A crisis places an organisation under extraordinary pressure.
Information may be incomplete, events may develop rapidly, stakeholders may demand immediate answers, and senior leaders may be required to make significant decisions in a short period.
In these circumstances, the organisation cannot afford to determine its crisis management structure, decision authority and response process for the first time during the crisis.
The Crisis Management Plan (CM Plan) provides the framework to support the organisation's strategic response.
It establishes how a potential crisis is escalated, who is responsible for leading the response, how the Crisis Management Team is activated, how decisions are made and how stakeholders are managed.
However, a CM Plan should not attempt to predict every crisis or prescribe every action. Its purpose is to provide sufficient structure for senior leaders to manage uncertainty and make timely, coordinated and defensible decisions.
This chapter explains the purpose of a Crisis Management Plan, what it should contain, how it relates to other organisational response plans and the principles that should guide its development.
A Crisis Management Plan is a controlled document that provides the structure, authority, roles, procedures and supporting tools required to manage a crisis.
The plan supports the Crisis Management Team in coordinating the organisation's strategic response to a difficult or escalating situation.
During a crisis, the CM Plan should help senior leaders answer several fundamental questions:
The CM Plan therefore acts as a strategic management framework during a crisis.
It does not replace leadership or professional judgement. Instead, it enables leaders to apply their judgement within an agreed structure.
Organisations often assume that experienced senior managers will naturally know what to do during a crisis.
Experience is valuable, but a crisis creates conditions that make informal management difficult.
A major event may involve:
Without an agreed plan, senior leaders may spend valuable time determining how to organise the response.
Questions may arise, such as:
These questions should be addressed before a crisis occurs.
A CM Plan reduces avoidable confusion by establishing the organisation's crisis management arrangements in advance.
The primary purpose of the CM Plan is to enable the organisation to maintain strategic control during a crisis.
The plan should support five important management requirements.
The plan identifies who leads the Crisis Management Team and who assumes leadership if the primary Crisis Leader is unavailable.
The plan clarifies who can activate the Crisis Management Team and approve significant strategic actions.
The plan provides a structure for coordinating multiple departments and response teams.
The plan provides a process for assessing the situation, identifying options, considering consequences and recording decisions.
The plan establishes how the organisation identifies, prioritises and communicates with affected stakeholders.
A well-designed plan should allow the Crisis Management Team to move quickly from confusion to structured management.
One of the most important purposes of a CM Plan is to support strategic decision-making.
A crisis may require senior leaders to make decisions that are unusual, complex or potentially irreversible.
Examples include:
The plan cannot make these decisions for the Crisis Management Team.
Instead, it should help the team determine:
This approach is particularly important because decisions made during a crisis may later be reviewed by regulators, boards, auditors, courts, customers or the media.
The organisation should therefore be able to demonstrate that decisions were reasonable based on the information available at the time.
Understanding what a CM Plan is not is equally important.
No organisation can predict every possible crisis.
Even when the crisis type is known, the exact sequence of events may differ significantly from previous incidents or exercise scenarios.
The plan should therefore provide a flexible management framework.
A cyber incident response plan may describe how systems are isolated, malware is analysed and forensic evidence is preserved.
The CM Plan addresses the wider organisational consequences.
For example:
A Business Continuity Plan focuses on maintaining or recovering priority business activities following a disruption.
The Crisis Management Plan provides strategic oversight of the wider crisis.
The Crisis Management Team may determine which services receive priority, while business continuity teams implement the agreed continuity arrangements.
Crisis communication is an essential component of crisis management, but communication alone does not constitute the complete organisational response.
The CM Plan must also address leadership, governance, activation, decision-making, coordination and recovery.
Emergency contact details are useful, but a list of telephone numbers does not explain who leads, what authority exists or how strategic decisions are made.
A Crisis Management Policy defines organisational intent, principles and governance expectations.
The CM Plan provides practical arrangements for managing an actual crisis.
A plan can provide structure, but it cannot replace judgement, experience, courage or accountability.
The Crisis Leader and CMT members must still assess the situation and make decisions.
The CM Plan normally operates alongside several specialised response plans.
These may include:
The relationship between these plans should be clearly defined.
Operational plans manage the immediate event.
For example, the Cyber Incident Response Team may:
Business Continuity and Disaster Recovery Plans maintain or restore priority operations and technologies.
The CM Plan provides strategic direction and organisational coordination.
The Crisis Management Team may:
The plans should operate together rather than compete for control.
A useful principle is:
Several principles should guide the development of the CM Plan.
The plan should focus on senior management responsibilities.
Detailed technical instructions should remain in operational plans.
The CMT should be able to locate important information quickly.
Avoid excessive background information.
The plan should clearly identify who can:
The plan should support situations where information is incomplete.
Processes for identifying facts, assumptions and unknowns should be included.
The core CM Plan should be applicable to different crises.
Scenario-specific playbooks may provide additional guidance for selected threats.
