Fifth public hearing of the National Commission on Terrorist Attacks Upon the United States

Statement of William G. Raisch to the National Commission on Terrorist Attacks Upon The United States
November 19, 2003

With Key Points from a Series of Roundtable Discussions on Private Sector Preparedness In Support of the Efforts of the 9-11 Commission
September - October 2003

Many of the key points that follow were drawn from a series of roundtable discussions with representatives from a diversity of industries and stakeholders including:

• Senior Management Personnel
• Corporate Safety & Security Professional
• Insurance Industry Underwriters and Loss Prevention Specialists
• Corporate Insurance / Risk Managers
• Regulatory Officials
• Corporate Counsel
• Legal Experts
• Public Safety Officials
• University Academicians
• Government Researchers & Investigators
• Rating Agency Analysts
• Standards Organization Representatives
• Industry Trade Association Personnel
• 9-11 Commission Staff

To promote free discussion, these roundtables were all conducted on an "off-the-record" basis; therefore, individual participants and their organizations are not referenced. Their participation nonetheless is sincerely appreciated and has significantly contributed to the understanding of this important arena and the development of strategies for the effective advancement of preparedness in the private sector.

This report is presented in a modified outline format and organized into three sections as follows:

• The Need for Private Sector Preparedness which outlines the rationale for a concerted effort to promote preparedness among private sector businesses and other organizations
• Short Term Strategies which discusses the initiatives that can be taken in short order primarily utilizing those elements which already exist but lack a framework and focus.
• Long Term Strategies enumerates a variety of initiatives that could be developed with concerted public/private effort. This section includes both new incentives as well as new programmatic initiatives to promote preparedness.

The Need for Private Sector Preparedness

• Initially, Our National Focus has been Primarily on Public Sector Preparedness: Much of the focus of preparedness efforts has been on
  • public sector preparedness (police and fire fighters, intelligence, military, transportation facilities, etc.) or on
  • the population at large (various general awareness campaigns, e.g. Ready.gov)

• Yet Private Sector Business has the Most Infrastructure & People: Businesses and other private sector organizations own 85% of America's infrastructure and employ the vast majority of our country's employees. Furthermore these resources of people and property are organized workplace units which can be more efficiently coordinated in an emergency situation than "the general public."

• Preparedness is Important & Can Minimize the Impact of Disaster: As a nation, especially post 9/11, we have acknowledged the importance of emergency preparedness in minimizing the impact of any disaster on people and property. Research has shown a clear relationship between advance preparedness and good outcomes for corporations after a crisis.

• However, the Private Sector is Often Unprepared for Emergencies whether the Emergency is Terrorist-Related or Not. Emergency preparedness has not been a historical focus of most firms with a few exceptions. There have been some exemplary efforts by select organizations and certain functional areas (e.g., information technologies) but on the whole emergency preparedness is not an priority for private sector organizations.

• Disaster Impacts on the Private Cost the Public as well as the Individual Companies: Loss of tax dollars, expenditures by the Federal Emergency Management Agency, the Small Business Administration and other agencies in response to private sector losses are often substantial.

• When Large Scale Disasters Impact Businesses There Can Be Dramatic Effects on Regional Economies as well as the National Economy. This was especially evident after 9/11/01 but was also apparent after the recent Hurricane Isabel, the northeastern power outage and the wildfires in San Diego.

• On an Individual Company Basis, Crises Occur With Significant Frequency. Research indicates that over the course of any five-year period, there is a 40% chance that a Global 1000 company will loose 30% or more of its value within one month due to a crisis. Many risks cannot be insured against or hedged. (Oxford).

• Yet, on the Whole, the Individual Companies Do Not See Themselves at Risk. Firms often look at hazards on an individual basis and discount each of them individually as unlikely (e.g., management questions what the risk of a terrorist attack occurring in proximity to their firm is, as opposed to what is the cumulative likelihood that some crisis of some sort will occur whether it is terrorist attack, fire, hurricane, workplace violence, hazardous materials incident, severe winter storm, transportation outage, power failure, or other emergency in the foreseeable future.

