Despite our best efforts to strategically apply every piece of technology available and all best practices, eventually, every organization will experience a crisis of some magnitude. At that point, regardless of the initiating event, the most important goal is to recover the business as quickly and cost-effectively as possible.
We in the security industry know all about crisis avoidance and prevention. After all, the primary thrust of our jobs is to implement a program that will prevent or deter unacceptable behaviour directed at our organization. Moreover, it is within this context that security and crisis management become adjacent, and in some circumstances, overlapping functions.
The two functions are adjacent in that certain classes of threats must pass through the security program to cause a crisis impacting the organization. For example, a disgruntled former employee must bypass technological, procedural and administrative security controls to regain access to a corporate facility and take a hostage. Crisis management takes over after the threat "defeats" the security program. However, these functions overlap as well, since security would play an on-going role in resolving the crisis.
The strategic response to a potential organization-threatening crisis is the crisis management or emergency operations plan. In broad terms, the strategy is to prevent or avoid the initiating event, mitigate the consequences of the event should it occur, and recover from the event as quickly as possible.
Planning Is Not Just Long-Term
Crisis management is all about planning and preparation. This planning is normally subdivided into five categories:
Category of CM Planning
The event is not in sight.
The event is expected in two to three days.
The crisis is on-going.
The short-term response action after an event has occurred.
The “last-leg” response actions and transition to normal operations.
This list recognizes that there is such an organization can do to prepare for a crisis.
In general, any crisis that can be defined regarding an initiating event with subsequent consequences can be the object of long-range CM planning activity.
Events that lend themselves particularly well to this type of approach include weather abnormalities (tornados, hurricanes, ice storms, floods), fire, power outage, water outage, communications failure, bomb threat, incident and computer system failure.
Other types of incidents can also be the object of long-range planning; however, these incidents are, in some respects, less frequent and are inherently more variable than the incidents above, with which we are much more familiar.
This latter category includes explosions, workplace violence, hostage incidents and social unrest or civil disorder.
Universal Crisis Management Problems
There are several common problems in organizations' crisis management programs today.
Do Not Have a Plan
Many organizations do not have a formal CM plan or structure with which to begin to prepare for or respond to a crisis event. In many organizations, on-going business activities easily consume the available staff resources. Unfortunately, this organization will not have even a basic structure for a response when an unexpected event occurs.
While the argument can be made that every business cannot afford to put off CM planning, those businesses with limited resources should at least assemble a basic planning and response document. This document at a minimum should contain contact information for those individuals designated to be in charge in the event of a crisis. This basic structure will provide a starting point.
View CM Plan as a Completed Document
Many organizations view their crisis management as a completed document; as such it sits on the shelf in various locations within the organization. If it is needed, the right people know where to find it.
In reality, the CM plan is an ever-evolving document that changes as personnel and response strategies change. At a minimum, awareness briefings should be provided to those individuals with crisis management responsibilities to provide the foundational information necessary to begin to deal with a crisis event.
Little or No Training
Third, there is the little training of the staff concerning translating the crisis management plan guidelines into action. This can only be accomplished through various table-top exercises or full-scale simulations.
Challenges for Enterprises
The development and maintenance of a corporate crisis management plan are often complicated by the geographical and functional diversity of an organization.
Lack of Allocated CM Resources
Most organizations find it difficult to dedicate the necessary resources to develop a core CM plan. Under the enterprise model, a CM plan may need to be developed, or at least tailored to each major facility in the portfolio. Under these circumstances, organizations should provide as much commonality as possible in the core CM plan; the distributed facilities would then only have to modify the external support agencies' emergency contact lists to fit their particular location. While this places the burden of CM planning on corporate shoulders, this is normally where these resources reside.
Because of potential functional and geographical diversity, the range of possible crisis types faced by the organization at large can be extensive.
Again, corporate-level planning should take into account this diversity and provide the necessary core response structures to address all hazards. Local tailoring with corporate support will provide the local information and strategy needed for local applicability.
Identification and Coordination of Support
The identification and coordination of support from local agencies, such as law enforcement, will need to be done locally. The corporate crisis planning team will need to ensure that these relationships are in place.
Local Crisis Management Team
Sometimes, the Local Crisis Management Team is also called the Incident Management (IM) Team.
- Depending on the event, the local crisis management team could need anything and everything from office supplies and building materials to rental cars, computers, and two-way radios. While some of these requirements could be foreseen and accommodated through a corporate account with a national supplier, the actual supply of the items would most likely need to be local. Experience has shown that establishing domestic sources of necessary supplies is a necessity.
- Enterprises need to be particularly careful in coordinating the flow of information.
Many CM guides stress the importance of managing the information provided to interested and affected parties, including employees, families, stockholders, and the media. Individual facilities may not have an individual designated or trained to interface with the press. The corporate public affairs person may be thousands of miles away at the corporate headquarters with second-hand information. This difficulty must be planned for in advance to ensure a clear and correct version of the event is conveyed to all parties.
One of the most important ways to improve your CM plan is to practice. The familiarity with the plan brought about by practice will enable your team to come to quick decisions about crisis responses and be able to access efficiently the resources necessary to protect the organizational assets, both staff, and capital.
Why Do Organizations Not Engage In A Proper Crisis Management?
Organizations, similar to individuals, try to deny their weaknesses (Hamidovic, 2012). The reasons why organizations do not engage in proper crisis management are often:
Organizations deny that they might be vulnerable to threats of imminent crisis and, thus, decide that no measure is to be taken.
Organizations recognize that a crisis will affect the organization, but its impact is considered to be too small to be taken into consideration; in other words, the magnitude and importance of the crisis are significantly diminished.
Organizations presume that “we are so big and powerful that we will be protected from the crisis.”
Organizations consider that crises do not happen to good organizations, thus ignoring all existing signals of crisis.
Organizations minimize the probability of occurrence of a crisis.
The organization believes that if a crisis should affect the company, it will affect only some departments.
Goh, M. H. (2016). A Manager’s Guide to Implement Your Crisis Management Plan . Business Continuity Management Specialist Series (1st ed., p. 192). Singapore: GMH Pte Ltd.
Extracted from Challenges in CM Planning
Find out more about Blended Learning CM-300 [BL-CM-3] & CM-5000 [BL-CM-5]
|Please feel free to send us a note if you have any of these questions to firstname.lastname@example.org|