How well do airports know their risk and plan for business continuity? This question was posed by Risk Solutions International (RSI) as part of a three-year, FAA-funded research and development project for the Transportation Research Board.
“The genesis of this project was a ‘problem statement’ developed by airport industry experts for the Airport Cooperative Research Panel (ACRP), which is a program within the TRB,” says Scott Corzine, senior vice president of FTI Consulting and principal investigator for the project. “The airport industry had concluded that--while airports excel at safety, security and emergency management--their level of knowledge and practice of business continuity planning were at an immature stage. Our research confirmed and amplified that finding.”
Airport Business recently spoke with Corzine to learn about the project’s findings and how airports can better plan for continuity of business operations when disaster strikes.
Tell about the key findings from the research. What are the highlights and were there any surprises?
We confirmed the premise and problem statement that led to this research, which was: There is a pretty radical lack of awareness in the airport community for business continuity. What it is, how it’s different from emergency management, and why it’s critical. Part of that is a lack of awareness. The second part is it’s just not a strategic priority for many airports. It is confused in a very big way with what they do so well which is emergency management, safety and security.
The second finding is there’s a general misconception that business continuity planning is an incident-specific recipe for exactly how you recover. First do this, then do this, then do this. It’s really not that at all because we write a business continuity plan in a way that is incident-agnostic. You write a recovery plan for how you recover certain essential functions regardless of what took them out.
Next we found that business continuity is uniquely challenging at airports. Many essential functions at airports are the responsibility of a contractor, tenant or government entity. Airports don’t control what the FAA does on site. They don’t control what the TSA does. They don’t control what Customs and Border Protection does. Airports don’t land planes; airlines do. Airports are a very complicated kind of ecosystem of shared responsibility among lots of people; many of whom do not work for the airport directly.
Can you explain the difference between an emergency plan and a business continuity plan?
An emergency management plan is a plan that’s all about protecting life and property, physical assets, infrastructure, life, property in an emergency. By its nature, it is incident-specific and it deals with what we call the phases of emergency management. How do I prevent bad things from happening? How do I mitigate the impact on life and property if they do happen? Preparedness is the second phase. How do I prepare for the inevitable ones that are going to happen whether I like it or not? How do I respond to this incident? How do I physically and psychologically recover my physical plan after something terrible happens?
By contrast, a business continuity plan is incident-agnostic. It doesn’t care why a system is down, why a process is broken or why an essential function doesn’t work. It documents the mix of resources that every essential function has in common so that planners can understand how to recover that function. While emergency management is about the protection of life and property, business continuity is about the recovery of essential functions and processes and data that drive those functions. All it knows, for example, is the IT system’s down. Whether it’s down because of a hurricane, fire, flood, famine or pestilence doesn’t matter. You have to get it back up and here’s how you will do that.
A business continuity plan deals with the mix of resources that every essential function has in common and those resources are people, plant, equipment and supplies, technology and processes. Anything at the airport requires a certain number of people to do it. If that person isn’t there, it may well be that that job can’t get done because it has to be a union worker and he has to have or she has to have that certification. The second piece is technology. Airports need network resources, laptops, desktop computers, servers and applications to get the job done. Without those, we can’t run payroll. We can’t check how much fuel we’ve used. We can’t do a lot of things. The third piece is plant equipment and supplies. Every single function at the airport needs some mix of supplies, equipment and facilities. The fourth segment is processes. Nearly everything that’s automated connects with some other process that had to come before it for the process to be doable. I can’t write paychecks for the airport staff unless I get the timesheets in on time. If the timesheet system’s down or if the guy who brings them to me in our office envelope isn’t available, I don’t make payroll on time. That’s a predecessor process. Business continuity looks at the mix of resources it takes to do every essential function as a baseline for how you go about recovering that function.
Can you give me some examples of situations that might occur if you do not have a business continuity plan in place?
Not having a business continuity plan simply makes the likelihood far greater that it will take them longer to recover than it should. Every moment they haven’t recovered, there is probably damage to a constituency from the airlines that are lease holders, to the tenants that need the space to operate, to restaurants that can’t serve hamburgers because the power is still out, to the TSA who can’t do their job because they can’t put people through the security machines--all parts of what I call the airport economic watershed.
Are there specific people within the airport who should be part of the planning process?
The person heading this up should have a job that gives them an overall purview of how the airport works. That might be operations because the operations office knows what everybody does and what everyone’s responsible for. It might be an internal auditor. Often, it’s the finance department because it touches everybody in terms of operating budgets and so forth. It may be the risk manager because the risk manager has an inside view of all the things that go on at the airport because he or she has to arrange insurance and do risk management planning. Often, it’s someone on the administrative side. It’s rarely someone in public safety or in ARF, which have a very specific job and don’t know the rest of the operation the way an internal group might.
Is there a process airports should follow in business continuity planning?
The results of this project were a guidebook and software, which has been published by the Transportation Research Board (TRB and can be downloaded or purchased directly from the TRB at http://onlinepubs.trb.org/onlinepubs/acrp/acrp_rpt_093.pdf. The software application is available to airports to install via CD, which accompanies the guidebook entitled “Operational and Business Continuity Planning for Prolonged Airport Disruptions.” The guidebook includes a discussion about what business continuity is, how an airport should go about building a business continuity plan, and how to keep it up to date. It’s not just a one-time thing.
