Emergency Preparedness and Response

Back to Basics: Conducting a Vulnerability Analysis

Back to Basics is a new weekly feature that highlights important but possibly overlooked information that any EHS professional should know. This week, we examine emergency planning, and specifically, how to conduct a vulnerability analysis of your business.

If there’s one thing we’re seeing as the summer of 2021 wears on, it’s that disasters and emergencies can happen anywhere. Triple-digit heat waves in the Pacific Northwest, flooding in Arizona and Europe, building collapses in Florida, the list goes on and on. And that’s not even getting into the constant barrage of mass shootings that take place with regularity and unpredictability. If you’re an employer, you can’t just hope that emergency events won’t happen in your area. You need to have an emergency plan in place.

So if you’re not already familiar with the Emergency Management Guide for Business and Industry published by the Federal Emergency Management Agency (FEMA), you should be. It’s a step-by-step guide on how to create a business emergency preparedness program. It spells out the four steps of the emergency planning process:

  1. Establish a planning team
  2. Analyze capabilities and hazards
  3. Develop the plan
  4. Implement the plan

This week, we’re going to focus on step two, analyzing capabilities and hazards. This involves gathering information about your current capabilities and potential hazards and emergencies, and then conducting a vulnerability analysis to determine your capabilities for handling emergencies. The information gathering part involves:

  • Reviewing internal plans and policies (e.g., evacuation plan, fire protection plan, security procedures, etc.)
  • Meeting with outside groups (e.g., government agencies, community organizations, utilities)
  • Identifying applicable federal, state, and local regulations (e.g., occupational safety and health regulations, environmental regulations, fire codes, etc.)
  • Identifying critical products, services, and operations (e.g., company products and services, products and services provided by suppliers, lifeline services such as electrical power, water, sewer, and gas, and operations, equipment, and personnel vital to keeping the business going)
  • Identifying internal resources and capabilities (e.g., resources and capabilities that may be needed in an emergency including personnel, equipment, facilities, backup systems)
  • Identifying external resources (e.g., local emergency management office, fire department, hospitals, police, etc.)
  • Doing an insurance review

The next task is to conduct an analysis to assess the vulnerability of your business, which determines the probability and potential impact of each emergency. The process as outlined by FEMA involves using a chart (found in the FEMA guide) to assign probabilities, estimate impact, and assess resources using a numerical system. The lower the score, the better.

List potential emergencies

In the first column of the chart, list all emergencies that could affect your facility, including those identified by your local emergency management office. Consider both emergencies that could occur in your facility and those that could occur in your community.

Think about the types of emergencies that have occurred in your area (e.g., fires, severe weather, hazardous material spills, natural disasters, terrorism). Geography is a factor, including proximity to: flood plains, seismic faults, and dams; companies that produce, store, use, or transport hazardous materials; major transportation routes and airports; and nuclear power plants.

Technology is a major concern. What could result from a process or system failure? Possible problems include: fire, explosion, hazmat incident; safety system failure; telecommunications failure; computer system failure; power failure; heating/cooling system failure; and emergency notification system failure.

Human error is the largest cause of workplace emergencies and can result from poor training, poor maintenance, carelessness, misconduct, substance abuse, or fatigue.

Look at your facility’s design and construction to determine which types of emergencies could result. Consider the physical construction of the facility, hazardous processes or byproducts, facilities for storing combustibles, layout of equipment, lighting, evacuation routes and exits, and proximity of shelter areas.

What emergencies or hazards are you regulated to deal with? Consider what could happen as a result of: Prohibited access to the facility, loss of electric power, communication lines down, ruptured gas mains, water damage, smoke damage, structural damage, air or water contamination, explosion, building collapse, trapped persons, chemical release.

Add it up

In the probability column, rate the likelihood of each emergency’s occurrence. This is subjective, but still useful. Use a scale of 1 to 5 with 1 as the lowest probability and 5 as the highest.

Source: FEMA.

Look at the potential human impact of each emergency—the possibility of death or injury. Assign a rating in the Human Impact column of the vulnerability analysis chart, using a 1 to 5 scale.

Consider the potential property for losses and damages in the Property Impact column using the 1 to 5 scale. Consider cost to replace, cost to set up a temporary replacement, and cost to repair.

Assess the potential business impact on the 1 to 5 scale, looking at the impact of business interruption, employees unable to report to work, customers unable to reach facility, company in violation of contractual agreements, imposition of fines and penalties or legal costs, interruption of critical supplies, and interruption of product distribution.

Assess your internal and external resources by considering each potential emergency from beginning to end and each resource that would be needed to respond. If you don’t have the resources and capabilities to respond and don’t believe external resources will be able to respond as quickly as you’d like, you may need to develop additional emergency procedures, conduct additional training, acquire more equipment, establish mutual aid agreements, and establish agreements with specialized contractors.

Totaling the scores for each emergency will help you determine planning and resource priorities, which is covered in steps three and four of the emergency planning process.