Strategic Risk Begins After the Emergency Ends

The Second Disaster

In risk management, we devote significant time and resources preparing for emergencies. Organizations conduct tabletop exercises, develop crisis communication plans, establish evacuation procedures, identify critical operations, and invest in insurance to protect their financial interests. Municipalities develop emergency operations plans, establish mutual-aid agreements, and prepare for their communities' immediate needs. All of these efforts are necessary and worthwhile, but what often receives far less attention is what happens after the emergency has passed. Responding to a disaster is largely operational; recovering from one is fundamentally strategic.

The immediate priorities are relatively clear: protect lives, stabilize the situation, secure damaged property, restore essential services, and communicate with stakeholders. Once those objectives are addressed, however, leadership faces an entirely different set of decisions.

• Can employees return to work?
• Can residents return to their homes?
• Will customers stay with the organization?
• Are suppliers still operating?
• Can the community continue providing critical services?
• Do we have enough cash while insurance claims are being adjusted?
• Should we rebuild exactly what was lost, or is this an opportunity to build something different?

These questions extend well beyond the emergency response itself and require leadership to balance financial resources, operational needs, employee and community considerations, customer expectations, and the organization's long-term objectives—often while information is incomplete and circumstances continue to change.

Insurance Is an Important Tool—Not the Recovery Strategy

Insurance plays a critical role in organizational resilience, but it is frequently misunderstood. Too often, organizations view insurance as synonymous with recovery; it is not.

Insurance provides capital to support recovery and can fund repairs, replace lost income, cover additional expenses, and provide the liquidity necessary to begin rebuilding. A well-designed insurance program can make an enormous difference in an organization's ability to move forward after a loss, but insurance is not the recovery plan.

My experience working through claims has reinforced this distinction: The claim itself can become a significant undertaking, often requiring detailed documentation, adjustment, negotiation, and time. At the same time, the organization must keep operating, communicate with stakeholders, support employees, maintain customer relationships, and make major financial and operational decisions.

Insurance cannot make those decisions and cannot replace customers who leave during a prolonged disruption, retain employees who decide their future lies elsewhere, rebuild organizational culture, restore disrupted supply chains, or repair damaged stakeholder relationships. Even the most comprehensive insurance program cannot overcome inadequate planning, unclear decision-making, or a lack of operational flexibility during an extended disruption.

In my experience, organizations rarely struggle simply because they lacked insurance. More often, they struggle because they underestimate what recovery will require—how long it will take, how many decisions must be made, and how many parts of the organization will be affected. Insurance funds recovery; leadership manages it.

Every Organization Has a "Day 30"

Many organizations prepare extensively for the first 72 hours: Business continuity plans establish immediate priorities, disaster recovery plans focus on restoring critical systems, and crisis communication plans outline how information will be shared. Those plans are essential, but far fewer organizations devote the same level of planning to the weeks and months that follow, when recovery becomes less about response and more about leadership.

Eventually, the emergency operations center closes, and the media moves on. Temporary solutions become permanent realities, and employees begin dealing with their own personal challenges. Customers want answers, and residents want services restored. Contractors may be difficult to find, supply chains remain disrupted, and financial pressures begin to mount. This is "day 30."

The emergency may no longer be visible, but the organization is still operating under the consequences of the loss. Insurance claims may still be in process, repairs may be incomplete, and leadership may be making decisions that will affect the organization for years.

This is where recovery planning often gets tested: The assumptions that seemed reasonable during a tabletop exercise can look very different several weeks into actual disruption.

Recovery Requires More Than a Plan

The organizations and communities that I have seen recover most effectively tend to share several characteristics: They understand their critical operations and dependencies before a disaster occurs, maintain enough financial flexibility to make decisions while other resources are tied up, establish clear decision-making authority before a crisis occurs, and regularly challenge their assumptions through realistic exercises and scenario planning. Perhaps most importantly, they understand that recovery is not simply about restoring what was lost; a disaster can create a decision point.

• Do you rebuild the same facility in the same location?
• Do you replace the same equipment with newer technology?
• Do you rethink your supply chain or geographic concentration?
• Do you change how employees work?
• Does a community rebuild the same infrastructure, or take the opportunity to make it more resilient?

Those decisions should not be made for the first time in the middle of a crisis and should be part of the organization's thinking before the loss occurs, which is where risk management has a role that extends well beyond insurance. Risk management should help leadership understand not only what can go wrong, but what the organization will need to make decisions when it does. That means connecting insurance, business continuity, financial resources, operations, human resources, communications, legal considerations, vendors, and other critical dependencies before the loss occurs. The goal is not to predict the future; it is to give leadership enough clarity and flexibility to navigate it.

The Measure of Resilience

Disasters do not end when the first responders leave; it is simply when the next phase begins. The headlines fade, outside assistance gradually disappears, claims move through the adjustment process, contractors come and go, employees return to work, and customers and residents begin asking when things will truly return to normal. But "normal" may no longer be the right objective. The organizations that recover most successfully are not necessarily those that experience the least damage. They are often the ones that understand recovery as more than rebuilding what was there before.

A major loss can expose weaknesses that were difficult to see during normal operations. Perhaps the organization was too dependent on a single facility, supplier, system, or geographic region. Perhaps its business continuity assumptions did not reflect operational reality. Perhaps its insurance program provided financial protection but did not contemplate the full scope or duration of the disruption. Or perhaps leadership simply discovered that recovery required decisions no one had previously considered. Those lessons can be difficult, but they can also create an opportunity.

The strongest organizations use the recovery process not only to repair what was damaged but to reconsider how they operate, where they were vulnerable, and what they can do differently next time. That is where preparation becomes resilience.

Preparing for the event itself will always be essential, but preparing for what comes after may be even more important, because after the dust settles, recovery is no longer about surviving the disaster—it is about leading through what comes next.