After the shaking stops, tenants need a floor-by-floor answer

Every Japanese property company has a business continuity plan, and most of them begin with the computers. The plan lists critical applications, gives each a recovery time objective and describes the second site, the backups and the people who will restore them. I helped write such a plan in 2012, the year after the Great East Japan Earthquake, and for almost a decade I believed it described what we would need on the worst day.

I no longer believe that. The first question a tenant asks after a strong earthquake is not whether our lease system is running. It is whether the building is fit to stay in or return to: which floors, which lifts, and when. On 11 March 2011 I watched alarms arrive from every building we owned on our monitoring centre's screens, and almost every telephone call over the next two days was a version of that question. We answered from engineers' notebooks, one call at a time, and some tenants waited a day and a half for an answer about a floor that had been checked within hours.

Recovery objectives written for the wrong reader

A recovery time objective is a promise to the people who use a system. For a ledger those people are our own staff, and the promise matters at month end. For a property company after an earthquake, the people who most need something from us are outside the company: about 2,300 tenant organisations and the people who work, shop or live in our buildings. What they need is information, and our plan had no objective for it at all.

When I became chief information officer in 2021, our infrastructure team was preparing a proposal for a second data centre in western Japan, so that lease, billing and accounting systems could be restored within four hours of losing the first. It would have cost about ¥1.2 billion over five years. On its own terms it was a sound proposal, and it met the group standard of four hours for every critical system. I asked my colleagues a different question. If a strong earthquake struck at ten in the morning, what would a tenant need from us at eleven, and which of our systems would supply it?

None of them would have. The lease system knew our tenants' contracts managers, not the people responsible for their staff's safety. Each building's management system reported equipment alarms to its own screen and to the monitoring centre, but nobody held a list, by floor, of what had been inspected. We would have restored the ledger within four hours and still been answering the telephone from notebooks.

So we changed the plan. Lease and accounting systems moved to cloud infrastructure with recovery in another region and an objective of forty-eight hours, at about a quarter of the cost. Our finance department accepted that an earthquake near month end might delay invoicing, and the group's internal audit function accepted an exception to its standard after a long and fair argument. Most of the money went to three things: strong-motion sensors in our 46 largest buildings, a service that publishes the status of every building and floor to tenants, and a restart order for 388 lifts agreed in advance with the companies that maintain them.

What a building can report about itself

A modern building knows more about its own condition than its owner usually asks. Strong-motion sensors at the foundation and on upper floors record how hard the structure was shaken and how far it swayed. Lifts stop under their earthquake control operation and report which car halted where. The building management system knows whether water tanks have held, whether pumps are running, whether the emergency generator started and whether the fire panel is reporting faults.

None of that decides whether a building may be occupied. That judgement belongs to qualified engineers and, after a large earthquake, to the rapid inspections that local authorities organise, which mark buildings with red, yellow or green placards. What the data can do is tell us where to send our engineers first and what to tell tenants while those engineers are travelling.

Our service combines three sources in a fixed order. The sensors come first. If recorded shaking at a building stays below a threshold that our structural consultant has set for that building, its floors are marked as shaken below the inspection threshold, which is a statement about the shaking and not about the building. The building systems come second, reporting lift, water, power and fire status floor by floor. Engineers' inspections come third, entered on tablets against a checklist. A floor is shown as inspected, no damage found only when a named engineer has walked it.

The lifts deserved more attention than I expected. After even a moderate earthquake, dozens of lifts can stop at once and wait for a maintenance engineer to check them before they return to service. The maintainers have far fewer engineers than there are stopped lifts, and in the past they visited buildings in whatever order the calls arrived. We now agree the order in advance: lifts that serve clinics and nurseries beneath the viaducts and our rental housing for older residents first, then the only lift in any building with one, then the rest.

Publishing what we do not yet know

The hardest argument was not technical. Our legal department worried, reasonably, that a provisional status would be read as an assurance and that a tenant who sent staff back to an uninspected floor might hold us responsible. Their safest course was to publish nothing until the engineers had finished.

I argued that silence is not neutral. Tenants decide whether to send people back whether or not we tell them anything, and without us they decide on worse information. We settled on a vocabulary that never uses the word safe. Every floor shows one of five states: not yet assessed; shaken below the inspection threshold; inspection under way; inspected, no damage found; and closed. Every state shows when it was set and by whom. The page says plainly that the status is not a structural judgement and tells tenants whom to call.

The first live test came on a weekday morning in February 2025, when an earthquake of intensity 4 in our area stopped 61 of our lifts. Every building had a published status within 26 minutes, and 58 lifts were running within three hours in the agreed order. We also made a mistake. An engineer marked a floor as inspected, no damage found without opening a locked storeroom where a ceiling panel had fallen. The tenant told us, and we corrected the status within 40 minutes. Locked rooms are now recorded as unchecked, and the floor cannot be cleared until they are opened.

That correction taught me how a board should judge a plan like ours. I would ask three questions. How long until every tenant can see a status for its own floor? How many statuses later had to be corrected, and why? And in what order will the lifts come back, and who agreed it? A modest earthquake will answer all three. The larger earthquake that national planners assume could one day strike beneath the capital will answer them with far less patience, and the time to discover that the ledger was the wrong priority is not the morning it happens.