SARS a wake-up call for business? While public health or bio-terrorism threat management is beyond the scope of most business leaders, this should not be an excuse for inactivity. A crisis management consultant argues that taking proactive steps can better prepare companies for survival.

Given the current environment, it's reasonable that we all probably have some degree of concern about threats to our personal health and safety. And, while terrorist threats (including weapons of mass destruction, or WMD), random violence (Washington, D.C., and West Virginia snipers) and contagious diseases (Severe Acute Respiratory Syndrome, or SARS) concern most people, the degree of concern and effect on behavior is largely a function of how they perceive risk.

Individuals usually underestimate known risks, such as vehicle accidents, but often overestimate individual risk when it involves unknown types--the "devils we don't know." The D.C.-area sniper incident last year was a largely unknown and unfamiliar risk. Once the sniper's pattern began to develop, decisions made by individuals and organizations were potentially an overreaction, although emotionally understandable.

Schools were closed and events were moved or cancelled. Some parents kept their children home from school--protective actions perceived to be a safer alternative. Yet, an objective analysis of the sniper threat might show that children were more likely to die in a home fire or vehicle accident or suffer some form of violence in their neighborhood, when compared to the very low individual risk of being the sniper's target.

Lesson for Business: Planning Gaps

What is the lesson for business? Faced with an unknown risk that they do not understand, employees will likely focus on their personal and family security first, be overly conservative and likely take time away from work --which can hurt productivity.

Why should management take a new perspective to current risks? While about 50-80 percent of companies have considered the risks to their business and have developed a variety of contingency plans, many of those plans are based on the world that existed prior to 9/11 or the world as we hope it will be following a successful war on terrorism.

Often, the plans underestimate the likelihood of a catastrophic event, citing it "likely, but it won't happen to our company." Most of the plans are focused on recovering processes and facilities, with less attention to protecting or recovering the most important asset--people.

Even those companies that recognize the exposure to their employees often plan for a specific contingency, but perhaps not the contingency that is going to cause the most severe consequences.

While contingency-specific plans (hurricane/earthquake preparedness) are useful, it is unlikely that they prepare companies for threats that do not have the same characteristics or the same type of consequences. For example, traditional building life-safety plans (fire/explosive device) are generally built upon a rapid evacuation philosophy. Such procedures misapplied in a terrorist scenario--chemical weapons or a "dirty" bomb-might place more people in harm's way than they protect.

Traditional business continuity plans assume that employees are healthy, can travel and are willing to travel and be separated from their families. These assumptions may be realistic if there is a severe fire or flood. In a wide-scale event, such as a 9/11, extended power outage or terrorism, these may be unrealistic assumptions. SARS is a good case study.

Unexpected Consequences: The SARS Case

SARS is an example of how a naturally occurring or intentionally caused disaster--a disease, in this case--can create unexpected consequences. Following the SARS outbreak, Far East business travel and tourism declined sharply, many businesses were closed, home quarantines were imposed and the disease spread from the Far East to North America.

The market cap of some airline and travel-dependent companies reportedly declined significantly when much travel was curtailed. The Wall Street Journal estimates the economic impact to Asia's 2003 GDP will exceed $10 billion. And, this economic impact is in response to a disease that has infected a few thousand people and resulted in less than one thousand fatalities globally.

Preliminary findings indicate that for individuals in close contact, SARS is a highly contagious but not uniformly contagious disease. The mortality rate has been estimated as high as 15 percent of infected patients globally, and higher in the elderly population and those without access to advanced medical treatment.

Many of the secondary transmissions were to health care workers and other hospital patients, who appear to be at higher risk. Once global health and infectious disease resources were mobilized, effective identification, containment and treatment strategies were developed. However, this took an extended time and was not in place until months after the initial outbreak.

If we consider SARS as a slower-moving and less lethal proxy for a more significant bio-terrorism incident, it yields many helpful lessons for public health officials, as well as business leaders. Some lessons learned (or relearned):

* Contagious diseases can spread very quickly, regardless of attempts to control them.

* Government officials may not be aggressive in attempts to contain the disease due to the fear of causing panic, compromising their economic interests or exposing the limitations of their medical/public health capabilities.

