New U.S. Law Creating a Voluntary Certification Program for Corporate Preparedness & the Opportunity to Advance Key Incentives for Business

Executive Summary:   Legislation was signed into law on August 3, 2007 that requires the U.S. Department of Homeland Security (DHS) to provide for the development of a private sector led voluntary certification program for all-hazards business emergency preparedness.  This program is to be developed in consultation with key stakeholders reflecting existing best practices and standards.  The program represents a significant opportunity to link preparedness activities by business with bottom-line market based incentives.

The Law:  The law is titled ‘‘Implementing Recommendations of the 9/11 Commission Act of 2007’’ and is also referred to as H.R. 1 and Public Law 110-53.  Title IX of the Act addresses private sector preparedness and the certification program.  Full text of the law is available at:  http://www.govtrack.us/congress/billtext.xpd?bill=h110-1&show-changes=0

Key Points of New Program and Legislation:   

  • Goal of the program is to provide a method to independently certify the emergency preparedness of private sector organizations including their disaster/emergency management and business continuity programs.   The program focuses on certifying the preparedness of businesses and other private sector entities and does not involve any individual professional certification.  The focus is on all-hazards preparedness and does not focus on terrorism.
  • The program will be voluntary.  Businesses will decide whether or not they wish to obtain certification of their organizations’ preparedness, likely based on what benefits they see in such certification.  There is no legal requirement to participate.

  • Key stakeholders are invited to participate in the development of the program.  Consultation with a variety of organizations and various sectors is required by the legislation. Program development will likely include involvement by a diversity of private sector advisory groups and others.

  • The program will be administered outside of government by third party organizations with experience / expertise in managing and implementing voluntary accreditation and certification programs.  The federal government will not run the accreditation / certification program. 

  • One or more preparedness standards can be designated. NFPA 1600 referenced as example.   The law calls for the adoption of “one or more appropriate voluntary preparedness standards.”  It further states that “The term ‘voluntary preparedness standards’ means a common set of criteria for preparedness, disaster management, emergency management, and business continuity programs, such as the American National Standards Institute’s National Fire Protection Association Standard on Disaster/Emergency Management and Business Continuity Programs (ANSI/NFPA 1600).’’ 

  • Existing industry efforts, certifications and reporting in this area will not be duplicated or displaced but rather recognized and integrated:  The legislation requires that the program consider the unique nature of various sectors within the private sector, including current preparedness certifications and reporting as well as existing initiatives by other federal agencies.  The legislation specifically calls for existing certification and related efforts be acknowledged and given credit in the process to avoid duplication.   It further calls for any designated standards to be tailored to address the unique nature of various sectors within the private sector.

  • Special consideration will be made for small businesses.  The program is to establish separate classifications and methods of certification for small business concerns as appropriate.

  • Proprietary and confidential information is to be protected:  The certification process is to protect information that is proprietary and confidential to the business. In addition, DHS may make public the listing of certified private sectors entities, only with the business’ consent.

  • The federal government has four basic tasks in establishing the program:

1.      DHS will designate one or more organizations to act as the accrediting body to develop and oversee the certification process, and to accredit qualified third parties to carry out the certification program:   In consultation with key stakeholders, DHS is to designate one or more third party non-governmental organizations based on experience and expertise in accreditation and certification processes.  This decision is independent of the actual standards to be utilized in assessing preparedness and likely will focus more on capacity to manage and support the accreditation process.

2.      DHS will separately designate one or more standards for assessing private sector preparedness:  In consultation with key stakeholders, DHS will also separately designate one or more voluntary preparedness standards that each third-party certification body will use to assess preparedness. The standards may be sector specific and must include separate considerations for small businesses.

3.      DHS will provide information and promote the business case for voluntary compliance with preparedness standards.  Businesses must be aware of the program and see value in it to participate in the program.  DHS will provide information to the private sector regarding voluntary preparedness standards and the business justification for preparedness.  The Department will promote to the private sector the adoption of voluntary preparedness standards.

