There are six steps for defining a crisis management plan that can be easily remembered using the word “CRISIS.” Each letter of the word stands for a critical step that is necessary to be prepared to deal with a crisis. If you want to be fully prepared for an emergency, then go through each of these steps:
- Complete a threat analysis: Before you begin any planning or preparation, the smart thing to do is to do a threat analysis to consider likely crisis situations. This is usually done in a brain storming session by contemplating a list of likely disasters. These could include natural disasters like storms or earthquakes or it could include man-made disasters like terrorist bombs or war. Other crisis situations might result from loss of key data, computer systems, or cyber intrusion. Although crisis planning usually is focused on these extreme situations, it would also be possible to include possible threats from competitors, loss of key accounts, or unwanted publicity due to misconduct by key employees. During the threat analysis phase, it is usually best to consider the widest possible range of crisis situations for your organization, and decide later which are the ones that you want to plan for in the next step – scenario planning.
- Review possible contingencies – scenario planning: Now that you have listed the possible threats and crisis situations that your organization might face, it is appropriate to define which ones are the most likely and perhaps most threatening. Some situations might be obvious. For example, if your building is located near a major river that is known to flood the area periodically, then this is a scenario for which you will want to prepare. Other threats may not be as likely, but if they did occur, would be devastating. For example the treat of a cyber-terrorist attack targeted at your firm might seem remote; however, if it or a similar event occurred that caused the loss of all your important electronic files and computer systems it might be an unrecoverable event unless you had a plan. So, the key to this step is to select the most important contingencies and define the possible scenario in more detail. In other words, if this particular contingency occurred, what would the scenario look like? Defining what the situation would look like will help to define the recovery plans for that scenario.
- Identify critical preparations: After you have done some planning for the most likely or important scenarios, examine the critical preparations that must be put in place. These could be critical infrastructure like prepositions supplies, emergency kits, or back-up electrical generators. It could also be other “hot sites” for computers or data centers that would take over in the event of loss of your primary data centers. It might also include more mundane preparations like emergency calling trees, home addresses and cell phone numbers for critical personnel.
- Select and appoint a crisis management team: After you have planned for scenarios, and identified critical preparations, then you must select and appoint a crisis management team. If you have multiple scenarios, then you might have different people designated for the team depending upon the situation. Most importantly, designate a clear chain of command for the team to take charge during a crisis. They must not only have the responsibility, but also the authority to act and make decisions. If both the lines of responsibility and authority are not clear, then there will be confusion and arguments among the team when the crisis erupts which will cause them to loose focus and valuable time better spent in dealing with the actual crisis itself. If there are critical decision points where the team must get permission from the CEO or other key official, then they must understand their scope of authority to act and how to quickly reach the final authority during the crisis. Defining the key players and how decisions will get made is important to the success of the crisis management plan. Once the team is in place, they need to be trained and have an opportunity to work together as they review the plans.
- Inform & educate everyone: Once the plans and team is defined, then it is important to inform and educate everyone else. Explain important procedures like evacuation drills, emergency exits, and what is expected under the various likely scenarios. In large office complexes, you might designate assembly areas outside the building, and have people on every floor designated to do a final sweep to account for everyone during a building evacuation. Other scenarios might require educating receptionists to understand what to do if they get a bomb threat and what information to listen for when receiving the call. Thus, make sure that everyone in the organization at least understands the basics of what they might be expected to do when a crisis erupts.
- Support practice, debriefing and ongoing planning: Planning is never perfect, but it can be refined through practice. It takes a commitment by senior management to support practice drills and spend the time to review what happened during the practice sessions to refine the plan. One would hope that the plans would never need to be exercised in a real crisis; however, there is no substitute for a well rehearsed plan when a crisis occurs. Most crisis plans should be practiced at least once per year, and the plan should be updated. Key personnel will change, information and phone numbers will need to be confirmed, and key parts of the plan might need to be refreshed. It will be of little use to pull out an out-of-date plan during a crisis only to find out that the information is wrong or that the plan will not work because of changed circumstances.
The key to success in a crisis is having a realistic plan ready to execute. Good prior planning will identify not only the necessary steps, but also the required advance preparation of supplies, people, and training. Use the steps of “CRISIS” format and be ready to deal with the emergencies that your organization might face. You will be glad to have invested the time in advance of the situation.
Five Tips on Developing a Crisis Management Plan for Your Business
One of the mistakes most commonly made is to assume that all crisis plans are the same. Having worked with a wide variety of Crisis Management Teams from many different industries and sectors, they can differ significantly according to the structure and function of the Crisis Management Team. This article is intended to help you to ensure that the plan you produce is appropriate to the team and purpose for which it is designed.
There are five principal steps which should be undertaken as part of the process of producing the plan, as discussed below.
The first step should always be to determine what type of team you are writing the plan for. Is it a strategic team or tactical? It may even be a mix of the two and the plan needs to reflect this. A plan may require a completely different format and content depending on the function of the team for which it is designed. Is the team responsible for Crisis Communications? Is it offering strategic direction or practical instructions? The team’s role is the principal determining factor in the content of the plan.
Secondly, it is essential to understand how the team operates. What is the structure? What are the team dynamics? Is it a virtual team? A good plan will reflect reality – writing a plan which tries to force a team to work in a way with which they are uncomfortable is inevitably counterproductive – the plan will be ignored and therefore will become irrelevant. Should the plan assume that all issues are addressed collectively? Does the team structure mandate structured review points? Find out how they work and construct the plan around it.
Thirdly, what does the team want from the plan? Some plans offer lots of detailed information, others high-level checklists and flow charts. There is no “right” answer, except that the plan must give team members the level of direction and information that they feel is useful and appropriate. Typically, for example, presenting Senior Management with a plan full of pages of close-typed text is pointless. Equally, at a tactical level more information may be required. This can only be determined by working with the team.
The fourth step is to make sure that the layout of the plan is logical. The best plans map to the response process. Content should be ordered in a logical progression which guides the team through the steps of the Crisis Management process in the order in which they are likely to arise. There is nothing more frustrating than leafing through a plan to try to find what you need in Appendix C when you are operating under pressure. If my next step is to conduct an impact assessment, I would expect to see the impact assessment form on the next page, not buried in an Appendix. Remember – above all else, the Plan is a working tool.
Fifth and potentially most important is to get the team to rehearse using the plan before you finalize it. Remember, these are the people who must use it in anger. Regardless of how good you think it is or how much input you have had from the team in developing it, there will be bits that just don’t work in practice or which can be improved. Also, people are much more likely to use the plan and follow the process if they feel that they have had a hand in developing it.
Often, Crisis Management Plans are developed independently of Crisis Management Teams, who are then expected to use them – clearly, this isn’t likely to promote engagement with the process. Every crisis plan is unique to the team it supports and the organization for which it is designed. There are no short cuts to preparing them and attention needs to be paid to the detail to ensure that it does what is required. The best way to validate your crisis plan is to run a scenario-based exercise as a table top and see how the team(s) find it – and develop it from the feedback.