A Rolling Disaster – Summer 2008 Flooding
By Roger Peters

The question “who would have thought?” arises as we look back at events that have occurred since the 12th annual Disaster Resource Guide was published. Severe flooding in the Midwest, over 1,700 fires burning in California during July, an earthquake in Illinois, shipping shut down for an extended period on the Mississippi, production lines shut down due to the bankruptcy of a key supplier, record oil and grain prices, and the subprime mortgage meltdown are only some of the events that have impacted us during the past year.

These events highlight the need for ongoing risk assessments, asking tough questions, and taking hard looks at strategies that were “good enough” in the past. Rethinking our mitigation strategies and implementing new methods may be the key to keeping our organizations operating if the unthinkable strikes.

The varied types of threats mentioned above stress the criticality of incorporating business continuity planning into enterprise risk management programs to reduce business risks. Each one of these events presents an opportunity to severely disrupt operations or destroy businesses. This article will touch on some key issues of the flooding that struck the Midwest during June this year. The article will largely focus on the Iowa floods, though Illinois, Wisconsin and Missouri were also impacted by the flooding. [See the article on ERM in this year’s issue: http://trendmag.trendoffset.com/publisher/disaster/Disaster_Resource_Guide/issue2/
magazine.php? mag=Disaster_Resource_Guide&page=&type=2&logo=0&issueid=4052.]

The Build-Up
Northern and eastern Iowa received heavy rains and storms during late May and early June. One of the more notable storms that helped contribute to saturated ground was a severe storm that led to an EF-5 tornado that struck Parkersburg, Iowa, on May 25. Approximately half of the town of 1,800 was destroyed, an event that would have been much worse had it hit the Cedar Falls/Waterloo area about 15 miles to the east. This tornado was estimated to have had winds up to 205 MPH and it left a path of destruction 43 miles long and over a mile wide at times. Heavy rains, large hail and high winds also accompanied the storm. Additional storms in the following days left the ground saturated with water and rivers rising.

Trickle-Down Effect
Very heavy rains on the evening of June 7 and following days were more than the drainage system could handle. Eastern Iowa rivers drain to the Mississippi, generally flowing to the southeast. Flooding in northern Iowa created an impact in many cities downstream; this event ultimately closed shipping on the Mississippi and caused flooding as far south as St. Louis.

Flooding generally causes extensive damage through contamination and structural damage to facilities. Runoff from farming areas contains pesticides, herbicides and fertilizers. Flooded areas in communities often pick up additional chemicals, fuels and waste water from treatment plants. Buildings must be disinfected, often resulting in significant delays for safe reentry. Mold often begins to take over before disinfection can be completed. Buildings often require inspections to make sure they are structurally safe after flooding. Basement walls frequently collapse due to the high pressure outside the walls and floating debris may have also damaged the facilities. Workforces can be disrupted for extensive periods when people must deal with personal disasters as well as business disasters.

A total of nine river systems were involved with the floods, all of which drain into the Mississippi. Many communities along the river experienced flooding and levees failed in Illinois and Missouri as the water moved downstream. Locks on the Mississippi had to be closed, halting shipping on 281 miles of the river on June 15. The river went ten feet over flood stage in St. Louis and after the crest passed, the last lock reopened on July 5.

After the Floods
Damage from the floods has had a significant economic impact that will be felt for years. The Iowa Department of Transportation released a report on July 16 that indicated a total of 464 miles of primary highways, not including city and county roads, had to be closed during the flooding. Damages were incurred on 125 miles of primary highways and 303 bridges and culverts. Damage estimates will not be available until August.

Key Considerations
Several factors make flooding different from other disasters, since there may be a lead time prior to the event as illustrated by the downstream communities. These factors allow time to prepare if adequate consideration is given to the worst-case scenarios. Many of the risk mitigation factors also apply to other types of disasters or incidents. Organizations far from floodplains can experience localized heavy rains, broken water pipes or inadvertent flooding.

1. Review your risk assessment. Have you covered your risks adequately? What if events exceed expectations or mitigating controls fail? Can you recover?

2. Assess the impact of flooding on your staff. People continue to be critical factors in the recovery efforts and often more focus is placed on systems recovery than workforce recovery. During the summer floods, large numbers of volunteers were mobilized for sandbagging. Staff availability or productivity will be reduced through absenteeism or exhaustion both before and after the flood. Your business will probably be impacted by road closings, family needs, damages to employees’ homes that need immediate attention and related factors. Planning to operate with reduced staff is critical.

Staff cross-training is essential during recoveries. Staff should fully understand their department’s procedures and the needs of interdependent departments. Having a wide range of experience with your business needs at a recovery site can help to resolve issues that are identified during the recovery.

