ISO 28000:2007

7/14/2021 Tutor notes

GVS RAO
06-01-2021

Gobburu Venkata
G2 BUSINESS EXCELLENCE
2. Contingency Planning and Contingency Plans – Not the same
Much has been written about the difference between the process of “planning” and the
creation of “plans.” Some of our greatest Military thinkers have praised the process of
planning and condemned the creation of arsenals of “plans”.1

Even the most thoughtfully developed plans often fall short in their implementation because
they either:

 Never get fully disseminated; or

 Cannot be executed by on-scene management
 Leave out critical considerations; or
 Require injections of specialized training; or
 Never get exercised, and (accordingly) never get adjusted; or
 Never get updated to reflect new procedures or capital improvements; or
 Were plagiarized from a similar but separate organization.
The list could go on, but you get the idea.

If a required course of action is contained within a current plan (i.e., it was anticipated), the
current plan survives intact. However, if the required course of action is (in some manner)
beyond the current plan, re-planning is necessary, which wastes time and manpower and
degrades mission effectiveness.

All plans need to have built-in “tripwires” or “pre-planned responses,” that allow on-scene
managers to execute when they are satisfied that pre-determined criteria have been met.
Timeliness of execution should be incorporated into the strategy and structure of any plan.
However, if the decision to execute requires the staffing, concurrence, and/or permission of
higher authority, that timeliness can be diminished or even lost completely.

The Military helped solve the problem of too many plans and not enough planning, and of
“execution by committee” with the concept of Situational Awareness, or the ability to
recognize a situation (or a change in a situation) identify and assess the options, select a
course of action, AND translate it into actionable orders. For the rest of us, civilian
organizations maintain situational awareness when they share, internally and externally, the
same operational (big) picture; and deviations or fluctuations are recognized more rapidly by
managers, who can implement corrective actions almost spontaneously. Managers and
auditors should look for and encourage situational awareness when they look at the
feedback, communication, and continuous improvement mechanisms in the organization.

Other, more specific opportunities for Management to incorporate situational awareness can
be found in:

 Standard operating procedures or SOPs

 Information management (including weather prediction)
 Report generation and simplification
 Pre-planned responses
 Alarm and alert systems
 Training and qualification systems

1
Patton and Eisenhower were two – nice to know that they agreed on something.

1|Page
  Executive “dashboards.”
 Clear-cut lines of authority (everybody knows who’s in charge, and local managers
have sufficient authority to initiate and support expedient recovery).

Top Management needs to focus on this last bullet. The ability of an on-scene manager to
enter into contracts or to purchase needed goods and services unilaterally is, in my
experience, absolutely essential during contingency operations.

Several years ago, while working as a Military Analyst, I helped to reconstruct

contingency response command and control at major U.S. Navy shore installations
on the Gulf Coast before, during, and after hurricanes Katrina, Rita, and Wilma. I
confirmed (to nobody’s surprise) the following with regard to contingency planning
and situational awareness:

1. Installation commanders and staffs had prepared documented contingency plans

and situational awareness strategies from which to execute flexible responses. Once
vital services were restored on-base, the Military went into the local communities to
help. Local governments and FEMA lacked the required preparation, training, and
expertise.

2. Those same installation commanders had conducted exercises, gathered feedback

and “lessons learned” and honed their future responses long before onset of those
hurricanes. Local governments and FEMA had not.

3. Local governments turned to the Military not only to restore utilities (e.g.,
providing emergency power to local hospitals and cell phone towers) but to set up
command centers in the cities and “assist” local officials through recovery and
restoration.

4. FEMA routinely usurped power and took over direction of local emergency
operations. FEMA should never have tried, for example, to tell Naval air station
commanders how to conduct flight operations or tell (U.S. Coast Guard) port
captains how to conduct search and rescue operations.

Figure 2-2 describes the Contingency Plan “continuum. That is, the path from and back to
normal operations after a disruptive incident. The path takes the organization through
Response, Continuity, Recovery/Resumption, and back to Normal. The ability of the
organization to travel safely and expeditiously along this path depends on the suitability and
robustness of the planning, the consistency and likeness of normal and contingency
operations, and the ability of on-scene personnel to react without the need for further
guidance and direction from above.

Figure 2-2 The Contingency Plan Continuum

Contingenx
NORMAL INCIDENT RESPONSE CONTINUITY RECOVERY/RESUMPTION NORMAL

2|Page
Contingency planning, according to NFPA 1600 consists of five components:

1. The Strategic Plan

2. The Emergency Operations/Response Plan
3. The Mitigation Plan
4. The Recovery Plan
5. The Continuity Plan.

However, the possible establishment of five separate plans (possibly created by five
separate levels or functions) creates numerous real and potential interoperability
complications, especially over time, as some activities change and others do not. The
“Strategic Plan” required is actually a subset of the overall strategic plan governing the
organization. With that in mind, a more streamlined contingency planning strategy like that
shown in figure 2-3 would likely be more executable.

Figure 2-3 Evolving the Contingency Plan

All the components of the diagram must be combined, revised, and combined again to
create operating plans for normal operations anyway. The shift to a contingency scenario
should be as automatic and transparent as possible.

3|Page