|
A Long-Overdue Trend Crisis management is an organization-specific program designed to effectively and efficiently respond to an event, minimize the impact, protect and reassure stakeholders, and prepare for recovery. Although the concept of crisis management is not new, business continuity planners (and other risk management professionals) are focusing more and more attention on this often overlooked area. This article explores the business trends leading to a higher degree of organizational crisis management readiness and maturity.
Catalysts for Change The crisis management process is a foundational element of the business continuity program, and executive managers understand that initial response decisions will have a major effect on recoverability and incurred losses. However, executive managers also realize their time is finite. They don't have the time to participate in multiple crisis management programs - one for business continuity, one for security events and another for product recall (as examples). They also don't have the time or ability to follow voluminous plans that fail to capitalize on their knowledge of the business or their creative decision-making skills.
Trends 1. Flexibility. An increased level of management participation and interest translates into streamlined, flexible crisis management processes. Crisis management is becoming all-hazards, event-oriented, with frameworks replacing detailed laundry lists of static, inflexible procedures. It is now nimble enough to address a wider variety of threats than just natural disasters, including reputational issues, supply chain interruptions, product recalls, kidnappings and health-related events. 2. Standards. Most current and emerging standards reference the management of response and recovery processes. The most significant standards applicable to crisis management are focused on the government sector, specifically the National Incident Management System (NIMS) and the Incident Command System (ICS). Originally designed to address federal, state and local government interaction, the private sector has modified both to meet commercial practices. Although not a 100% match, NIMS and ICS concepts influence most crisis management programs, leading to stronger integration with first responders. 3. Triggers. Effective crisis management teams know when (and when not) to activate core elements of their response processes. Triggers and other criteria that drive action and response are formalized, although flexibility is built into the process. 4. Information. Unlike its predecessors, today's crisis management processes are built on advanced knowledge and timely information. Although not possible in all circumstances, organizations see crises coming and are proactive in responding. They collect information, perform trend analysis, discuss implications and prepare to act quickly. Why is this happening today? More mature organizations are implementing enterprise risk management (ERM) processes. These processes - in reality, mindsets - place risk management center stage and result in strategies to proactively monitor and manage risk. As a result, crisis management processes are built into ERM programs, triggered when a risk becomes a reality to the business. 5. Inter-relationships. More and more entities understand they truly operate in an interdependent world, recognizing they have direct control over very little. Leading organizations integrate their crisis management processes with third-party programs, including government entities (federal, state and local), private volunteer organizations, industry groups and business partners (local and distant). Best-in-class organizations collaborate with key suppliers and respond jointly. 6. Communications. The common thread holding these crisis management trends together is crisis communications. Crisis management and crisis communications are different - and often confused with one another. Whereas crisis management is the response process where decisions and actions originate, crisis communications is the process to make all stakeholders (internal and external) aware of these decisions and expectations. Executive managers and business continuity professionals are engaging communications and human resources counterparts to identify and design communications processes that keep stakeholders aware and involved in the response and recovery process. Ghost web sites, crisis holding statements, crisis hot lines, media handling processes and notification services are just some of the solutions that enable effective crisis communications - and thus, effective crisis management.
Organized to Respond
Who is the CMT leader? That depends on the organization. It should be a senior executive with an understanding of the business, and someone respected by his/her peers, with the authority (and the ability) to quickly make decisions on behalf of the organization. In many organizations, it's the COO or CFO. In most cases, it's NOT the CEO. Why? Many companies include the CEO on the CMT, but recognize that the CEO still has an organization to run (typically, the whole organization is not affected by a crisis). Additionally, the CEO is often the "face" of the crisis, and as the face of the organization, considerable public appearances with employees, investors and the media are required to be effective. As a result, it becomes impossible to lead the response effort. Keeping the CMT small and nimble is an important consideration. Equally important is flexibility. The word "others" on the list above means that, depending on the situation, other executive managers or resources may be called upon to participate in the strategic response effort. Some organizations find that the "other" role may include third parties. The second tier in the crisis management structure includes managers that lead the "do'ers". Reporting to executives on the CMT, the Crisis Response Team often includes personnel with deep subject matter expertise - in support of the CMT. Facilities, engineering, technology and communications practitioners (to name a few) will implement decisions, perform damage assessments and acquire the resources necessary to respond, recover and restore critical business functions and technologies.
Communications and Technology 1. Having access to information necessary to make decisions is critically important. 2. Getting this information to the right people is equally important. With these two lessons learned in mind, organizations are acquiring or building portals to support crisis management teams, with processes to populate these sites with information needed to support decision-making and collaboration.
To meet this objective:
Engage Executive Management
1. Develop ways to measure business continuity readiness and present the findings to your
organization's business continuity / risk steering committee on a quarterly basis.
Link business continuity readiness to their knowledge and participation in the crisis
management program, and reinforce this linkage.
Culture Is Key Consider addressing the impact of culture during the crisis management program development process, as well as during exercises. Recognizing culture as a catalyst (or impediment) to successful decision-making is an important first step in maximizing (or minimizing) its effects.
Conclusions
About the Authors |