continuous balancing act and for others, it will be a non-issue.
The next challenge you’ll encounter is if your worksite has enough space and flow for employees to be socially distanced and still be able to work effectively. You’ll also have to consider breakrooms, restrooms, hallways, and small spaces, and what about the reception area?
Recommendation on Social Distancing:
Make sure you have clear and concise signage that explains the social distancing policy at your entrances and displayed throughout your worksite.
Next, you’ll want to incorporate clear visuals and signage that shows 6-foot distancing clearly. You’ll also want to implement a nonpunitive and friendly reminder policy where all employees can remind others, including customers and guests of the social distancing policy.
Temperature Checks Are Not A Panacea
While this sounds like a great way to ensure employee safety, it includes its own set of challenges. Where will you source the preferred no-touch thermometers? Will you use and implement thermal cameras and where will you source them? Many scams are out there in sourcing for both – do your due diligence. Who will take employee temperatures? Other employees? Managers? Self-checks? Should you hire an outside vendor? What type of vendor? Will, you set up screens and barriers for the checkers? What about Personal Protective Equipment (PPE) and what kind? Will you record or not record temperatures? If you do you will have to comply with HIPAA, and how will you do that?
It doesn’t end there. What is your policy if someone has a temperature of 100.4°F? Sure, you won’t allow them access to the worksite, but then what? Do they need to self-quarantine? Do they need to go to a doctor? Get tested for COVID-19? How and when can they return? Also, they are now covered under the Americans with Disabilities Act (ADA). Once you send them off-premise, do you require contact tracing for those around that person? If so, how far back will you go?
Next, how will you go about getting the temperature? The CDC guidance calls for doing this before entering the facility or worksite to minimize exposure. This, however, has proven extremely difficult to implement and most employers that are implementing temperature screening are doing it just after the employees enter the facility. Outside increased temperatures of as little as 80°F and people traveling in hot cars have caused false positives. One client implemented utilizing a large swamp cooler outside the entrance to help reduce this. Another potential problem seen is people trying to reduce their temperatures with icepacks. How will you handle that?
Then we have compensation issues to worry about. Having employees waiting in line before the start of their shift or day can cause delays, lateness, and if required is considered part of work.
All of these issues combine to create immense challenges in reopening after coronavirus. Many businesses that start off planning to implement temperature screening tend to abandon it once they’re confronted with the challenges of implementing it.
Recommendations for Temperature Screening:
Now that you are aware of many of the challenges around temperature screening, the first step to take if you’re still considering this is to create a written plan on how you will meet these and other issues you encounter.
Once you address this through a written plan, conduct a walkthrough of the area where you will be doing the temperature screenings. Ensure that you will have enough space for the screener, any barriers you will use, and the person being screened. Next consider the time to check each person and how long it will take to check each employee, guest, and vendor entering the facility.
Next, we recommend hiring a vendor to do the actual temperature screening if possible. If you’re a small business and can’t afford to hire a vendor, utilize your employees to check other employees, or have them conduct self-checks.
Work out and talk through all the potential iterations of what will happen when an employee has a temperature of 100.4°F. Write these policies and procedures down, and do not deviate from them.
We highly recommend that you do not record temperature readings from any employee, whether normal, high, or below normal. Speaking of below normal. You’ll have to decide what to do when someone has a below normal temperature because it will happen.
If you deploy thermal cameras, we recommend people spend time training and getting used to them. There will be a learning curve as to where the camera picks up high temperatures and you may need to use a backup touchless check as well. From experience, thermal cameras work well and speed up the process overall but will also cause significant false positives when the outside temperatures climb. Some may require constant calibration as well as temperature changes occur in the surrounding environment.
Beware of Scams:
Always do your due diligence when researching vendors and products. We as well as clients have run into numerous scams and fake vendors while researching temperature screening solutions. Call clients listed on their sites and reach out to colleagues and see what they are using and where they obtained it. Also, never pay large upfront fees if you can avoid it.
Handling Visitors and Vendors
Another area that presents challenges in reopening after coronavirus is how to handle visitors, guests, and vendors. Early on, it was typical to prevent visitors of any kind from entering your facility. Today as we begin to reopen, visitors of some types are more expected. However, there are different types of visitors and you may want to handle each differently.
One type of visitor could be anyone that shows up unannounced. This could include family members of employees, job seekers, new vendors, or even local officials checking in on you.
Each situation might have to be handled differently, but you should have policies in place to prevent confusion.
Recommendations for Visitors of Employees:
We recommend people visiting your employees that are not doing business with you remain and wait outside your facility. This reduces both the number of people going into your facility and the need for testing or providing PPE to people who enter your worksite. Employees can meet with family, friends, and anyone else outside the worksite.
Recommendations for Job Seekers:
Place signage outside refusing admittance along with a number where they can seek assistance if necessary. Provide them with an online URL application completion process or your jobs/careers website address.
Recommendations for Vendors:
All vendors should have face coverings or a mask when entering the facility. You should also require hand sanitizing before entering as well. If you are going to temperature screen employees, you should do the same for all vendors entering the site for an extended period of greater than 30 minutes. You can also choose to check all of them before letting them into the facility. Set all sales/marketing and non-essential, non-delivery-based vendor meetings to teleconferencing only.
Request all vendors to provide touchless only options for billing.
Recommendations for All Visitors:
All visitors with permission to enter the worksite should sign in and out and provide a cell phone number along with whom they are visiting and why. Face coverings and hand sanitizing should be required. Limit all face to face meetings.
You will need to set up touchless or contactless methods of interacting with customers and vendors. This includes payment collection methods and the providing of goods and services.
Recommendations for Going Contactless:
First, ask your payment processing vendors about their contactless options and services that you can provide to your clients. If you accept card payments, consider collecting the payment information over the phone and directly inputting it into your payment processing systems. We advise against writing it down and then putting it later. Additionally, you can offer to invoice the customer and accept payment later depending on the type of service you provide.
Next, come up with a delivery method to provide your goods and services to clients and customers. Offer curbside pickup and delivery. Allow, a limited number or one person into your establishment at a time to pick up your products.
Can you deliver some services through a teleconference, videoconference, or through the mail or email? If so, do it where you can.
Find additional ways you can provide goods and services to clients where possible.
Consider what other additional needs you have. Some businesses require additional security and cleaning vendors. When you find you need a new or additional vendor, we have found it best to start early in the process and execute early. We have seen businesses wait and then be left with zero options in some cases. Find what you need, implement and you can always make adjustments as you go along.