Crisis management is an essential part of any operation, regardless of industry or region, public or private sector. Crises happen when they are least expected, as proven by the pandemic. But what is crisis management and how can you ensure your organisation is best prepared for a crisis?
To summarise, crisis management is the policies, plans, processes and people that can be called on in the event of a crisis that threatens to destabilise or harm an organisation.
When a crisis occurs, critical decisions must be made based on limited information and often a high degree of uncertainty. This makes it easy to say “let’s wait for more information”, however this information may never arrive and the chance is missed to act early before the crisis escalates.
The decisions taken will have a significant impact on the crises and the organisation’s wellbeing. Shareholder value, employee and stakeholder relations will all be affected. But it does not have to be negative. Acting proactively and reaching out to customers and providers can lead to goodwill and even a growth in sales as stakeholders rally to support the organisation.
For this reason, crisis management capabilities must be analysed, tested and improved continually to ensure an organisation is in the best possible position to handle any, and every, crisis. This proactive approach is essential for modern organisations in a world where change is constant.
In its crisis management Report 2021, the Business Continuity Institute (BCI) refers to crisis management as a crucial part of achieving resilience for any modern-day organisation: it ensures the organisation is well prepared, is able to rapidly identify and respond to an emerging crisis, it has the right people involved, enables information to be absorbed and assessed to inform timely decision making and a collaborative environment is fostered.
It’s important to consider the potential scale of a crisis and the impact it can have on an organisation. Cyber attacks can lead to theft of IP; fire or boycotts can lead to mass resignations; a pandemic can lead to misinformation and a rise in cyber attacks. In other words, a crisis can quickly lead to multiple crises and your team must be prepared for these at the same time. As an example, in the public sector, we have seen how the pandemic has led to restrictions, which has led to the need to financially support businesses – which have paused operations – and their employees who have been furloughed.
One crisis can also have wide-ranging impacts on an organisation, industry, nation, and society as a whole. Therefore, they must be managed by different entities in different ways. For instance, the Eyjafjallajökull volcano grounded European airlines, stranded citizens throughout Europe, and increased pressure on rail traffic. Similarly, the recent grounding of a ship in the Suez Canal was a crisis for international commerce, for the many shipping companies impacted, and the captain and crew stuck on the vessel. These crises had to be handled differently at every level.
Most organisations today understand the need for a crisis management plan but not all are fully or properly prepared. The BCI found that less than half of the organisations polled in their crisis management Report 2021 had an effective crisis plan for the pandemic, and a third had a plan that was either ineffective or wasn’t used at all. It’s not hard to imagine which organisations fared the best out of those polled.
Acting proactively in a crisis can have a positive impact – in other words, every cloud has a silver lining. A 4C client in the hospitality industry has reported that thanks to open communications with customers and a clear plan of action during a crisis, they have received positive feedback in customer surveys. Another good example is from the consumer goods company that has adopted a “winning in the marketplace during a crisis” strategy. The company’s aim is to get its products on the shelves of customers faster than competitors following a crisis. In an industry where shelf space is key and can be lost quickly this strategy proves invaluable for securing their market position.
Crisis management should be applied prior to, during and after a crisis.
This is where you define your processes, plans and objectives, and identify the people who should be involved – ensuring a direct channel to leadership exists, should a crisis occur. Testing through training and exercises will inform you if you have prepared properly. This must be found out before a crisis occurs so you don’t discover mid-crisis that you have insufficient capabilities or are missing key people in the team.
Read more about training and exercises
Use your plans, follow your policies – you’ve put them in place for a reason, don’t go with gut feelings. By all means, re-assess mid-crisis, but do so with a sound structure in place and a qualified person or team who is not involved in managing the crisis and can therefore take an objective view.
The 4C Crisis Management Model was developed as an easy-to-use tool to support crisis management teams. Since most organisations know some of the crises they will face i.e., cyber attacks, the model can be used to plan for such crises in advance. Training with a third party that can create life-like scenarios for these will further improve response capabilities.
A full evaluation should take place. How did you perform? Did the plans and processes provide the support as expected? Did everybody perform to expectations? Did senior management make themselves available as needed? Can improvements be made where needed? Do you know if improvements are needed? All these questions need answering.
The task of the Crisis Management team is not to take operative action per se, but rather ensure that those who do need to act have the right prerequisites to work efficiently. The team must:
In a crisis, a CEO can assume control – running meetings, solving problems, taking decisions – the very things that the Crisis Management team has been set up to do. It’s important that the CEO trusts the team to handle this. Having a dedicated facilitator, who reports to the CEO during a crisis can help avoid such scenarios. This can be an employee or external partner.
In order to build Crisis Management capabilities, you must identify your current and existing capabilities. Therefore, a thorough analysis must be performed to understand where you are, and if this is good enough, or if improvements need to be made. The best way to do this is through training and exercises that test your organisation’s capabilities and the people within it, in a life-like crisis. This provides a good measuring stick, from which to understand where improvements need making. Importantly, it also brings the people together who will have to collaborate one day in a real-life crisis. Having trained together, and got to know each other somewhat, they will be better prepared for the real thing.
Those parts of the organisation that are exposed to high risks or are business-critical should have high incident and Crisis Management capabilities and should therefore exercise more regularly and stringently. This is where most effort should be directed in an organisation.
Most importantly, never assume it won’t happen to you. As Mike Tyson famously said, “Everybody has a plan until they get punched in the face!”
Request a live demo, customised to your needs, to see how Exonaut can take your incident and Crisis Management to the next level.
