I have written a fair bit about risk (defined as the intersection of assets, threats and vulnerabilities) and how to manage/mitigate it, however most of this has been based on an interpretation of past events, where we have past behaviors, and actions – both from our own experiences, and those of others — to guide us in what we should expect in the future, and how we should respond to it. Such a methodology works well where risks are routine, and low-level. For example, we have a wealth of information concerning how burglaries and muggings are committed, and the preventative measures we can take to reduce our vulnerabilities in order to protect ourselves and our assets, however we have less information to work with, when we are looking at the best way to respond to active shooter/killer incidents, acts of terrorism, etc., which occur less frequently; and sometimes past experiences of how to respond in an emergency can misguide us. On 9/11, when the planes hit the Twin Towers of the World Trade Center, many people — unaware of what had actually happened — started to move up the stairs to get to the roof, rather than going down towards the ground level. The reason for this was that several people had been airlifted from the roof after the 1993 truck bombing in the basement of the building, and were using this as a point of reference as to how they should respond in this moment (this was an option that was attempted on 9/11, but the ferocity of the fires and the amount of smoke prevented it from happening). In such high-risk and rare situations, it is important that any response gets it right the first time, however learning from experiences is not always an option. In this article, I want to look at some of the modelling methods we use to formulate Emergency Operations Plans (EOP), that can guide us on how to react and respond when we experience these types of uncommon, but high-risk events.

Drills and physical exercises are one way to train and develop responses, however when we are talking about large scale institutions, these can be costly, difficult to co-ordinate or even find the time to do; they may also be extremely disruptive to the organizations day-to-day business e.g. active shooter training in a hospital or healthcare setting, that involves the evacuation of a ward or intensive care unit, may put actual patients’ lives at risk. There may also be kick-back to this type of training from schools, which either believe that this type of training would be traumatic to students – there are of course ways to mitigate this – or find that they are unable to get parental consent for a large majority of students. I can’t stress enough the value of such drills and exercises for perfecting EOP’s and providing a dynamic and kinetic education as to the effectiveness of a plan, however there are also drawbacks to such exercises; if in the review stage it is found that the plan has to be changed i.e. those taking part have just been educated in an outdated response model. If such drilling occurs infrequently, it may be that the “new” revised plan isn’t practiced before an actual event occurs, and so those actors in a situation revert back to something that they have experienced, which may put them in danger; in a similar way to those who tried to get to the rooftop of the Twin Towers, believing that they’d be air-lifted to safety. One way to avoid these problems is to engage in Prospective Hazard Analysis (PHA).

With PHA, there is an assessment of all of the things that could go wrong, so all of the potential problems that could be faced, are dealt with and ironed out, so that an EOP can be shown to be proven to be effective. There are many different PHA methods and approaches that are available, such as SWIFT (Structured What-If Technique), FMEA (Failure Mode and Effective Analysis), and HEART (Human Error Assessment and Reduction Technique) etc. however, a common component that they all share, is the identification, and likelihood of hazards, and recognizing deviations that could occur, resulting in further hazards e.g. a hazard, could be an active shooter/killer, and a deviation could be that somebody who has identified the killer in a school, office or university panics and forgets to notify the person who is in charge of making the announcement over the public address system (issuing the code green warning), to inform everybody in the building of the presence of a shooter – the resulting hazard is that a mobile shooter is able to find more unprepared potential victims. This deviation can be mitigated against with more training, and the stressing of the importance of informing those in charge of the PA system.

Although most Prospective Hazard Analysis, is done at the macro/organizational level, it can also be done at the micro/personal level. This is something I do with clients when taking them through Travel Security basics, such as how to develop an EOP for dealing with a fire in a hotel when abroad. Obviously, the guts of such a plan is to exit the building by making it to a fire-escape, however there can be deviations to this, such as what to do if the fire exit is blocked by too many people trying to evacuate e.g. fire regulations in a foreign country may allow for major exits to have their doors open inwards, meaning large crowds pushing against each other to escape may push against the door preventing it from opening, etc. With some foresight and planning, this risk can be controlled, and a strategy devised for dealing with it i.e. having an awareness of another exit route that although may be less direct, will likely be less trafficked, etc. Although staying in the penthouse may seem luxurious, it obviously lengthens the time it will take you to exit a building in the event of an emergency – the fire plans of the World Trade Center, looked at it taking a minute for a person to clear each floor (something that turned out to be wildly optimistic, with the number of people trying to exit), so if you were on the 110th floor it would take you nearly 2 hours to exit the building in the event of an emergency. It’s also worth noting that over a certain number of stories, no fire ladder, etc. will be able to reach you.

Although an organization may have implemented an EOP, it’s worth recognizing its limits and failures, and deviations that might not have been considered e.g. such as the length of time it takes to evacuate a building — if you are a frequent traveler who stays in a lot of hotels, purchase a fire hood/smoke mask, and travel with a flashlight (the electricity may go out in a fire); the mask/hood should give you 50-60 minutes of breathable air, protecting you against smoke inhalation and falling hot ash. If you find yourself on one of the upper floors (you may have asked for one lower down, but none was available), the extra time this gives you to evacuate may be the difference between life and death. In all areas of our life we should have plans of what to do when faced with different types of emergencies, and we should be regularly testing them.