• Even When There is an Interest in Preparedness, There is Uncertainty and Confusion in the Private Sector as to What to Do: With a diversity of general but vague public messages, there is confusion in the private sector on preparedness issues and a need for coordination in this arena. It is not clear to many organizations, what can be done and what good "preparedness" is.

• There is no clear understanding of any incentives for Private Sector Preparedness. There is no compelling rationale for a firm to undertake preparedness measures.
  • Regulatory issues are vague - except in specific industries like financial services which has specific SEC regulations
  • No direct correlation between preparedness and cost savings in insurance is seen
  • Little understanding of bottom-line impacts of preparedness
• Constrained Budgets Due to the Slow Economy Limit Staff Time and Resources Available for Emergency Preparedness

Short Term Strategies to Promote Preparedness

Several Key Pieces to the Puzzle Already Exist: Many key elements of a potentially successful effort to promote private sector preparedness already exist while others have to be developed. The primary initial challenge may be one of integrating existing elements into a logical framework and then communicating them to the private sector. Then in turn, more developmental elements can then be addressed.

Three Key Elements Critical to Promoting Private Sector Preparedness:

1. Standards for private sector preparedness (both process as well as physical)
2. Incentives to motivate the private sector to address the standards
3. Education to effectively communicate the incentives and the standards as well as related information such as best practices.

1. Standards can provide models for preparedness for private sector organizations to reference in their own efforts. They can be voluntary or regulatory. Currently, the existing process-oriented preparedness standard is voluntary while most life safety codes (fire/building codes) are regulatory standards.

1. The Process Standard for Emergency Preparedness (NFPA 1600) Offers Promise as The National Model for Private Sector Emergency Preparedness: The process of Emergency Management including advance hazards analysis, remediation, response and recovery is central to effective preparedness. The NFPA 1600 Standard on Disaster / Emergency Management and Business Continuity Programs provides the overall process and functional inventory necessary central to build an effective preparedness program including an overall plan to direct activity pre-crises, during and post-crisis. It is a consensus-based standard developed in accordance with the American National Standards Institute (ANSI).

   NFPA Standard 1600 was developed by the National Fire Protection Association in consensus with public and private sector organizations including the Federal Emergency Management Agency, the National Emergency Management Association and the International Association of Emergency Managers. It is the only process-based standard existent on either a national or international basis. The standard identifies the key functional areas and an overall strategy for disaster preparedness and business continuity for both private and public sector organizations. It takes a "total program approach" for disaster /emergency management and business continuity programs by providing common program elements, techniques and processes. It is not a detailed "how to" but rather a general strategic level reference that can serve as a guide in the development of an overall program. Given the difference among organizations, more detailed plans and operational level policies and procedures are best developed on a company-by-company basis.

   There are no competing standards to NFPA 1600. Since it was only elevated to a full national standard in 2000, NFPA 1600 is still not widely known. It is currently a voluntary standard so regulatory bodies have not publicized the standard as many other NFPA regulatory standards are. Nonetheless, NFPA 1600 is a significant resource for private sector preparedness, worthy of greater communication and use.

2. Building / Fire Code Standards for Emergency Preparedness: Local life safety / fire / building codes generally dictate such issues as fire egress (including corridor and stairwell widths), sprinkler system requirements, fire door ratings, etc. There are two key issues in this regard:

   • There are two primary competing codes in this respect (NFPA and ICC - International Codes Council). The codes have substantial similarities. Furthermore, it is the local government's prerogative to modify the codes as they see fit within their jurisdiction. Thus, there can be differences in the life safety/fire/building codes from area to area. The standards though on the whole are similar with certain exceptions. This is an area of concern to many private sector organizations that would prefer a truly national standard - especially those organizations with multiple sites. While there has been some movement in this direction, the effort could be furthered by a national entity that sought to promote greater consensus in this regard (perhaps the Department of Homeland Security or ANSI in select areas). Nonetheless, the doctrine of "home rule" by state and local governments may make this effort an uphill battle.

   • There is an acknowledged need to review existing life safety codes in light of the post-9/11 environment. New York City's Local Law 5 (Life Safety Code) with its most recently proposed amendments reflecting lessons learned from 9/11 may serve as a worthwhile reference for the evolution of structural or building codes which address emergency management issues.