4.      DHS will monitor the effectiveness program on an ongoing basis. DHS will annually review the accreditation and certification program to ensure its effectiveness, including the operations and management of any the accreditation and certification bodies, and the standards designated, and must make improvements and adjustments to the program as necessary and appropriate.

 InterCEP’s Assessment of Key Considerations Going Forward 

  • Market-based incentives may develop as the certification will provide a way to confirm that a business is prepared so it may be rewarded.  A major rationale cited in the testimony for the program was the need to enable a closer link between preparedness and benefits for business.  Key stakeholders in such areas as insurance, legal liability, rating agencies and supply chain management have generally acknowledged that business preparedness is valuable and should be rewarded but to date there has been no widely accepted methodology to confirm that preparedness exists in a business so that it could be rewarded.  This program could supply such a method.

  • Businesses and their representative associations must be actively involved from the beginning in the development of the certification program and its ongoing operation.  In order to assure that the ultimate certification program has true value to businesses, business and key stakeholders must have ongoing input into the program.  Key issues related to the certification program that should be addressed include but are not limited to:

o   Potential value of the certification process for internal self-assessment of preparedness activities by the business, conducted in addition to any third party assessment for certification purposes.

o   Use of certification as a consistent tool to promote supply chain resilience and to avoid the necessity of customers to do their own assessments of critical suppliers

o   Use of certification as a proactive strategy to minimize legal liability post-event

o   Use of certification in support of corporate governance and social responsibility activities

o   Integration with other business reporting requirements where practicable to avoid duplication and potentially integrate divergent requirements under one program

o   Potential TRIA considerations

o   Capitalize on existing management system activities where they exist in the corporation to facilitate conformance (e.g., quality and environmental management)

o   Assurance that the ultimate program is scalable and of value to small, medium and large businesses.

  • Potential external incentive providers must also be involved from the beginning in the development of the certification process and its ongoing implementation.  The program must be structured such that the final assessment is of value to them and facilitates their provision of market-based incentives.  Input from and involvement of the following key stakeholders should promote recognition of the preparedness certification in their respective activities: 

  •  
    • Insurance industry
    • Rating agencies
    • Legal community
    • Supply chain management
    • Internal and external auditors
    • Risk management 
    • Others as appropriate
  • Experience from similar but more established voluntary certification programs should be tapped for insights into program development:  Similar voluntary assessment and certification programs have been utilized on a voluntary basis for some time in quality management and environmental management. While the legislation clearly does not call for a management systems approach and many businesses opt for a more program element approach, historical experience and lessons learned with the voluntary certification element of these programs could provide insights into the development of the preparedness certification program. 

  • In designating one or more preparedness standards for use in the program, a “constellation of standards” should be evaluated.  Where there are more than one acceptable existing preparedness standards with significant value to one or more business sectors, consideration should be given to structuring a certification process which accommodates the assessment of the business against one or more standards in a unified framework that acknowledges a common core of program elements and best practices.

The International Center for Enterprise Preparedness (InterCEP) The International Center for Enterprise Preparedness at New York University is the world’s first major academic center dedicated to private sector preparedness and resilience. Businesses and other private sector organizations set the initial mission of the Center and remain engaged on an ongoing basis in its evolution. The U.S. Department of Homeland Security provided the initial funding for this initiative to create a truly international resource for education and research in this vital area.  The Alfred P. Sloan Foundation provides core funding for the ongoing advancement and development of business incentives for corporate preparedness and resilience.  

InterCEP’s Director, Bill Raisch, was private sector advisor to the Federal 9/11 Commission which advocated both a voluntary standard for preparedness and market-based incentives to encourage compliance with the standard.  The Center has continued to advance the private sector recommendations of the Commission and promotes the identification of financial and other impacts of emergency preparedness on businesses.  A core focus of InterCEP is the business case for business preparedness including both internal benefits to the corporation as well as external incentives from the market.

With respect to this new accreditation and certification program, InterCEP’s goal is to serve as an ongoing channel for key stakeholder input in the development and continuing operation of the program.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: