As an operational risk consultant, I often encounter clients who have no business continuity plans — “Too much time and money” or “We don’t have anyone on staff who knows how to do that kind of stuff.” These clients opt instead to create plans around disaster response and/or crisis management. Sometimes such plans are emergency management oriented, with a fat binder full of procedures and acronyms that few in the organization understand or consult in time of emergency.
A little detective work often shows that the emergency management plan was by and large lifted from another organization, resulting in a poor fit, or perhaps the plan was created by former staff members who took a couple of FEMA courses. As a result, drills or scenario tests are often nonexistent, the binders grow dusty on the shelf, and the organization itself is at risk in terms of its readiness to handle any type of high impact event.
I led the Washington Mutual (WaMu) Crisis Management Team for six years, and worked on a Financial Services Roundtable blue ribbon commission to consider and write recommendations around mega-catastrophes. Over that time, I reduced the size of the WaMu crisis management team from 23 members with assorted titles, to 10 senior executives. Though each of the lines of business had strong business continuity plans, we saw the work of the crisis management team as separate and distinct from those plans.
Each member of the crisis management team owned an operational piece of decision making during events that included the California wildfires, Florida hurricanes, west coast earthquakes, New York snowstorms, and the 2003 east coast power outage. My colleague, Al Wilson, called being a member of the team “sitting in the big chair.” That’s still the best definition of the work that I have. I have taken many of the refinements that we made in the crisis management program at WaMu into the work that my firm does today.
We work on such programs with a variety of clients, most often in six of the nation’s critical infrastructure sectors: banking and finance, energy, technology, telecommunications, public health and emergency services. I described one extreme earlier, where a firm has crisis management procedures but no business continuity plans. But there’s another extreme, where large firms improvise their response to high-impact events because they have binders full of business continuity plans but no good strategy for handling crises or disasters.
These are the two extremes, both of which present operational risk exposure and illustrate the need for sound but streamlined crisis management plans. Let's start by looking at the characteristics of effective members of a crisis management team:
- Senior level executives, with direct responsibility for key business operations.
- Senior corporate executives to speak for Human Resources, Facilities, Legal and Communications.
- Calm and graceful, and respectful under pressure.
- Ability to analyze and make decisions from the big chair, for the whole organization, not just one’s own area of responsibility.
Once you’ve identified effective members of the crisis management team, you have begun to establish a well-oiled team. At the heart of crisis management lays the ability to obtain good outcomes using split-second timing. Practice makes perfect, especially if the organization is willing to run drills and scenario tests around the commonest risks faced.
Creating a “playbook” that outlines, in a streamlined fashion, the most common events and the range of decisions around each type of event does work, especially if the playbook gets thinner — not fatter — because actual events, as well as tests and drills, have refined the work. A particular challenge these days is the new world in which we live with iPhone photos, real time Tweets and Facebook updates. No longer is it only mayors who lose their next election over a badly handled snowstorm. Chief executives are retiring early or sent on their way by boards for mishandling situations that outrage both the public and shareholders.
A good crisis management team analyzes on-the-ground reports from the various lines of business and corporate support areas. Business units are executing on their business continuity plans, which may mean they have already turned to work-around solutions, hoping that you will solve the large problems so that everyone can return to normal operations. What are the types of decisions, then, that a crisis management team is responsible for?
- Determining whether employees should stay at work, report to work or work from home.
- Evacuating employees if necessary from foreign locations.
- Determining whether emergency assistance may be offered to employees.
- Authorizing unusual expenses; an example of such expenses may be extra security personnel to monitor a facility that has been damaged.
- Authorizing internal and external communications, with a strong element of shaping the story that will be told by the team.
- Consideration then action on legal advice that may cover a wide range of topics, from liability to reputational risk exposure.
- Updates to regulators and to boards of directors, so that there are no surprises.
In summary, a good crisis management team is empowered to make the optimum set of decisions on behalf of an organization. Over time, the team can operate from a playbook that bears a strong resemblance a streamlined set of checklists. Such a playbook allows the team to handle lower level events with dispatch, and meet higher impact events with a level of knowledge and competence not otherwise possible when juggling too many new fast balls.
Crisis management might involve determining how to handle a large scale technology failure. On the other hand, it might involve deploying employees from other parts of the country to handle services while local employees help their families after a devastating wild fire or hurricane. Crisis management is not simply the management of natural disasters, though we have certainly had our share of them in the past several years. It is much more than a compilation of procedures. It is decision making at its highest level.
For more information, please visit www.anniesearle.com.