Communication should be part of the crisis response process rather than an activity performed only after decisions have been made.
The CM Plan should address the transition from active crisis response to recovery and normal management.
The plan must remain available if normal systems, facilities or communication platforms are unavailable.
A practical CM Plan may contain the following sections.
This section establishes document governance.
It may include:
This section explains:
This section defines:
The objective is to help the organisation recognise when strategic Crisis Management is required.
This section explains:
This section identifies:
This section defines the responsibilities of:
This section identifies who can approve major actions.
Examples may include:
This section explains:
This section describes how the CMT operates.
It may include:
A structured response process may include:
Activate → Assess → Stabilise → Decide → Communicate → Monitor → Recover
This sequence provides a common approach across different crisis scenarios.
This section establishes:
This section defines:
Playbooks may be developed for priority scenarios such as:
Useful tools may include:
This section explains how the plan will be:
The CM Plan must be designed for the conditions in which it will be used.
During a crisis, participants may be:
The plan should therefore be easy to navigate.
CMT members should be able to locate activation, communication or stand-down procedures quickly.
Checklists support consistent action during periods of high workload.
Tables are useful for:
Process diagrams can clarify:
Instead of:
“Consideration should be given to regulatory notification.”
Use:
“Compliance Lead assesses regulatory notification requirements and advises the Crisis Leader.”
Background explanations may be useful during training but are often difficult to use during a crisis.
Detailed guidance can be maintained in supporting manuals or training materials.
Before drafting the full plan, the planning team should develop and agree on the Table of Contents.
This is an important implementation step.
The planning team should ask:
The Table of Contents should be reviewed with key CMT members.
This review helps ensure that the plan structure is agreed before significant drafting work begins.
The CM Plan should have a designated owner.
The Plan Owner is generally responsible for:
However, the Plan Owner should not develop the entire plan alone.
Relevant departments should contribute to sections affecting their responsibilities.
For example:
The CM Plan should be an organisational plan rather than a document owned by one specialist department.
Once the draft plan is developed, it should undergo a structured review.
The review should consider five areas.
Does the plan contain all required sections?
Are roles, contact details and authority correct?
Does the CM Plan align with other organisational plans?
Can the CMT realistically perform the documented procedures?
Can users quickly locate and understand the information?
The review should involve actual CMT members.
A plan should not be approved solely because the document appears professionally written.
The individuals expected to use the plan should confirm that it is practical.
Several weaknesses frequently appear in CM Plans.
Important procedures are hidden within extensive narrative content.
Statements such as “senior management will manage the crisis” do not define responsibility.
The plan identifies responsibilities but does not explain who can approve significant actions.
Terms such as “serious incident” or “major impact” are not defined.
The communication team is informed too late.
The CMT becomes responsible for technical or operational tasks.
The plan focuses on the first few hours but does not explain stand-down or transition to recovery.
The plan requires that decisions and actions be recorded but provides no practical tools.
The only copy is stored on the corporate network.
A plan may remain untested for several years.
These weaknesses should be identified through plan review and exercises.
The planning team should conduct a CM Plan structure workshop.
Confirm:
Develop the proposed Table of Contents.
Identify who is responsible for providing content.
Identify supporting plans and teams.
Confirm which strategic decisions must be documented.
List forms, checklists and logs.
Ask potential users whether the proposed structure is practical.
Workshop Output
The output should be an approved Crisis Management Plan Structure and Table of Contents.
This becomes the framework for developing the remaining sections of the plan.
Before proceeding to detailed crisis scenario planning, the organisation should answer:
If these questions cannot be answered, further plan design work is required.
The Crisis Management Plan is the central management framework supporting an organisation's strategic response to a crisis.
Its purpose is not to predict every event or provide a script for senior leaders. Its purpose is to establish the structure, authority, coordination arrangements and decision-support processes required when normal management procedures are no longer sufficient.
An effective CM Plan clearly explains when the Crisis Management Team should be activated, who leads the response, what authority exists, how the team operates and how decisions, actions and communication are coordinated.
The plan must also integrate with operational incident response, business continuity, technology recovery and other specialised plans. Operational teams manage the immediate event, while the Crisis Management Team manages the wider organisational consequences.
The quality of the CM Plan should ultimately be judged by its usability. When a crisis occurs, the key question is not whether the plan is comprehensive or professionally presented. The key question is:
Can the Crisis Management Team use the plan to determine what to do next?
With the purpose and structure of the Crisis Management Plan established, the organisation can proceed to identify the threats and crisis scenarios that the plan must be capable of managing.
Goh, M. H. (2016). A Manager’s Guide to Implementing Your Crisis Management Plan. Business Continuity Management Specialist Series (1st ed., p. 192). Singapore: GMH Pte Ltd.
To learn more about the course and schedule, click the buttons below for the CM-300 Crisis Management Implementer [CM-3] and the CM-5000 Crisis Management Expert Implementer [CM-5].
|
Please feel free to send us a note if you have any questions. |
||