2. Incentives provide the "carrots and sticks" to motivate organizations to undertake preparedness measures. Absent incentives "Emergency Preparedness" is just a good idea. Incentives can be both positive (e.g., benefits) and negative (e.g., fines). Existing incentives follow and offer the greatest short run opportunity to promote greater preparedness. Potential incentives subject to development are discussed later.

1. Existing OSHA Regulations Require Workplace Evacuation Plans and in some cases More Complex Emergency Response Plans. The Occupational Safety & Health Act and the Occupational Safety & Health Administration which administers the Act reflect key elements for promoting preparedness:

   • Regulations already exist which require Emergency Action Plans (essentially evacuation plans required for all workplace organizations) and more involved Emergency Response Plans (required for specific process-oriented organizations)

   • OSHA has an existing enforcement function with the capability of writing fines

   • As importantly, OSHA has an established and staffed program of "Compliance Assistance" which takes a non-enforcement and consultative approach to promoting workplace safety through education and assistance. This effort is exemplary and should be widened in its staffing and support.

   • Additional funding may be needed to truly promote this effort and to promote recognition of and compliance with these regulations as a basic foundation for effective evacuation.

2. Legal Liability: With an Average Directors & Officers Liability Claim for a Publicly Traded Company Ranging From $19 - $24 Million , this Liability Can Be Significant. Minimizing exposure may become a major incentive for private sector preparedness. The recent decision in Federal Court holding that the Airlines should have reasonably foreseen a 9/11 type Terrorist Attack suggests that all organizations may have a legal responsibility to plan and prepare for emergencies.

   • The Perceptions of "Reasonableness and Foreseeability" Are Changing in terms of D&O Insurance: Everything is foreseeable now. It is now the expectation of employees and investors that all corporations should be prepared and this will be an issue in the aftermath of any crisis. Some see the potential liability based upon "Negligent Failure to Plan for Emergencies."

3. Crises Happen More Frequently than Thought As previously, discussed Oxford Metrica research suggests over the course of any five year period, there is a 40% chance that a Global 1000 company will loose 30% or more of its value within one month due to a crisis.

4. Risk to Market Valuation: Preparedness Impacts Market Valuation Research on Post-Event Crisis Management and Impact on Shareholder Value (Oxford Metrica) indicates
   • Many risks cannot be insured against/hedged
   • Large firms are not more resilient than smaller firms
   • Organizations can potentially benefit from crisis if handled well (e.g., increased visibility, good publicity, etc.)
   • There is a positive relationship between advance preparedness and good outcomes.

5. Additional "Bottom Line" Oriented Rationale based upon current research and experience

6. Social Conscience Rationale including commitment to employees, community and country

3. Education

1. Spotlight Key Existing Preparedness Standards and Incentives. Publicize and educate the private sector on what already exists with respect to the rationale for preparedness and the standards on how to prepare their organization. There is a tremendous lack of understanding with respect to emergency preparedness in the private sector.

2. Provide Access to Additional Supportive Resources including
   • Planning Aids
   • Best Practices
   • Self-Assessment Aids
   • Management and Workforce Training

3. Deliver Education via a Multi-Media Network
   • Print
   • Television
   • Web-based
   • Video/CD

4. Integrate Existing Resources for Easier Private Sector Access (possibly via a single gateway) including
   • Universities
   • Professional Associations
   • Trade Associations
   • Government Agencies
   • Media
   • Other Private Sector Resources

Long Term Strategies for Preparedness

Potential Additional Incentives to be Developed

• Financial Incentives (tax credits, grants, etc.) Could Be Developed to Further Promote Greater Voluntary Compliance. Real estate tax abatements and enhanced development rights could also be used to promote building owners to undertake physical plant remediation efforts that promote greater emergency preparedness. New York City is currently evaluating such measures. Tax credits would effective for both building owners and tenants.

