Ask the Expert: What Should We Think About After an Incident to get Back to Normal?

November 10, 2020 | 3 min read

It’s human nature: after a traumatic incident, we want to get back to normal. That’s as true of businesses as it is of individuals. When an incident happens — an accident, a weather incident, or an attack, such as an active shooter — many businesses' focus is on rebuilding and getting back to normal.

But what does “back to normal” really mean, and is it possible for businesses to return to the status quo after a major security incident? This post will go deeper into what happens when there’s an incident, how businesses should think about recovery once a threat is over.

Ask the Expert: How Do I Identify If an Incident Is Probable?

Remember: response is not synonymous with recovery

When there’s a security incident, the first things most people think about are the things that need to be done immediately: evacuating a site during a flood, for example, or calling the police when an attack occurs. It’s important to understand that items are part of an organization's response. They are not part of recovery. They’re the things a business does when a threat is actually happening. Recovery is what happens when the threat is over.

Recovery is often given a short shift. We spend so much time trying to prevent risks from happening and later responding to the threat that does happen that we can forget about what happens after a threat occurs.

In the security industry there are two areas we focus on after an incident: adaptation and recovery.


Adaptation is the process of making changes to your business so that you can move forward, despite a disruptive security event.

For example, if a company’s primary manufacturing facility is in the path of a devastating storm, the company may choose to increase production at a different plant while the first factory is rebuilt. Office workers who normally work at that plant may be able to work from home. In this way, the organization can remain productive while recovering.

How an organization adapts depends on the incident that affected it in the first place. In the case of an active shooter, it’s important to consider personnel issues, such as whether employees will feel safe returning to work. In that case, you may need to adapt by offering support like counseling or support hotlines.


Recovery is often what we think of when we think of “going back to normal.” During the recovery phase, you’re moving out of crisis, rebuilding, and carrying on after a tragedy.

There’s a lot of grey area involved in the recovery phase; you might be tempted to think of recovery as a return to the way things were. But often with trauma, that isn’t completely possible. A traumatic event often forces organizations to do things differently than they did before.

Take the manufacturing plant that was hit by a storm, for example. For that organization, “recovery” might mean reopening a renovated facility that’s better able to withstand a flood. It may also mean deciding that the factory, which long sat in a flood plain, should not be opened, and permanently relocating its plant. For the organization impacted by an active shooter, the recovery phase may be even longer, as legal proceedings take place, employees deal with lasting trauma, and security plans are adjusted so that no similar events can happen in the future.

How can you prepare for an active shooter? 5 best practices

Recovery takes time

While an organization’s response happens immediately, recovery is a process. It’s a learning curve that doesn’t take you “back to normal” but instead helps your organization to find a new normal.

Adaptation in particular can take a very long time. It can be one of the longest periods of a traumatic event, and there is no set timeline for an organization to follow. You must move through both adaptation and recovery at your own pace.

The most important thing to understand is that recovery isn’t about going back to the way things were. It’s about finding a new way to fulfill your organization’s mission.

Do you have a security project you need help with? Schedule your personalized demo today.

Are you ready to improve your organization’s risk management?

See Circadian Risk In Action Now
Schedule FREE Demo