Preparing for Crises

Quite appropriately, SMEs prepare for incidents and crises (as we define them in the preceding section) in broadly the same way and look to use many of the same personnel, facilities and ways of working when responding to disruptive events. On the one hand, this approach is entirely proper and reasonable; but remember that in the measures you adopt a point may come while responding to an incident (and possibly arise very quickly) when it takes on the character of a crisis.

In this section, we assist you in preparing for that eventuality. To do so, we need to consider crisis management in the round, focusing on what you and your team need to think about and do before the crisis hits you. That’s another way of saying what you and your team need to do now.

Crisis preparation is about a number of different things:

Spotting what may cause you trouble, outside and inside your organisation.

Having BC arrangements in place.

Developing a crisis management capability within your organisation that entails:

• Setting the tone from the top that crisis preparation matters.

• Defining roles and responsibilities.

• Writing and maintaining a plan.

Validating your arrangements; that is, testing them.

Remember what Snoopy said: ‘Five minutes before a party is not the time to learn how to dance.’ In the same vein, crisis management is not about ‘winging it’ on the day when things go wrong. As many organisations have discovered, that approach is the most reliable route to business failure.

To help you avoid succumbing to this serious error, we now describe the measures you need to take.

Scanning the horizon to spot trouble

Horizon scanning is the process of spotting risks and issues (which we discuss and distinguish in the earlier section ‘Examining risks and issues’) and other potential sources of crisis. The horizon metaphor is useful because it implies that spotting problems isn’t primarily about keeping an eye on day-to-day disruptions (though these still have crisis potential if not handled effectively through BC).

Horizon scanning is about looking further ahead, from side to side and inside your organisation as well as outside, and looking for potential problems that may, at some time and in some way, give rise to a crisis or other disruption.

Special interest groups castigate large corporations, institutions and governments (especially with hindsight) for failing to act on warnings and clear evidence of impending crises: for example, of hurricanes, car-safety problems, unsafe level crossings, sex abuse scandals or illegal infringements of privacy. After all, the public view goes, such institutions have the resources to find and fix problems. Hindsight is of course a wonderful thing, but don’t assume that interest groups are going to cut SMEs much slack purely on the basis that they have fewer resources to devote to this task.

People are unlikely to forgive any organisation that fails to respond rapidly and effectively to events that cause harm, loss, fear or sustained inconvenience. You need to carry out a balancing act here. On the one hand, horizon scanning can identify risks and issues to address before they become a problem. But on the other hand, you can’t root out every risk and issue – risks are a fact of life and some things just appear unseen out of left field, and so trying to plan in detail for every eventuality isn’t an option either. Having a crisis management capability, however (as we describe in the next section), can help you tackle both the foreseen and the unforeseen.

Developing a crisis management capability

A capability in this context is your organisation’s ability to do something effectively – in this case handle all the activities associated with crisis management. Developing such a capability requires you to consider a number of different aspects including:

The way you think about risks, issues, your vulnerabilities, strengths and weaknesses as a company.

The way in which your business is structured and organised to deal with problems.

The degree to which you and your staff are ‘all on the same page’ and willing to face up to challenges together.

The practical dimensions such as logistics that ensure that people carry decisions through into (the right sort of) action.

You can prevent or interrupt many potential crises through contingency measures, and so business continuity is a critical tool to any organisation. BC alone, however, can’t guarantee that you contain all potential crises, perhaps because they arise from issues that you didn’t foresee or were of a severity that overwhelmed existing arrangements. For this reason organisations must give thought to how they would respond strategically to such crises, where a failure to get it right can have terminal consequences for your business.

We elaborate on some of the critical dimensions of a crisis management capability in the next few sections.

Assuming leadership

Leadership is important at the best of times; during the worst of times it becomes vital. Good leaders accept reality quickly, face the harsh facts and lay out the firm’s direction. The saying ‘management is doing things right, but leadership is about doing the right things’ certainly holds true for leadership in a crisis.

Great leadership isn’t about asserting detailed control over every aspect, but involves setting the overall direction, communicating that with clarity and then inspiring and motivating people to achieve what you set out.

Defining roles and responsibilities

Because crises are inherently uncertain, you can never be quite sure what you’re going to have to deal with. This uncertainty makes it all the more important that you define generic roles and responsibilities – the ones that the organisation is going to need whatever happens.

Many staff members fear that they’ll be expected to undertake tasks that they’re unable to cope with. Crises are stressful enough without making it even harder for staff, and so stick to the principle of ‘broadly normal roles under extraordinary circumstances’.

Ensure that the roles you expect staff to play in a crisis are as close as possible to the ones they carry out under normal business – they know how to do them, so don’t complicate matters. For example, information management and log keeping is critical in a crisis, and so aim to use staff with data processing or similar expertise.

