Risky Business

How well do airports know their risk and plan for business continuity? This question was posed by FTI Consulting as part of a three-year, FAA-funded research and development project for the Transportation Research Board (TRB).

“The genesis of this project was a ‘problem statement’ developed by airport industry experts for the Airport Cooperative Research Panel (ACRP), which is a program within the TRB,” says Scott Corzine, managing director of FTI Consulting and principal investigator for the project. “The airport industry had concluded that —while airports excel at safety, security and emergency management – their level of knowledge and practice of business continuity planning were at an immature stage. Our research confirmed and amplified that finding.”

Airport Business recently spoke with Corzine about the project and how airports can better plan for continuity of business operations when disaster strikes.


What were the key findings from the research?

We confirmed the premise and problem statement that led to this research, which was: There is a fairly radical lack of awareness in the airport community for business continuity. What it is, how it’s different from emergency management, and why it’s critical. Part of the problem is a lack of knowledge. The second part is that business continuity planning, or “BCP”, is just not a strategic priority for many airports. BCP is confused in a very big way with what airports do so well – which is emergency management, safety and security.

Our second finding is that there’s a general misconception that BCP is an incident-specific recipe for exactly how you recover, step-by-step, for all kinds of disaster scenarios. First do this, then do this, and so on. BCP is really not that at all because the best practice is to write a business continuity plan in a way that is incident-agnostic. You write a recovery plan for how you recover certain essential functions regardless of what specific incident took them out of operation.

Next we found that business continuity is uniquely challenging at airports. Many essential functions at airports are the responsibility of a contractor, tenant or government entity. Airports don’t control what the FAA does in the tower. They don’t control the work the TSA does. They don’t control what Customs and Border Protection does. Airports don’t land planes – airlines do. Airports are a very complicated kind of ecosystem of shared responsibility among lots of entities and people, many of whom do not work for the airport directly.


Can you explain the difference between an emergency plan and a business continuity plan?

An emergency management plan is a plan that’s all about protecting life and property, physical assets, and infrastructure in an emergency. By its nature, emergency management is incident-specific and deals with what we call the four phases of emergency management. How do we prevent destructive things that threaten us physically from happening? How do we mitigate the impact on life and property if they do happen? How do we prepare for the inevitable incidents that are going to happen whether we like it or not? How do we respond to each of these types of incidents? How do we physically and psychologically recover the physical plant after something terrible happens? Airports generally do this very well.

By contrast, a business continuity plan is incident-agnostic. It doesn’t address why a system is down, why a process is broken or why an essential function doesn’t work. It documents the mix of resources that is critical to every essential function so planners can understand how to recover those functions. While emergency management is about the protection of life and property, business continuity is about the recovery of essential functions and processes, and data that drive those functions. The BCP addresses, for example, that the IT system is down, runway lights and NAVAIDS are not functioning, shared services are disrupted, or winter operations are unable to take place. Whether these functions are down because of a hurricane, fire, flood, sabotage, power outage or pandemic doesn’t matter. You have to get them back up and operational, and here’s the plan for how you will do that.

A business continuity plan deals with the mix of the kinds of resources that every essential function has in common – people, plant, equipment and supplies, technology and related processes. Every essential function that takes place at the airport requires a certain number of people with specific training, licenses, certifications or physical attributes to do it. If the usual person isn’t there, it may well be that the job can’t get done, for example, because it has to be performed by a union worker who is required to have specific qualifications. The second resource every function requires is technology. Airports need network resources, laptops, desktop computers, servers and applications to get the job done. Without those, we can’t run payroll. We can’t check how much fuel we’ve used. We can’t operate shared infrastructure services, or provide customer support. The third piece of the resource puzzle is that every single function at the airport needs some mix of supplies, equipment and facilities at which to operate optimally, whether it is fuel, forms or vital records, tools or vehicles. Related or dependent processes is the fourth resource category that almost every essential function depends on. Nearly everything that’s automated at the airport connects with some other process – internal or external – that had to come before it, in order for the process to be viable. We can’t write paychecks for the airport staff unless Payroll gets the timesheets on time. If the timesheet system is down or if the guy who brings them to me in our office envelope isn’t available, we won’t make payroll on time. That’s a predecessor process. BCP looks at the mix of these four types of resources that it takes to perform every essential function as a baseline for how airports go about recovering those functions.


What might occur if Airports Lack a business continuity plan?

Not having a business continuity plan simply makes the likelihood far greater that it will take airports longer to recover than it should. Every moment they haven’t recovered, there is probably damage to a constituency—from the airlines that are lease holders, to the tenants that need the space to operate, to restaurants that can’t serve hamburgers because the power is still out, to the TSA who can’t do their job because they can’t put people through the security process. Damage from operational downtime can also be measured in direct costs. Loss of services or facilities may mean contractual penalties and claw-backs. Regulatory scrutiny or fines could be levied. Reputational damage suffered can be difficult to recover.


Who should be part of the planning process?

The person heading up the business continuity program should have a job at the airport that gives them an overall purview of how the airport works. That might be operations because the operations office knows what everybody does and what everyone’s responsible for. It might be an internal auditor. Often, it’s the finance department because finance touches everybody in terms of operating budgets and so forth. It may be the risk manager because the risk manager has an inside view of all the risks at the airport and because he or she has to arrange insurance and perform risk management planning. Often, it’s someone on the administrative side. It’s rarely advisable for someone in public safety or in ARFF to coordinate BCP, because these job functions are emergency, safety, security and crisis response-oriented, and they may not know the rest of the airport operational processes the way an internal administrative or oversight group might.


What process should airports follow in business continuity planning?

This process and recovery framework are part of our project deliverables. The results of the TRB project were a guidebook and software tool, which have been published by the TRB and can be downloaded or purchased directly from the TRB at http://onlinepubs.trb.org/onlinepubs/acrp/acrp_rpt_093.pdf. The software application is available on CD, which accompanies the guidebook entitled “Operational and Business Continuity Planning for Prolonged Airport Disruptions.” The guidebook includes a discussion about what business continuity is, how to build a business continuity plan, and how to keep it up to date. We developed both tools specific to the airport operating environment, and flexible enough to work for small airports, general aviation facilities, and FBOs on the one hand, and large, complex airports on the other. We encourage airports everywhere to add BCP to their strategic plans, and to get started by using these tools.