ISO 22301 introduces specific requirements (ISO 22301, 2012) for communication and warning. This is new and distinct from BS 25999, which is in recognition of the importance of this element, particularly in the initial stages of an incident. Specifically, ISO 22301 requires organisations to have procedures to:
Furthermore, it also requires consideration of procedures for:
Taking responsibility to ensure that these procedures are regularly exercised.
How would you detect an incident? People seldom ask this question because they often assume that it will be obvious - see a storm coming, fire in the building. However, some of the incidents are not so visible or easily identified by your own people. For example, when a burst pipe flooded an office, a cleaner saw the flooded office and informed her supervisor. The supervisor told the landlord and sent some people to turn off the water. None of these people worked for the impacted company, and they did not call to inform the company. As a result, the pipe burst on the Thursday night before Easter, and on the Tuesday morning after the holiday, staff arrived at a smelly, soaking and unusable office. By then, you need to find out who found the problem and how they raise an alert as you cannot act until you know you have a problem.
Having established there is an incident, you need to ensure that you are monitoring the situation and know how this may be changing. For instance, there should be regular updates on where the safe exit routes remain and so on, in case of an event of a forest fire.
Now we know that we have a problem, ensure that we can communicate within the organisation. Communication is not just about sending people a message; we need to check if it was received, understood and acted upon and in a position to receive feedback. Besides dealing with our staff, we also need to deal with others such as the contractors, members of the public, visitors to our building, consultants and other organisation who may be customers, regulators, suppliers or neighbours. We need to consider and work out how we can communicate with all of these, especially in situations where communication is more difficult than usual. What will be some of the procedures when dealing with problems such as the cell phone network is overloaded, the BlackBerry network happens to be down or when staff are spread over a large area rather than in an office?
Information from official sources may warn your organisation regarding risks that are specific to your country or region. Someone needs to monitor this and deal with the warning accordingly when received
For instance, the issuing of flood warning, tsunami or typhoon warnings to organisations located near the floodplain of a river, or probably an alert from a nearby industrial plant that warns the leak of chemical or nuclear.
Similarly, we must ensure that we can communicate with the emergency responders, such as the fire, medical services, and police. In the case of a fire, the authorities will take control of the situation and you are required to provide information to them if necessary. For example, assuring them that the building has been completely evacuated. You can also receive information such as when access may be possible and the extent of the damage from them when they are ready to provide it.
Throughout the whole incident, it is important to record vital information, decisions made and actions taken. You need to consider how to do this in the varying circumstances that you may have to operate. Keeping a manual record with pencil, clipboard and paper may seem like a good idea until you try to do it in the dark when it is raining. The final set of requirements that must be “considered” depend on the nature of your organisation.
The requirement to “alert interested parties…” relates to the need for certain types of organisation to tell neighbours and the public if they have an incident that will impact upon them. For instance, a chemical plant that might pollute the air or water used by neighbouring businesses and the public will have an obligation to alert them to the danger. Remember that many ordinary organisations can pose a risk to the public on occasions. For instance, the emission of Legionella from a poorly maintained air conditioning unit killed several people in the UK although the problem was known, and no warning had been given.
Larger organisations are liable to the need to consider the requirement for “interoperability of multiple responding organisations and personnel”. For instance, a large campus site that I worked at had 44 different buildings and a number of industrial and manufacturing processes on site. They had their own in- house fire service with a fire engine and a team of staff trained as firemen. It was vital to ensure that they could work alongside the public fire service when they arrived and that fire hydrants and hoses were compatible.
The teams planned together and exercised together to ensure that they could manage the response, but also to ensure that they could communicate with each other effectively in an emergency.
The need for a communications facility refers to the need that some organisations will have to make specific arrangements for communication in a time of crisis. Such facilities might be as simple as a designated room with a dedicated landline or may be sophisticated facilities for managing thousands of incoming calls, such as are deployed by airlines when an air crash occurs. Facilities may not be premises; they can include appropriate tools to send voice, SMS and other messages to staff and to allow them to confirm that they are okay.
Goh, M. H. (2015). A Manager's Guide to Implementing Your IT Crisis Communication Plan. Business Continuity Management Specialist Series. Singapore: GMH Pte Ltd.
Extracted from "Linkage to ISO22301"
To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org. They are the BL-CC-3 Blended Learning CC-300 Crisis Communication Implementer and the BL-CC-5 Blended Learning CC-5000 Crisis Communication Expert Implementer.
| Please feel free to send us a note if you have any of these questions to sales.ap@bcm-institute.org |