• Existing Regulations (e.g., OSHA) Could be Expanded or New Emergency Preparedness Regulations Developed (e.g. NFPA 1600 could become a mandatory not voluntary standard for some organizations)

• Promote the Establishment and/or Recognition of Insurance-Based Incentives Rewarding Preparedness. Insurance companies may consider preparedness in the underwriting & pricing of insurance for private sector organizations. This could potentially allow for relatively lower premiums for those organizations that are well prepared versus those that are not.
  • But Insurance Companies Need a Generally Accepted Standard for Private Sector Preparedness that Can be Measured. It is difficult for insurance companies to understand whether or not an organization is "prepared" without a commonly accepted standard. Only with such a standard can the industry effectively incorporate preparedness into its underwriting and premium pricing. They are often unaware of NFPA 1600.
  • Regulatory and Industry Consensus Would Also Be Necessary.

• Evaluate Further Development of Regulatory-Based Incentives
  • Promote Wider Standardization and Updating of Fire / Life Safety and Building Codes which already exist but could benefit in some cases from updating and standardization in light of the new environment
  • Consider amending OSHA legislation to require a proactive reporting by the private sector to OSHA confirming the existence of Emergency Action Plans and Emergency Response Plans. Currently, these plans are generally required but can often only validated by OSHA upon submission of a complaint.
  • Coordination of emergency preparedness initiatives is needed among various geographic jurisdictions as well as levels of federal, state and local government. Perhaps the Department of Homeland Security might be an effective catalyst in this regard
  • Research the Advisability of Wider Regulatory Standards for Private Sector Preparedness (e.g., the adoption of the NFPA 1600 Standard into law).

• Evaluate Separate Legislation and/or an Amendment to Sarbanes-Oxley that Addresses the Need for Crisis Preparedness in Corporate Governance. Sarbanes-Oxley has been a very strong motivator for corporate change. While Sarbanes-Oxley does not address emergency preparedness, it may serve as a model for establishing a crisis management responsibility in corporate governance.

• Promote Market Valuation/Rating Agency Incentives. Given a common standard, at least one of the rating bodies appear to be willing to include this in their analysis although it would be only one of many factors under consideration.

• Evaluate Promoting Emergency Preparedness as a Requirement for Participation in Private and Public Supply Chains (e.g., consider a preference or requirement for and emergency management program prior to doing business with the government)

Potential New Initiatives

• Development of a Voluntary Private Sector Preparedness Accreditation Should Be Considered. There is currently a voluntary accreditation initiative underway (EMAP) which accredits governmental emergency management programs. This effort is supported by FEMA and administered by the National Emergency Managers Association (which represents governmental emergency managers). The development of a private sector equivalent of EMAP (perhaps building upon it) should be investigated.

• Market-Driven Preparedness Initiative: Harnessing Post 9/11 Public Interest in Preparedness to Promote Voluntary Compliance to a Recognizable Standard. Much the same way that an emphasis on quality has forwarded such corporate quality standards as ISO 9000, so too could an identifiable preparedness standard become a factor which employees, building tenants, investors and others look for in an organization and/or building. In the case of facility/building preparedness, Emily Raisch has proposed a recognizable symbol and ranking system akin to those posted by restaurants attesting to their ranking (A,B,C..) by the Department of Health. These rankings could be posted at such places as entrances to buildings and in elevators where the public could view them. Attaining a top rating could be seen as a competitive strength by building management/ownership and could be a factor to be evaluated by both current and prospective tenants. Defined, measurable criteria and optimally non-biased third party inspection would be important to forwarding this initiative. Nonetheless, there may also be mechanisms which would not require outside certification. The only potential concern in this regard would be the use of this posted information in targeting weak facilities for terrorist attack but presumably no entity would pursue such a rating without at least a threshold of commitment to emergency preparedness. Therefore, it is likely that most of the participating organizations would receive a relatively high rating or could opt not to post a low rating.

• Development of a Self-Assessment Methodology so organizations can perform a preliminary assessment of their preparedness and identify both strengths and areas for improvement as well as establish a benchmark for progression in their preparedness efforts over time.

