A Long-Overdue Trend – the Maturity of Crisis Management

Although the concept of crisis management is not new, business continuity planners (and other risk management professionals) are focusing more and more attention on this often overlooked area. This article explores the business trends leading to a higher degree of organizational crisis management readiness and maturity.

Catalysts for Change
Executive managers are paying closer attention to risk management efforts and are demanding a leadership role in business continuity. Executives understand the value of a robust, integrated risk management program with the appropriate “tone from the top.” They also appreciate lessons learned from recent crises that demonstrate the need for timely response led by executive managers who appropriately coordinate with governmental entities and first response organizations.

The crisis management process is a foundational element of the business continuity program, and executive managers understand that initial response decisions will have a major effect on recoverability and incurred losses. However, executive managers also realize their time is finite. They don’t have the time to participate in multiple crisis management programs – one for business continuity, one for security events and another for product recall (as examples). They also don’t have the time or ability to follow voluminous plans that fail to capitalize on their knowledge of the business or their creative decision-making skills.

Trends
Executive management attention and participation, together with the application of lessons learned from recent prominent disasters has led to a number of trends transforming crisis management:

1. Flexibility. An increased level of management participation and interest translates into streamlined, flexible crisis management processes. Crisis management is becoming all-hazards, event-oriented, with frameworks replacing detailed laundry lists of static, inflexible procedures. It is now nimble enough to address a wider variety of threats than just natural disasters, including reputational issues, supply chain interruptions, product recalls, kidnappings and health-related events.

2. Standards. Most current and emerging standards reference the management of response and recovery processes. The most significant standards applicable to crisis management are focused on the government sector, specifically the National Incident Management System (NIMS) and the Incident Command System (ICS). Originally designed to address federal, state and local government interaction, the private sector has modified both to meet commercial practices. Although not a 100% match, NIMS and ICS concepts influence most crisis management programs, leading to stronger integration with first responders.

3. Triggers. Effective crisis management teams know when (and when not) to activate core elements of their response processes. Triggers and other criteria that drive action and response are formalized, although flexibility is built into the process.

4. Information. Unlike its predecessors, today’s crisis management processes are built on advanced knowledge and timely information. Although not possible in all circumstances, organizations see crises coming and are proactive in responding. They collect information, perform trend analysis, discuss implications and prepare to act quickly. Why is this happening today? More mature organizations are implementing enterprise risk management (ERM) processes. These processes – in reality, mindsets – place risk management center stage and result in strategies to proactively monitor and manage risk. As a result, crisis management processes are built into ERM programs, triggered when a risk becomes a reality to the business.

5. Inter-relationships. More and more entities understand they truly operate in an interdependent world, recognizing they have direct control over very little. Leading organizations integrate their crisis management processes with third-party programs, including government entities (federal, state and local), private volunteer organizations, industry groups and business partners (local and distant). Best-in-class organizations collaborate with key suppliers and respond jointly.

6. Communications. The common thread holding these crisis management trends together is crisis communications. Crisis management and crisis communications are different – and often confused with one another. Whereas crisis management is the response process where decisions and actions originate, crisis communications is the process to make all stakeholders (internal and external) aware of these decisions and expectations. Executive managers and business continuity professionals are engaging communications and human resources counterparts to identify and design communications processes that keep stakeholders aware and involved in the response and recovery process. Ghost web sites, crisis holding statements, crisis hot lines, media handling processes and notification services are just some of the solutions that enable effective crisis communications – and thus, effective crisis management.

Organized to Respond
Most organizations have a two-tier crisis management “organizational structure”. First, a group of executives with an ability to make decisions on behalf of the entire organization are appointed to a body often called the Crisis Management Team, or CMT. Although loosely tied to the day-to-day organizational structure, key line-of-business and support functions that should be represented include:

• Executive management (Team Leader)
• Key product and service delivery
• Human Resources
• Communications
• Legal
• Finance
• Technology
• Risk Management
• Business Continuity (as a team coordinator)
• “Others”

Who is the CMT leader? That depends on the organization. It should be a senior executive with an understanding of the business, and someone respected by his/her peers, with the authority (and the ability) to quickly make decisions on behalf of the organization. In many organizations, it’s the COO or CFO. In most cases, it’s NOT the CEO. Why? Many companies include the CEO on the CMT, but recognize that the CEO still has an organization to run (typically, the whole organization is not affected by a crisis). Additionally, the CEO is often the “face” of the crisis, and as the face of the organization, considerable public appearances with employees, investors and the media are required to be effective. As a result, it becomes impossible to lead the response effort.

Keeping the CMT small and nimble is an important consideration. Equally important is flexibility. The word “others” on the list above means that, depending on the situation, other executive managers or resources may be called upon to participate in the strategic response effort. Some organizations find that the “other” role may include third parties.

The second tier in the crisis management structure includes managers that lead the “do’ers”. Reporting to executives on the CMT, the Crisis Response Team often includes personnel with deep subject matter expertise – in support of the CMT. Facilities, engineering, technology and communications practitioners (to name a few) will implement decisions, perform damage assessments and acquire the resources necessary to respond, recover and restore critical business functions and technologies.

Communications and Technology
Recent crises taught executive managers two important lessons.

1. Having access to information necessary to make decisions is critically important.

2. Getting this information to the right people is equally important.

With these two lessons learned in mind, organizations are acquiring or building portals to support crisis management teams, with processes to populate these sites with information needed to support decision-making and collaboration.

To meet this objective:
1. Identify the information necessary to make decisions.
2. Source this information and create a repository in a central location.
3. Consider developing a situation report that summarizes the information in an easily reviewable manner.
4. Develop automated processes to push alerts to key stakeholders/audiences.

Engage Executive Management
Successful crisis management execution hinges on executive management knowledge and involvement. How can a business continuity professional keep crisis management in front of the executive management team? Successful organizations achieve this in two ways:

1. Develop ways to measure business continuity readiness and present the findings to your organization’s business continuity / risk steering committee on a quarterly basis. Link business continuity readiness to their knowledge and participation in the crisis management program, and reinforce this linkage.

2. Conduct crisis management exercises on a recurring basis (annually, at a minimum). Using a likely scenario identified in the risk assessment, walk the crisis management team through the response framework. Build awareness through hands-on application of the crisis management process, and engage the executive management team in making suggestions for improvement.

Culture Is Key
So far, we’ve introduced a number of factors influencing the growing maturity of crisis management. Another factor is culture. Collaboration and consensus-oriented decision-making monopolize many board rooms and C Suites in today’s business environment. However, this trend often needs to be suspended in time of crisis.

Consider addressing the impact of culture during the crisis management program development process, as well as during exercises. Recognizing culture as a catalyst (or impediment) to successful decision-making is an important first step in maximizing (or minimizing) its effects.

Conclusions
Executive management interest and involvement is enabling a greater focus on crisis management. This involvement, paired with lessons learned stemming from recent crisis situations, is leading to the maturation of a critical component of an organization’s risk management program. When addressed appropriately, to include the trends and other key success factors addressed in this article, a crisis management program can enable a timely, effective response that minimizes injury, physical damage, reputational impairment and downtime.

About the Authors
Brian Zawada is the Director of Consulting Services and co-founder of Avalution Consulting. Brian’s thirteen years of business continuity and crisis management experience include the delivery of response and recovery solutions for the financial services, manufacturing, consumer products, retail and pharmaceutical industries. Brian can be reached via email at [email protected]

Robert Giffin is a Managing Consulting and co-founder of Avalution Consulting. Rob specializes in the development of response and recovery programs in the manufacturing, healthcare and consumer products industries, as well as in government. Rob can be reached via email at [email protected]