3. Review your facilities and look for opportunities to mitigate flooding risks. While your facility may never be exposed to several feet of water, a few inches could result from a broken water pipe, an accidental sprinkler discharge or extinguishing a fire within your offices or higher-level floors. Even small amounts of water can be very damaging to facilities, records and electronic equipment.

Walk through your facilities and observe items that would be damaged by a few inches of water. Plastic sheeting could reduce damage from sprinkler discharges in critical areas, but electrical risks need to be considered. Anything on the floor or stored in the bottom drawers of file cabinets are more likely to be water-damaged than in higher drawers.

Even if the power has been turned off, electrical cables can act as wicks, similar to those of a candle. Water on the floor can follow the cables into electronic equipment and damage it even if the systems are above water levels. Many data center wiring projects now utilize cabling coming down from the ceiling versus coming up from under raised flooring. Even a slight elevation above the floor may prevent serious damage from minor leaks.

Use of gas fire suppression systems instead of sprinklers helps to remove water threats. Moisture and temperature sensors provide early warning but are not utilized in many computer facilities.

4. Plan your facilities and records recovery strategies. Be ready to act rapidly when an event strikes.

Mold sets in fast and assistance may be hard to obtain in the event of a regional disaster. Both your facilities and records to recover need attention rapidly. Recovery contractors may be overwhelmed with requests and delays may occur.

Hot sites may fill as a result of a regional disaster and systems recovery may need to occur at a more distant location. Understand the travel limitations of your staff to make sure they can be available at an alternate site. The same considerations apply for workspace recovery. Family needs may override your recovery needs if significant travel is required.

5. Review your records retention practices. Knowing what to recover and what can be destroyed greatly reduces the cost of records recovery. Planning your strategy and selecting a recovery vendor in advance can reduce delays and help contain mold growth.

6. Review your communications systems. Maintaining methods to communicate with your staff and customers cannot be underestimated. Communication systems failures could hinder your recovery efforts and threaten customer loyalty. Voice communications are typically more difficult than computer systems to recover, though the trend to Voice over IP (VoIP) systems is creating new recovery options.

Don’t depend on your cell phones to work during a regional disaster; power may be off or the circuits could be overloaded for extensive periods.

7. Determine whether your technology can support your recovery time requirements. Many new advancements have occurred over the past few years that can reduce operating costs while enhancing recovery capabilities. Some of the enhancements include:

• Storage area networks technology allows disk storage to be shared across multiple systems. Systems management, storage utilization and backup capabilities are enhanced while recovery windows can be reduced.
• Server virtualization utilizes software to consolidate server applications and systems. The ability to support multiple servers on a single computer reduces the number of physical servers that must be restored. Administration capabilities are enhanced and recovery windows can be shortened.
• Data replication capabilities have matured substantially during the past few years. Hardware prices have dropped significantly, and maintaining a remote hot site is significantly more attractive than in the past.
• Virtual private network (VPN) technology has allowed many organizations to enhance their use of the Internet to securely access their systems from homes or remote locations. Many organizations have already expanded their systems access.

8. Review your business processes to determine if they can be enhanced while increasing efficiency or reducing complexity. Increased utilization of paperless business processes, imaging and related technologies can reduce the dependence on working from a physical office or having departments work in close proximity due to workflow processes.

9. Understand your supply chain risks. Flooding can disrupt supply chains and business operations. While your facilities may not have been damaged, key suppliers or shipping methods may have been impacted. Just-in-time supply strategies are not forgiving and you could be affected by events impacting your suppliers, customers or transportation companies.

10. Test your plan to determine if it is viable. Testing will provide major benefits if a recovery is necessary. Having expertise across your organization will only help, especially if transportation or other issues prevent key staff from being able to assist with your recovery.

The Muskrat Theory
A take-away from the floods is a concept I call the Muskrat Theory. Hundreds of people battled the water in Winfield, Missouri, as they built a levee to hold back the water. Despite their valiant efforts, a homeless muskrat, with no apparent terrorist ties, burrowed into the levee and caused a 30-foot-wide breach as the water flowed through the weakened barrier. The end damage was as significant as if the event had been planned for months and skillfully executed by an attack team. We can make extensive plans and test them under “normal” conditions, but we could miss that “muskrat,” the small thing that could derail our plans. Ask the hard questions, the ones no one would have thought about: What if the water is 12 feet above record levels? What if a key person isn’t available for the recovery? Don’t let a muskrat beat you.

About the author
Roger Peters, managing director, leads RSM McGladrey, Inc.’s national technology risk management and business continuity consulting practices. He is based in Minneapolis and can be reached at (612) 376-9330 or roger.peters@rsmi.com.