'Look at prevention, reaction, resumption'

Andrew Horne, Managing Director, Xerox India, is not only a corporate veteran at the American firm but also an alumnus of the Royal Military Academy who served for six years with the Royal Scots Dragoon Guards. He spoke to Kushan Mitra on how companies could be prepared for extreme eventualities like the recent terror attacks in Mumbai.

We run at least three fire drills every year so that our people know where the emergency assembly points are - Andrew Horne

There is a lot that has changed over the past two decades when it comes to companies being prepared for the worst. Insurance and corporate liability has played a major role in defining the new preparedness. Every major company in the world today has a crisis management plan for executives as well as assets and a business resumption plan in place. And it is not just terror that companies need to worry about, but also natural disasters like the one that hit New Orleans, as well as industrial accidents.

When it comes to terror, companies have to look at all three aspects—prevention, reaction and resumption. A company can seek to only deter an attack, because, at the end of the day, prevention is the responsibility of the state. We can act as a deterrent by implementing strict security and access standards and educating our employees about the importance of security.

At Xerox India, we have taken steps towards that —from increasing security and also drilling into guards the message that familiarity should not make security lax. Every person, from the juniormost service employee to the senior-most manager, should be subjected to the same level of security, there are no exceptions and there should be no exceptions. What if someone senior walks in with a bomb in his briefcase into an office or walks out with sensitive documents because terrorists or any other malicious people are holding his or her family hostage? Such incidents have occurred earlier.

You also have to explain to your employees the importance of these plans. Companies should audit both the crisis plan and the resumption plan, either virtually or through practice. We run at least three fire drills every year so that our people know where the emergency assembly points are and we can safely do headcount checks.

Your plans have to be robust, but you also need to be pragmatic, and sometimes you do need to have a ‘Plan B’. Most importantly, leadership has to be sharp and decisive. As for business resumption, the emotional trauma of an attack notwithstanding, we have to make sure that business goes on. We still need to send out invoices and products and service customers.

Regarding the Mumbai attacks, I do not think it is fair to single out any one country as being more dangerous to do business. Attacks have taken place across the world from Moscow to Bali and Madrid. As a British national, I did know people who were affected by the London bombings. Terror is not a localised phenomenon, and, therefore, for multinational companies, you have to look at terror as a global issue.