When an unexpected disaster occurs, people immediately ask: How could this happen? Who was responsible? Where do we go from here?

Having worked for decades in the chemical industry, including acting as chairman of the U.S. Chemical Safety Board (CSB) and a consultant in chemical plant and oil refinery safety worldwide, I have seen my share of disasters. I have also seen my share of responses. On June 8, as keynote speaker of the World Conference on Disaster Management in Toronto, I’ll be sharing some of the top mistakes companies make in a disaster and how to avoid them.

Disasters can take many forms, from natural disasters such as the fires in Fort McMurray, to the train derailment in Lac-Megantic and the 2008 U.S. financial crisis, to malicious cyber-attacks on retailers and terrorist attacks on commercial airliners. I personally have witnessed a chemical plant explosion (I was working there at the time), and investigated the catastrophic 2010 BP explosion and oil spill in the Gulf of Mexico as well as multiple fires, explosions and toxic gas releases that caused severe damage and fatalities. Here is what I have learned is essential for companies to do to prepare for the worst:

Create a plan: It is absolutely essential that a disaster plan be put in place and that all employees know what their responsibilities are in case of a disaster. Take all the time you need to prepare for the disaster and provide ongoing disaster planning training to all employees.

Eliminate risk: Understand the difference between hazard and risk. A hazardous activity, for example, could be climbing a ladder at home. The risk associated with climbing a ladder is the possibility of falling and getting injured or killed. The risk can be reduced or eliminated by adhering to the known safe practices for climbing a ladder. It’s the same in business – know your hazards and then take all the steps necessary to reduce or eliminate the risk.

Be prepared: The best defence against a disaster is to prepare for it. Have experts in place who understand your business processes, know what the potential for a disaster is, and can implement procedures to prevent a disaster. In a chemical plant, this would be the technical experts in metal fatigue, corrosion or chemical reactivity who understand the details of the process. In the aviation industry, planes are designed to not have one point of failure and pilots are trained to a high level of skill to deal instinctively with in-flight emergencies. There is a great awareness today of the potential for cyber-attacks from outside a business, and diligent companies have programs to defend against such attacks.

Involve outsiders: Get to know your stakeholders, the communities around your facilities, the emergency responders, and the local political and community leaders. Develop an ongoing relationship with them, invite them to tour your facilities and even encourage your management team to live in nearby communities. It will be too late to get to know your local fire department when they are on their way to deal with your emergency.

Rely on advisors: Forming a community advisory panel made up of first responders, community representatives and health officials who meet regularly with facility management to discuss issues of mutual interest is a common practice in the chemical industry. For other companies, it may be Information Sharing and Analysis Centers (ISACs) to help combat cyber security threats. Major retailers who had customer data breaches, formed ISACs to ensure information sharing among retailers, law enforcement and other stakeholders.

Be media-savvy: Send your managers for training on how to answer tough questions that will be asked by print or television reporters in the event of a disaster. Pick a spokesperson that is empathetic to the concerns of local neighbors and who is able to explain complex issues honestly and in a way the public understands. In today’s world, you also have to deal with social media – Facebook, Twitter, Instagram etc. – to quickly and proactively disseminate messages and respond to posts.

Set aside resources: If you do have a disaster, you will shocked by the time and resources required to get your operation up and running again. There is the actual physical rebuilding of your operations but you will also have to deal with investigative agencies, regulators, attorneys, insurance companies and many others. A serious incident can suck the oxygen out of your company for a year or more as you are trying to rebuild your business and your reputation.

The bottom line of disaster response is to predict what could happen, prepare an appropriate response, run drills to practice that response and if a disaster happens, respond professionally. After the disaster, evaluate your preparedness and response and decide what you could have done differently.

Published Monday, Jun. 06, 2016