A Complete Crisis Management Program Is the Key to Recovery

Traditional crisis management is adjusting to the new “Always On” era. In this new landscape, it is critical to be proactive and adaptive in managing events that pose threats to your organization.

An effective Crisis Management Program is driven by situational awareness, effective communications, and constant testing exercises. 

The key components of a complete Crisis Management Program include:

1. Plan
2. Team
3. Crisis Management Team Plan
4. Crisis Communications Plan
5. Command Centers
6. Pandemic or Loss of Human Resources Planning
7. Exercises
8. Training & Awareness
9. Crisis Management Program Maintenance

1. Plan

The heart of any crisis management program is the crisis management plan. This document sets forth the critical steps of a company’s emergency response plan. Read more about the crisis response plan here.

2. Team

Have you identified primary and alternate team members for each key role? Are team members capable of managing their role on the team? An effective team is not comprised of individuals based on a title, but on capability. For example, in an organization we work with, the leader of the application takes on the communications lead role. During a crisis, this individual’s value is best served leading and coordinating communications, while allowing a direct report to focus on application impacts. Regular review of the team members and team dynamics is essential.

This team is not the one to use for team building and developing relationships. Members must be focused on providing effective and supportive leadership during stressful situations.

Several roles must be fulfilled when the disaster first occurs in order to optimize the organization’s response. These roles include:

• First Point of Contact – usually the person who runs the facility’s day-to-day maintenance. This person can look at a situation and decide how to contain it until it can be repaired.
• Facility Manager – coordinates damage assessment, salvage, and restoration activities.
• Executive Team
  • CEO – whoever makes the top business decisions
  • CIO – makes the IT strategic decisions and advises top executives on IT recovery process
  • Disaster Recovery Manager – advises executives on the Disaster Recovery Plan execution and process
• Executive Staff
  • Corporate Communications Manager – coordinates with the news media to ensure accurate reporting
  • Human Resources Manager – coordinates communication and notification to all employees
  • Legal Team – coordinates with the insurance company to meet assessment needs while speeding the company’s recovery
  • Purchasing Manager – quickly contacts suppliers and orders needed support
  • Sales Manager – contacts customers to assure them of the timely delivery of their orders or to assist them in finding an alternative source of goods and services

2. Crisis Management Team Plan

Do you have a comprehensive plan, consistent with industry best practices, that directs the team and its response? While the plan cannot list or identify every possible situation or contingency, it can list critical information and predefined actions and decisions.

“A goal without a plan is only a wish.”
– Jeff Rich, American explorer

3. Crisis Communications Plan

Do you have a documented plan that outlines the guidelines and steps to communicate effectively during a crisis? The plan should include templates, contacts, and potential communication triggers. Include task lists and details on the use of communication technologies such as emergency notification systems, conference calls, online meetings, etc. to ensure that every member can assist as needed in the communication efforts. Remember that you cannot be sure that the person (or people) who normally use the tool will be available. (To find out more about communications tools that are available to you, see our blog from last week.)

4. Command Centers

Do you have physical and virtual command centers in place where team members can assemble during a declared event? Ensure the Crisis Management plan defines when a physical and/or virtual command center will be used. Identify and document secondary sites and technologies as well. Consider the logistics, safety, and availability of the command center.

5. Pandemic or Loss of Human Resources Planning

Does your Crisis Management plan reference pandemic planning guidelines and standards? This is one specific situation that will require unique actions and planning. Many organizations have good strategies and plans for events impacting the organization, and for ensuring that staff can continue to function. When it comes to understanding what to do if a sizable portion of staff or individuals with singular knowledge or skills is not available, planning is often less mature. You have a limited knowledge of what will actually happen in a disaster situation. As an example, we have seen organizations that are very lean, yet still have a backup for each critical function. But, when an individual is on vacation, it means that the function now has only one person available; if that individual is also unavailable, there will be an interruption in service. You may want to consider having a standalone Pandemic/Loss of Human Resources plan referenced in your Crisis Management plan.

6. Exercises 

Do you hold regular mock disaster exercises to heighten team sophistication and maturity? Exercises should utilize realistic scenarios. While a zombie apocalypse may be fun, it is not real. Using real events, especially leveraging known weaknesses and gaps, provides appropriate stress-inducing behavior versus a game mentality. Exercises are about simulating the management of an event. Avoid intellectual exercises where the team says things like “and we have communicated to the shareholders.” Performing the task at least at a minimal level should be part of the exercise; it is too easy to simply say that something has occurred. When your team actually tries to perform a task, they see how long it may take, how difficult it might be, or that additional resources are needed. Also, avoid discussions on how to prevent the scenario, or explaining why the scenario could not happen.

Exercises should be both comprehensive (following an event to completion, which may simulate days or weeks of activity), and real time (a more limited scenario that is performed in real time with actual actions). For example, we recently performed an exercise where the team had to relocate from the primary to the secondary command center. It was quite eye-opening: it took over an hour to travel to the secondary site, get settled, and resume managing the event.

Note the team dynamics. Does anyone dominate the discussions? Does the leader facilitate or do they direct? Is there open and safe communication? Finally, be sure to make documentation of action items and risk assessments a part of the exercise.

7. Training & Awareness

Is your team regularly trained on the process and how to respond effectively? Exercises are wonderful training; yet more frequent training and awareness tasks are just as important. Consider sending short monthly training messages or inviting individuals to review their roles and plans, including how the crisis team may act based on recent events in the news – workaday ransomware, the British Airways IT outage, or the Phoenix Comicon potential shooter incident.

8. Crisis Management Program Maintenance

Are your Crisis Management process and associated documents regularly updated and maintained? Generate a schedule for updating all the documentation, plans, action item due dates, exercises, and other training items. This may be obvious, but many organizations do not have a formal schedule for maintenance tasks. Lack of updates and failure to maintain your program leads to a program that exists on paper only. Functional and mature Crisis Management programs stay up-to-date based on changes in their organizations.

By implementing and maintaining these components in a systematic fashion, you will have set the critical foundation and infrastructure in place for the success of your Crisis Management program. You can read about what MHA Consulting puts into a Crisis Management solution here. To read more about Crisis Management programs, including how to prioritize these items, visit this blog post.