In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal Consultant and CEO Bryan Strawser talks about the first question that any potential client asks: Shouldn’t I have a plan for alien invasion??!
That’s not really the question, of course. What gets asked is this: Shouldn’t I have a plan for X?!
That situation could be an active shooter, a workplace violence threat, executive misconduct, a data breach, or a host of other common threats that businesses are faced with in today’s uncertain world.
Instead, Bryan steers the conversation towards the idea of a crisis management framework. In other words, a process to triage information, escalate an incident into a broader crisis, and then manage that crisis through a defined decision making and communication process.
Now your company is able to deal effectively with any situation that it is facing, rather than just those where plans have been already put into place to handle.
| Hello and welcome to the Managing Uncertainty podcast hosted by Bryghtpath, LLC.
Managing Uncertainty is a podcast series where we discuss global risk, crisis management, business continuity, and crisis communications. We talk about strategies, tactics, and resources that help you prepare for, respond to, and recover from all sorts of disruptions and critical moments. Our goal is to make sure that you’re ready to lead through your company or organization’s critical moment. I’m Bryan Strawser, the founder, principal consultant, and CEO at Bryghtpath.
|
| On today’s episode we’re going to be talking about the one question that I always get when a new client calls, when someone is calling us asking for our help or our advice on learning how to prepare for some type of critical moment or disaster that they see in the future. The question that I always get is shouldn’t I have a plan for some type of situation that’s on their mind?
These days it’s often an active shooter scenario or a food safety product recall, workplace violence or executive misconduct. These seem to be very popular crisis situations that companies are preparing for today. My answer to this always is that having plans is great. Companies should build plans for the risk that they anticipate could happen to their organizations, for the disruptions that they think could happen to their locations or their headquarters or their employees, and they should plan for those situations that can really cause harm to their assets particularly their people around the world.
|
| In my mind, from my experience, crisis management doesn’t really start by building a set of plans. It starts with thinking about what I like to call a crisis management framework. We use this a lot in our consulting practice. That before you get to build plans, you should start by understanding how your organization at a strategic level is going to prepare for situations by building a decision-making and communication framework, basically a decision-making process that you’re going to use when these situations happen. Because if you don’t build something like this and instead you build a set of plans, you’re eventually going to find yourself in a situation where you’re confronted with a business disruption or a crisis or a risk that you never anticipated and for which you don’t have a plan. Now all of a sudden, because you have never built a decision-making process, you’ve never built a crisis framework, you’re not sure what to do.
|
| I think a great example of this from recent history is the huge earthquake that the country of Japan faced back in 2011. They saw, I believe, one of the five worst earthquakes that’s ever happened in US or world history, rather. It was combined with a massive tsunami that came ashore not long after the earthquake. Now you have a country that’s dealing with this massive earthquake and the damage that it brought. You have a huge tsunami that comes ashore and kills thousands of people and creates a massive amount of damage to northern Japan. Then as we all know, within the next few days becomes the looming radiological disaster that happened at the Fukushima nuclear plant.
|
| Arguably going into this situation, anyone could say that Japan was, perhaps, the best-prepared company in the world, the best-prepared country in the world, rather, for an earthquake. They were perhaps the best-prepared country in the world for a tsunami. They were lauded for their nuclear safety and emergency procedures. But they found themselves confronted with all three at the same time. Because they didn’t have a good method on how they were going to deal with this, they didn’t have a good situational awareness, their response caused a lot of criticism and certainly led to a very difficult recovery period and response for the country as a whole.
|
| What we want when we’re planning for a crisis situation is to start with this idea of a crisis management framework. What you’re building is a process by which your organization is going to make decisions on a strategic level to respond to a crisis, to a business disruption, and then how you’ll recover from that disruption. When we think about a crisis framework here at Bryghtpath, we start by understanding what our crisis strategy for an organization is going to be and how do we connect that to the company’s strategic objectives, the threats and vulnerabilities that are in front of them, and what allies and advocates might they have when they find themselves in this difficult situation.
