The purpose of the what-if analysis is to identify specific hazards or hazardous situations that could result in undesirable consequences. This technique has limited structure but relies on knowledgeable individuals who are familiar with the areas/operations/processes. The value of the end result is dependent on the team and the exhaustive nature of the questions they ask regarding the hazards.

A specific checklist of items should be used to identify hazards and hazardous situations by comparing the current or projected situations with accepted standards.

The value of the end result is dependent on the quality of the checklist and the experience/credentials of the checklist user. What-if/checklist: This technique is a combination of the what-if and checklist techniques, and uses the strength of both techniques to complete the risk assessment.

The what-if questions are developed and the checklist(s) used to encourage the creativity of the what-if process, as well as fill in any laps in the process of developing questions. The value of the end result is dependent on the team and exhaustive nature of the questions they ask regarding the hazards.

Hazard and operability study (HAZOP): This technique requires an interdisciplinary team that is very knowledgeable of the areas/operations/processes to be assessed.

This approach is thorough, time-consuming, and costly. The value of the end result depends on the qualifications/experience of the team, the quality of the reference material available, the ability of the team to function as a team, and strong, positive leadership.

Failure mode and effects analysis (FMEA): Each element in a system is examined individually and collectively to determine the effect when one or more elements fail. This is a bottom-up approach; that is, the elements are examined and the effect of failure on the overall system is predicted. A small interdisciplinary team is required.

This technique is best suited for assessing potential equipment failures. The value of the end result is dependent on the credentials of the team and scope of the system to be examined.

Fault-tree analysis (FTA): This is a top down approach where an undesirable event is identified and the range of potential causes that could lead to the undesirable event is identified. The value of the end result is dependent on the competence in using the FTA process, on the credentials of the team, and on the depth of the team’s analysis.

The hazard identification should include the following types of potential hazards. This list is not all-inclusive but reflects the general categories that should be assessed in the hazard identification.

(1) Naturally occurring hazards that can occur without the influence of people and have potential direct or indirect impact on the entity (people, property, the environment), such as the following:

i. Earthquake;

ii. Tsunami;

iii. Volcano;

iv. Landslide, mudslide, subsidence;

v. Glacier, iceberg.

i. Flood, flash flood, seiche, tidal surge;

ii. Drought;

iii. Fire (forest, range, urban, wildland, urban interface)

iv. Snow, ice, hail, sleet, avalanche;

v. Windstorm, tropical cyclone, hurricane, tornado, water spout, dust/sand storm;

vi. Extreme temperatures (heat, cold);

vii. Lightning strikes;

viii. Famine;

ix. Geomagnetic storm.

i. Emerging diseases that impact humans or animals [plague, smallpox, anthrax, West Nile virus, foot and mouth disease, SARS, pandemic disease, BSE (Mad Cow Disease)];

ii. Animal or insect infestation or damage.

(2) Human-caused events such as the following:

i. Hazardous material (explosive, flammable liquid, flammable gas, flammable solid, oxidizer, poison, radiological, corrosive) spill or release;

ii. Explosion/fire;

iii. Transportation accident;

iv. Building/structure collapse;

v. Energy/power/utility failure;

vi. Fuel/resource shortage;

vii. Air/water pollution, contamination;

viii. Water control structure/dam /levee failure;

ix. Financial issues, economic depression, inflation, financial system collapse;

x. Communications systems interruptions;

xi. Misinformation.

i. Terrorism (explosive, chemical, biological, radiological, nuclear, cyber);

ii. Sabotage;

iii. Civil disturbance, public unrest, mass hysteria, riot;

iv. Enemy attack, war;

v. Insurrection;

vi. Strike or labor dispute;

vii. Disinformation;

viii. Criminal activity (vandalism, arson, theft, fraud, embezzlement, data theft);

ix. Electromagnetic pulse;

x. Physical or information security breach;

xi. Workplace violence;

xii. Product defect or contamination;

xiii. Harassment;

xiv. Discrimination.

(3) Technological-caused events that can be unrelated to natural or human caused events, such as the following:

In order to maintain continuity of operations, the entity should identify essential or critical functions and processes, their recovery priorities, and internal and external interdependencies, so that recovery time objectives can be set.

The five key principles of resource management that underpin effective resource management are as follows:

(1) Advance Planning. Entities work together in advance of an incident to develop plans for managing and employing resources in a variety of possible emergency circumstances.

(2) Resource Identification and Ordering. Entities use standardized processes and methodologies to order, identify, mobilize, dispatch, and track the resources required to support incident management activities.

(3) Categorizing Resources. Resources are categorized by size, capacity, capability, skill and other characteristics.

(4) Use of Agreements. Mutual aid/assistance agreements and pre-incident agreements among all parties providing or requesting resources are necessary to enable effective and efficient resource management during incident operations.

(5) Effective Management of Resources. Resource managers use validated practices to perform the following key resource management tasks systematically and efficiently:

(a) Acquisition Procedures. Used to obtain resources to support operational requirements.

(b) Management Information Systems. Used to collect, update, and process data; track resources; and display their readiness status.

(c) Ordering, Mobilization, Dispatching, and Demobilization Protocols. Used to request resources, prioritize requests, activate and dispatch resources to incidents, and return resources to normal status.

The 2007 edition of the National Fire Protection Association (NFPA) Standard on Disaster/Emergency Management and Business Continuity Programs is available for download at no charge at NFPA’s Web site. FSM