2005 Ad

Risk Management, Dec, 2006 by Alfredo Guerra, Kathie Kearney

When Steve Klingel relocated to South Florida from Minnesota he was already well-versed in dealing with the effects of blizzards and ice storms. He would soon become equally familiar with windstorms.

In his first three years as president and CEO of the Boca Raton-based NCCI Holdings, Inc., a national provider of workers compensation and employee injury data, there were 50 named tropical storms and hurricanes. More than 12 of them put NCCI's risk management and emergency preparedness team into high alert. With the exception of Hurricane Wilma in 2005, most of the storms caused only one to two days of disruption to NCCI's operations. However, Klingel noticed that more was involved than just the physical protection of the company and the backup of electronic data.

With each new trial by storm, new employee needs were identified. When Hurricane Wilma moved across the Florida peninsula in 2005, its wind force and intensity was expected to decrease to tropical storm levels, leading many businesses and residents--already weary from earlier seasonal storm preparations--to forego genuine emergency precautions. Reluctantly, but methodically, NCCI forged on through the steps of its preparedness plan, however.

In a disastrous turn, the storm actually grew in intensity and took the entire region by surprise. Businesses were closed for days, property damage was extensive and cell phone transmission towers were downed. To make matters worse, much of the area's backup resources and services had already been sent to aid the victims of Hurricane Katrina on the Gulf Coast, leaving the state even more vulnerable.

When the clouds subsided, NCCI had weathered the storm far better than most--but not without learning some valuable lessons.

Developing a Plan

Compared to the devastation of recent years, the 2006 hurricane season has now come and gone without major impact for most U.S. businesses. This cannot necessarily be taken as a sign of things to come, however, and companies that use this as a validation to downgrade their preparedness are certainly taking a myopic view of things.

NCCI has been as active as ever in fortifying their business continuity plan and was able to use Tropical Storm Ernesto as a "test run" for its latest emergency enhancements. Fortunately, Ernesto was more bark than bite and once again provided NCCI with an opportunity to initiate, implement and improve its business continuity plan.

Each year, NCCI considers all of its risks when creating a comprehensive preparedness and recovery plan. The greatest lesson learned to date is that no two storms are the same, and each presents a unique set of circumstances and challenges. Risk managers will undoubtedly come up short if they just prepare for the needs of the last disaster.

Due to the nature of its business, NCCI can maintain service levels and online tools used by its customers to conduct their business for up to a few days with minimal staff. But if the company closes due to a hurricane or other natural disaster for an extended period of time, stakeholders' businesses (approximately 900 member insurance companies servicing 36 states) can be adversely affected.

Regardless of their inherent limitations, companies residing in areas of seasonal or regularly occurring natural disasters must plan on operating at some minimum level of effectiveness following a major disaster event. NCCI's secret to surviving the seven hurricanes that have impacted its headquarters in just two years is really not a secret at all--everything is clearly and concisely spelled out in its business continuity plan.

The plan is a living document that is used by nine operating divisions in times of disaster and provides a detailed framework to follow in the event of any disaster. The keeper of the plan is the risk management department. Business coordinators are appointed in each division to identify the components and requirements for their division. They regularly feed information to the risk manager and update it regularly for the following four business reasons:

* It is an internal game plan that the disaster team and managers use as a step-by-step guide and resource

* It is a signal to the board of directors that staff has a formulated strategy for maintaining operations

* It is written verification to a company's own insurance company that precautions are being taken to avoid unnecessary losses

* It is designed to ensure the safety of all employees and the protection of the facility from losses and damage, as well as the maintenance of some minimum level of business productivity/profitability during a disaster

The plan elements most used during a hurricane are the departments' business resumption plans, which identify business-critical functions or processes and how they are recovered. Employees can refer to the actions that must be taken on each day following a disaster.

Access to the plan is key. Hard copies are given to the disaster plan and recovery team, which consists of the CFO, treasurer, HR manager, risk manager, facilities manager and corporate communications representative.