|
| From there, we like to build a crisis playbook by establishing some sort of corporate crisis management team, a defined escalation process by which situations are escalated from, perhaps, disparate incident processes throughout the organization into the corporate crisis management process where they are now being managed by this higher-level group of cross-functional leaders on a corporate crisis management team. Here we’re talking about funneling at an enterprise level different types of incidents that are occurring that suddenly have become a crisis. We advocate having a single corporate crisis management team that deals with things once they reach that level. Here we’re really thinking about incorporating incidents like information, security incidents, technology incidents or outages, physical security incidents, financial situations, perhaps a liquidity crisis for an organization, and even things like a cyber breach or executive misconduct, all of which are now crisis situations that a company’s dealing with. We’re pulling them into this corporate crisis management team once we’ve hit a set of escalation triggers, and we’re letting this higher-level group of leaders manage through this situation and then communicate out through their internal and external communication process those decisions. So we’re working through this decision-making framework.
|
| Once we’ve established that, then we can start to identify scenarios. We can build specific crisis plans starting with the top five, 10, 15 or so risks that the organization has identified. We can build crisis communications plans that line up with those risks and the crisis plans. We can build a rapid response process that allows for quick response to reputational situation and the communication aspects. Once we’ve built all of this and we’ve trained the corporate crisis management team and we have rolled this method out, then we can practice it by working through a full-blown crisis simulation and exercise and then reap the results, review the results of that exercise, and build an after-action plan to close the remaining gaps that we see. That’s just the start. That’s the beginning. We’ve laid out a crisis strategy. We’ve laid out the playbook. We’ve established our corporate crisis management team.
|
| Now comes the hard part. In order to really have this escalation process work effectively, it’s important for companies to build what I like to think of as a radar screen. It’s a 24/7 monitoring process. It can be outsourced to an organization like ours, and this is one of the things that we do, or it can be an in-house command center or operations center that’s really monitoring globally events and occurrences and threats that can impact the organization. They’re giving that early warning for the corporate crisis management team and other senior executives on what’s happening. This can also be a center or process that monitors social media or general media reporting and is able to provide that back to the organization as well.
|
| The next component is just ongoing education, that it’s important that employees, particularly managers and leaders and senior leaders within the organization, understand the process and understand their role in an emergency at their location or within their area of responsibility. It’s important that we have an ongoing approach to practice this process through exercises and training. Then there’s an opportunity, here, to look at how do we influence and in keep informed our external allies and influencers. These could be bloggers or advocates of your organization or partners you’ve worked with on community engagement in the past that you can leverage when there is a crisis situation in the future.
|
| These are all preparation steps that we take in advance of a crisis. When we find ourselves in that critical moment, now we’re prepared. We have a decision-making process. We have a communications process that we’re going to follow. So when the critical moment comes, we activate that corporate crisis management team. We’ve got an early warning through our radar screen, our 24/7 monitoring process. If needed, we can activate a communications rapid response process. We can bring in help from experts that we’ve identified in advance of a crisis. And we can start to execute our plans that we’ve built if the crisis is one of those top risks that we’ve identified and built plans for. But if it’s not, if it’s not something we’ve anticipated, we can use the framework. We can use our decision-making process with the corporate crisis management team to really respond to that and use that methodology to make decisions and communicate the results of that decision-making process.
|
| When the critical moment is over, the immediate response is wrapping up, then we can shift into recovery. We can take stock of our plans and our performance and see where we need to make changes and improvements. We can communicate those activities broadly. Hopefully we’ve executed on this well. We’ve made strong decisions, and we’re able to make that into a story we can tell that enhances our organization’s reputation. We can go back and update our crisis playbook and our plans that we’ve built, and we can assist our employees and others with long-term recovery challenges.
|
| This is a very simple overview of what a crisis management framework can be. Again, the core is that you want to get to a decision-making process that integrates the different types of situations the company, your organization, might be confronted with. They go into one decision-making crisis management and communication process that has clearly defined roles and responsibilities and decision-making rights within the organization. Then no matter if you have a plan or not, you have a process by which you can effectively lead your organization through this critical moment and hopefully come out stronger on the other side.
|
At Bryghtpath, we’re often asked about risks and threats faced by Senior Executives of major corporations and non-profits – and how to best go...
In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses three books he’s read that have impacted our...
In this episode of the Managing Uncertainty Podcast, Bryghtpath Principal & Chief Executive Bryan Strawser discusses what is resilience? The concept seems straightforward in...