* Early and effective information sharing is necessary to mobilize the global health resources necessary to isolate and identify the suspected cause.

* The process for detection and identification can take significant time, during which the disease, precautions and treatment remain largely unknown or not well defined.

* International travel can rapidly spread these types of diseases. SARS spread from China to Canada in a few days after travlers had been exposed.

* The medical community has limited capacity for dealing with large-scale outbreaks--isolation rooms, decontamination capabilities, protective clothing--even in highly industrialized countries.

* Bio-terrorism preparedness plans are well-intended but probably inadequate for most significant events. One hospital reportedly was going to lock down its facilities and rely on local police to secure its entrances and local fire service personnel to decontaminate victims outside the hospital. Will these public safety resources be available in a large-scale event?

* Quarantines do not work particularly well and are weakened by a highly mobile society and 24/7 real-time communications. If people exposed to SARS--which has a relatively low mortality rate--and those under home quarantine skip out of the country, what would likely happen with people exposed to a disease with a very high mortality rate (greater than 60 percent for some bio-terrorism agents)?

* Isolation, quarantine and other actions by civil authorities may create unintended backlash from individuals or groups that believe their civil rights have been violated (breaking quarantine, violence against civil authorities, theft of drugs/medical equipment). Are public safety agencies and businesses prepared for these contingencies?

The U.S. Homeland Security exercise (TopOff2), conducted earlier this year, demonstrated that we are better prepared than a few years ago, but significant room for improvement remains across all sectors.

Businesses Can Prepare Better

Businesses can learn from the lessons made very clear to public health/emergency services. Potential threats to businesses can be more severe and spread wider than isolated incidents like 9/11.

For example, an unknown disease may be spread through shipment of imported products. In such a scenario, international shipping and domestic rail shipping might grind to a halt or be stopped by governmental action.

Traditional planning may not be responsive to threats that involve a larger geographic area or an extended time period. The recent blackout that effectively lasted one business day caused an estimated $4-6 billion in losses. What if it had been caused by a a terrorist act, or if it affected a larger geographic area?

While most businesses plan for the acute and isolated event that they may have experienced before, this era of terrorism and asymmetrical warfare calls for all asymmetrical response capability that is not built on static or historic assumptions.

Businesses need an integrated and flexible crisis management plan to guide senior management in focusing the company's response to an unexpected and potentially devastating event.

Even those companies that have plans to provide counseling or physical/financial assistance to employees in the aftermath of a crisis overlook the greater business risk--that employees simply will not be willing or able to report for work in a widespread threat scenario like a weapons-of-mass-destruction attack. Following 9/11, many people were unable to work due to psychological trauma, fear of the unknown, family commitments or pressure and other indirect causes.

Planning must take into account the business-ending implications of the various human impacts from a terrorist event. For example, planning should include alternate staffing contingencies, as well as staff education and "hardening" in preparation for such an event. Helping employees develop family emergency plans in advance and providing specific plans for communication with families will also help in this regard.

While it's impossible to eliminate the risks of bio-terrorism and other terrorist events entirely, business leaders can take actions that will provide some additional assurance to their employees and their families. These actions will have an immediate and long-term positive effect on the business. They also work well for other events that are not caused by terrorists.

And, while public health or bio-terrorism threat management is beyond the scope of most business leaders, this should not be an excuse for inactivity. The proactive steps outlined above, along with advice from experts, can better prepare companies for survival.

James M. Connolly is Chief Operating Officer, Crisis Consulting Practice, for Marsh Inc. He can be reached at James. M.Connolly@.marsh.corn.

A few of the questions for business leaders to consider:

* Do we have a corporate crisis management plan and a team prepared to manage the strategic issues facing the business due to an unknown and somewhat unexpected threat?

* Do our plans recognize that our people are the most critical asset and often the most difficult to replace?

* Is our planning for the human impact on our employees and contractors as robust as our planning for our facilities and IT infrastructure?

* Do our plans consider the employee's family members? Personnel will be far more ready to perform tasks under extreme conditions if they have some assurance that their families are protected.

* Are our business unit and site-level business continuity and emergency response plans likely to be effective for non-traditional exposures (WMD, contagious disease, terrorist bombing)?