When a café in Sydney’s central business district was under siege by a gunman, risk managers in the city rallied to assess the nightmare scenario and safeguard their staff. Trevor Treharne spoke to two who were on the scene.

On 15 December 2014, a lone gunman entered the Lindt Chocolate Café in the APA Building in Martin Place, Sydney, Australia.

In an act of terrorism, the man held 10 customers and eight employees hostage in what would prove to be a 16-hour standoff.

2014 Sydney hostage crisis, Martin Place, Sydney

Source: Maksym Kozlenko - CC BY-SA 4.0

2014 Sydney hostage crisis, Martin Place, Sydney

When a gunshot was heard within the café, police officers stormed the building. One hostage was killed by the gunman, another died from a police bullet ricocheting in the subsequent raid, and the terrorist was killed by police.

Three other hostages and a police officer were injured by gunfire during the raid.

Located in a busy business district, the attack impacted not only those in the direct vicinity, but as other terror attacks had proven to be coordinated in various locations, the entire city’s business community was put on alert.

Two risk managers in the city — Kevin Bates, group head of risk and insurance at Lendlease, and Eamonn Cunningham, then chief risk officer with Westfield/Scentre Group — had to react.

INITIAL RESPONSES

“On the day, the head of corporate affairs approached me and asked if I was aware of an event developing at the Lindt Café,” says Bates. “We called a meeting, which involved interrupting an ongoing meeting, to talk to the CEO about the situation.”

Bates says it was recommended that the company held a crisis meeting at its highest urgency level of red. “This meeting ensured that everyone was aligned, and we could discuss if something needed to be actioned. 

“We began with the scenario and discussed the various ‘what ifs?’ around the situation,” he said. “You have to consider how the gunman may act. If this person is looking to take human life, how might they do this?

“For example, what if this siege is a distraction to make office workers go home and then a major transport hub will be attacked?”

“We began with the scenario and discussed the various ‘what ifs?’”

Bates says such considerations then played into what Lendlease should do next – perhaps sending people home on public transport might be more dangerous.

“We have retail centres on George Street [which is near Martin Place], and we felt they needed to be moved without using public transport. So we hired a fleet of buses and chartered three ferries to get people home.”

Cunningham says Westfield had a very sophisticated event monitoring system in all regions, yet the news came from a more personal source.

“My instinctive reaction was on the likely scale and dimension of this incident.”

“The news initially came from my daughter, who is armed with a master’s degree in international security and then worked for a boutique security firm. That firm also had an event monitoring system,” he says.

“My instinctive reaction was on the likely scale and dimension of this incident. Did it, or was it likely to, spread beyond its single location in Sydney central business district?”

He adds that a major consideration was the very large Westfield shopping centre only about 500 metres from the café.

“My concern increased when my daughter called to say the black covering erected on the window of the café was the ISIS flag. By this time, Westfield’s global crisis management had been activated.”

RISK MANAGERS STICK TOGETHER

Bates says he called Cunningham to discuss the situation and ask how his organisation was handling matters.

“We decided that any employee that felt safer at home would be able to leave, but we also made sure that we were not creating bottlenecks in the city by performing the same actions,” says Bates.

“In these situations, there is often a lot of initial confusion, but the first priority was our employees and their safety.”

Bates says there was a series of calls with risk managers in the city during the event to exchange knowledge and discuss the best response.

“Kevin and I had a number of candid conversations during that incident and I remarked afterwards that if he had not called me first, I would have called him.”

Cunningham adds that the life of a risk manager can be a lonely one but you need to extend your professional external relationships to people in your industry who you implicitly respect and trust.

“Two of my strongest such relationships were with the risk managers of organisations who were actually fierce competitors of Westfield - Lendlease in Sydney and Simon Property Group in Indianapolis, US.

“These relationships, which involved regular dialogue, had the implicit approval of our respective CEOs. Kevin and I had a number of candid conversations during that incident and I remarked afterwards that if he had not called me first, I would have called him.”

Bates says one major note from the situation was that the organisation had not yet geo-located every employee’s home address, as this must be voluntarily given by the employee to the firm.

Having a response infrastructure, for example a crisis management team, that practices constantly is “absolutely worth its weight in gold”.

“We had this fleet of buses and three ferries at our disposal, but we did not know exactly where to send them. Do six go east, and six go west?

“After the event, we contacted all our employees and asked if we could now have these details. We do not use this information for anything else; this is purely for a crisis.”

Bates adds that after the event, the organisation built an online platform and training schedule around threats such as active shooters.

For Cunningham, there were four major takehomes. First, having a response infrastructure, for example a crisis management team, that practices constantly is “absolutely worth its weight in gold”.

“Never, ever forget to prepare an after-action report. There are always lessons to be learned”

Secondly, “have a dozen or so generic playbooks, one of which can be adapted to suit the circumstances encountered.”

The third is that while complete data and intelligence is perfect, sometimes you have to make decisions based upon limited initial information. “You can then always re-calibrate your actions based on better or more complete intelligence down the track.”

Cunningham’s fourth lesson is: “Never, ever forget to prepare an after-action report. There are always lessons to be learned so that you can improve your level of preparedness for the next time.”