[OR] [Pillar] [E3] [C3] Crisis Management in Operational Resilience – Strategic Response and Leadership

eBook 3: Chapter 2

Business Continuity Management in Operational Resilience – A Deep Dive

Introduction

In an era of heightened uncertainty and increasingly complex disruptions, organisations must be prepared not only to recover operations but also to lead effectively during crises. While Business Continuity Management ensures operational sustainability and Incident Management handles immediate response, Crisis Management (CM) provides the strategic leadership, coordination, and decision-making capability required to navigate high-impact events.

Within the context of Operational Resilience, Crisis Management plays a pivotal role in ensuring that disruptions are managed in a controlled, coordinated, and transparent manner, enabling organisations to continue delivering critical business services while safeguarding stakeholders and reputation.

This chapter explores the role of Crisis Management as a key component of operational resilience, focusing on its strategic importance, governance structure, integration with BCM and IM, and alignment with regulatory expectations.

3.2 Understanding Crisis Management in Operational Resilience

Definition of a Crisis

A crisis is typically characterised by:

• High impact and uncertainty
• Time-critical decision-making
• Potential threat to organisational survival, reputation, or stakeholders
• Requirement for senior leadership involvement

Unlike routine incidents, crises often involve multi-dimensional impacts across operations, technology, people, legal, and reputational domains.

Crisis Management Defined

Crisis Management is the structured approach by which an organisation:

• Responds to major disruptive events
• Coordinates enterprise-wide actions
• Communicates with internal and external stakeholders
• Makes strategic decisions under pressure

Role in Operational Resilience

Crisis Management ensures that:

• The organisation responds coherently and decisively
• Strategic priorities are protected during disruption
• Stakeholders remain informed and confident
• Critical services continue within acceptable thresholds

3.3 The Strategic Role of Crisis Management

Crisis Management operates at the highest level of organisational response, bridging operational actions and strategic direction.

Key Strategic Functions

1. Leadership and Decision-Making

• Establishes a central command structure
• Enables rapid, high-stakes decisions
• Balances operational, financial, regulatory, and reputational considerations

2. Enterprise Coordination

• Aligns multiple business units and functions
• Ensures consistent priorities and actions
• Eliminates duplication and confusion

3. Stakeholder Communication

• Manages communication with:
• Regulators
• Customers
• Employees
• Media
• Protects organisational reputation and trust

4. Resource Prioritisation

• Allocates limited resources to critical services
• Supports continuity strategies defined by BCM

Key Contribution

Crisis Management acts as the “strategic brain” of operational resilience, ensuring that all response efforts are aligned with organisational objectives.

3.4 Crisis Management Framework and Structure

A well-defined Crisis Management framework is essential for effective execution.

3.4.1 Crisis Management Team (CMT)

The CMT is typically composed of senior leadership, including:

• Chief Executive Officer / Managing Director
• Chief Risk Officer
• Head of Operations
• Head of IT / Technology
• Head of Communications
• Legal and Compliance representatives

Key Responsibilities of the CMT

• Assess the severity and impact of the crisis
• Activate appropriate response levels
• Make strategic decisions
• Oversee communication strategies
• Monitor recovery progress

3.4.2 Crisis Escalation Levels

Crisis Management frameworks often include escalation tiers:

Purpose of Escalation

• Ensures appropriate response intensity
• Triggers leadership involvement
• Enables timely activation of crisis structures

3.4.3 Crisis Communication Framework

Effective communication is central to crisis success.

Key Elements

• Pre-defined communication protocols
• Identification of spokespersons
• Messaging aligned with regulatory expectations
• Real-time updates to stakeholders

Outcome

• Maintains trust and transparency
• Prevents misinformation
• Protects organisational reputation

3.5 Integration with Incident Management and BCM

Crisis Management does not operate in isolation. It is part of an integrated response ecosystem.

3.5.1 Integration with Incident Management

• Incident Management provides:
• Initial detection and response
• Real-time situational updates
• Crisis Management uses this information to:
• Assess severity
• Decide on escalation
• Direct strategic response

3.5.2 Integration with Business Continuity Management

• BCM provides:
• Continuity strategies and recovery plans
• Defined service priorities
• Crisis Management:
• Aligns decisions with BCM priorities
• Ensures resources support critical services
• Oversees execution of continuity plans

3.5.3 Integrated Response Flow

• Incident Occurs → Managed by Incident Management

• Escalation → Crisis Management activated

• Strategic Coordination → CMT leads response

• Continuity Execution → BCM ensures service delivery

• Recovery and Stabilisation → Organisation returns to normal

3.6 Crisis Management and Operational Resilience Outcomes

Crisis Management directly supports operational resilience objectives:

1. Sustained Delivery of Critical Services

• Ensures continuity strategies are prioritised and executed

2. Protection of Stakeholders

• Safeguards customers, employees, and partners

3. Regulatory Compliance

• Ensures timely and accurate regulatory reporting

4. Reputation Management

• Maintains public confidence and trust

5. Organisational Adaptability

• Enables dynamic response to evolving scenarios

3.7 Scenario-Based Crisis Management

Operational resilience requires organisations to prepare for severe but plausible scenarios.

Examples of Crisis Scenarios

• Cyberattack affecting core banking systems
• Prolonged IT system outage
• Third-party service provider failure
• Pandemic or workforce disruption
• Natural disasters impacting operations

Role of Crisis Management

• Leads scenario-based decision-making
• Coordinates cross-functional response
• Ensures alignment with impact tolerances

3.8 Regulatory Expectations for Crisis Management

Regulators increasingly require organisations to demonstrate:

• Clearly defined crisis governance structures
• Evidence of leadership involvement
• Documented communication strategies
• Integration with BCM and Incident Management
• Regular crisis simulation exercises

Implications

Organisations must ensure that Crisis Management is:

• Formally structured and documented
• Regularly tested and validated
• Fully integrated into the operational resilience framework

3.9 Common Challenges in Crisis Management

Despite its importance, organisations often face:

• Lack of clear leadership roles
• Ineffective communication strategies
• Delayed decision-making
• Poor integration with BCM and IM
• Insufficient training and exercises

Addressing These Challenges

• Establish clear governance structures
• Conduct regular crisis simulations
• Enhance cross-functional coordination
• Develop strong communication frameworks

Crisis Management is a critical pillar of operational resilience, providing the leadership, coordination, and decision-making capability required to manage high-impact disruptions.

• It ensures that organisations respond strategically and cohesively
• It aligns operational actions with organisational priorities
• It protects stakeholders and reputation
• It enables continuity of critical business services

When integrated with Business Continuity Management and Incident Management, Crisis Management transforms organisational response from fragmented actions into a coordinated, enterprise-wide resilience capability.

Ultimately, Crisis Management ensures that organisations are not only able to withstand disruption but are also capable of leading through uncertainty with confidence and control.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.