• Undertake Further Research to Identify the Value of Private Sector Emergency Preparedness and the Most Effective Incentives to Promote Investment by Private Sector Companies. Bottom-line impacts of effective preparedness programs should be researched and generalized. Beneficial by-products of such programs such as improved employee morale and improved intra-organizational cooperation should be identifi

• Investigate the Need for Continuing Federal Government Support to Address Insurance-Related Concerns About Terrorism Risk.

  • The Terrorism Risk Insurance Act (TRIA) has provided an Important Cap to the Financial Risk of Insurance Companies and Has Sustained an Environment in which Insurance Companies Have Continued to Provide Insurance in Many Areas Where They May Not Have Otherwise.

  • TRIA is to expire at the end of 2005. Unless TRIA is extended or another alternative is developed, insurance companies suggest that they may not write policies in what they identify as high-risk areas (like Downtown New York City). Thus, TRIA may be an economic Time Bomb in this respect possibly impacting:
    • Workers Compensation
    • Property Insurance
    • Liability Insurance

  • It is Predicted that Proximity to a Potential Terrorist Target May Dramatically Impact Not only the Price but in Some Cases the Availability of Any Insurance as the insurance company will first look at the probability of collateral damage due to a terrorist related incident and then secondarily how prepared the organization is to weather the incident. There are 3,400 potential terrorist sites identified sites in the U.S. by one organization alone. (RMS).

  • One leading recommendation is a mandatory reinsurance pool with first loss exposure by the insurance industry up to a threshold and then government funding thereafter of losses. Such an effort might parallel the U.K. terrorism pool.

Concluding Comments

Multiple Initiatives Are Likely Necessary. Given the diversity of the private sector, a variety of distinct but coordinated efforts are most likely necessary to effectively promote emergency preparedness and crisis management.

For Any Effort to Be Effective, It Must Not Contribute to Existing Regulatory Complexity and Inconsistency But Instead Should Optimally Provide a Model for Greater Rationality: Any initiative for private sector preparedness must first seek not to worsen the existing situation by adding yet another layer of uncoordinated and inconsistent regulations. Rather, this initiative could in fact borrow from a primary role of the newly created Department of Homeland Security, that being to add coordination to government activities and breakdown barriers between agencies. Such an effort would likely be embraced by the private sector.

Joint Public / Private Involvement is Critical. Any effort to promote private sector preparedness must directly involve the private sector in both its development and application. That involvement must include the representation of the private sector organizations that will actually be impacted by any program if it is to be effective.

Bill Raisch serves as the founder and director of the Emergency Corpstm Program, a nationwide initiative sponsored the Greater New York Safety Council. The program focuses on emergency management training with an emphasis on emergency response teams and the development of emergency management plans. He has provided training to nearly 200 organizations in emergency management in conjunction with subject matter experts from the FBI, OSHA, New York City Office of Emergency Management, the Counter-Terrorism Division of the New York Police Department, the Fire Department of New York and numerous private sector experts in business continuity, legal affairs, emergency management and other areas.

Bill is a member of FEMA's Master Trainer Program and has developed several targeted emergency management training programs in consultation with FEMA. He has received extensive training at FEMA's Emergency Management Institute at the National Emergency Training Center where he developed a practicum training program on the "Development and Review of Organizational Emergency Management Plans." Bill has developed an organizationally focused adaptation of FEMA's Community Emergency Response Team program. He has also received training from NYPD's Counter-Terrorism Division, the Disaster Recovery Institute, the United States Coast Guard Auxiliary, the American Red Cross as well as other organizations.

His planning experience includes over twenty years of organizational consulting and past tenure as the Director of Strategic Planning for Smith Barney International. Currently, in conjunction with his efforts with the Greater New York Safety Council, he serves as a director of the American Group of Companies, Inc. which focuses on developing innovative educational programs.

Bill is a 1979 graduate of Cornell University's College of Arts and Sciences where he majored in government and economics. He received his M.B.A. from Cornell's Johnson School of Management in 1981 fulfilling the requirements for a Masters in Public Administration as well.

He is married to Barbara J. McCabe and is proud father to three daughters, Emily, Julie and Anna. He also volunteers with the United States Coast Guard Auxiliary and provides emergency management assistance in that regard.