Creating a crisis plan

Plans can be a two-edged sword. Not having thought about and developed a plan almost certainly consigns you to failure, and yet many organisations develop plans of impressive length and remarkable detail, only to discover that they don’t help much when a crisis erupts.

When this happens, doggedly trying to stick to the plan, or worse, fit the crisis to the plan instead of the other way round, is usually the worst thing you can do.

Incident management and BC plans are likely to be reasonably detailed. This is appropriate because you can foresee and describe the risk impacts to time-critical activities and dependencies with a fair degree of accuracy. Therefore you can set down in detail what people need to do in the event of incidents arising. Crisis plans, in contrast, need to be much shorter and more flexible, reflecting the inherent unpredictability of such events.

Successful crisis responses are fast, well-informed, involve good decisions, communicate appropriately and manage the return to business as usual, sensitively and effectively.

Although no single template exists for a crisis plan, it needs to cover the following points:

People involved: The plan needs to identify who’s authorised to determine that your business is facing a crisis and so activate the plan. Practically, it also needs to include up-to-date contact details and other information such as out-of-hours security, log-on passwords, door codes and so on, which enable people to access the building, log on and get working.

Getting started: The plan needs to stipulate what people are expected to do from the word go. Getting this clearly written down, perhaps as an aide memoire, is critically important – remember that people are likely to be under stress and that’s when mistakes happen.

Information management: You can’t hope to manage events to your advantage if you don’t really know what’s going on. Information is therefore the lifeblood of crisis management. You have to consider carefully all potential information requirements against all reasonably foreseeable crisis scenarios and practically define how you would:

• Find the information you think you’re likely to need.

• Get hold of that information in practice.

• Assess the accuracy, timeliness and relevance of the information.

• Collate and transform raw information into the various briefing and information products required.

• Maintain your awareness of what’s going on.

Agreeing objectives: The military refer to ends, ways and means:

• Ends describe what you’re trying to achieve.

• Ways are the options for achieving those ends.

• Means are the resources at your disposal to achieve the ends.

One of the early priorities for a crisis management team is to produce a statement that defines, agrees and communicates the desired end state that everybody is working to achieve.

Joining it all together: To be truly effective, a plan has to ensure that the organisation is acting as a coherent whole. For example, unless you take steps to ensure this, you may well end up in a situation where your senior staff have decided to do one thing, your operational managers are working to achieve another thing and your communications staff are saying that you’re doing something completely different. This situation is bad enough at the best of times, but when you’re trying to assert control, and be seen to be in control, it undermines all your efforts.

Very often business owners and managers assume that people will do things, or that things will happen, in a particular way. The solution is one word: check!

Sustaining the effort: Responding to a crisis is likely to start with a sprint, as you seek to assert initial control and organise your response, but it turns into a marathon. If you overstretch your staff and yourself, you’re going to fail. You need to face up to this reality and set expectations and working practices that are sustainable for weeks and months rather than days.

Training

You train and prepare for most things that you expect your staff to do – customer service, accounting, health and safety, and a range of other skills central to success – and crisis management is no different.

If, after diligently considering your risks and taking steps to develop a crisis capability, you don’t train your staff in what’s expected of them, you’ve largely wasted a lot of effort.

Some common misconceptions abound about crisis training, and so we repeat the guiding principle of ‘broadly normal roles under extraordinary circumstances’. Of course, you expect employees to operate under different conditions and probably at a higher tempo, but that’s where the training comes in. It builds employees’ awareness, hones specific skills and above all gives them confidence that they can play their role in any crisis response.

Here are two final points on training to consider:

Prepare yourself adequately. Don’t fall into the trap of being overconfident. Seek out specialist training from which you think you’d benefit.

Don’t be tempted to try to conduct training through means of an exercise that’s also intended to test your preparedness measures. It may seem like an efficient approach, but you won’t achieve either aim properly. You’re likely to leave your staff lacking knowledge and confidence and still not have any real idea of whether your plan is up to the job. Train your people for the anticipated roles, and then look at validating your arrangements.

Validating: Are you ready?

Validation is the process of assuring your readiness for a crisis. You can go about this in different ways; some are relatively exploratory and others may feel much more like a test with a pass/fail result. Cutting to the chase, the most important thing is to do something rather than nothing, and then take stock afterwards.

Chapter 11 explains what validation is all about, how to go about it, and what the various options are.

Whichever approach you undertake, don’t be too easy on yourself – prepare one that gives you, your team, your systems and your plan a thorough workout.

Observe the following mantra: prepare for the worst, hope for the best – and if that sounds like something the US Marines would say then it probably is, but it’s the way to go. Many organisations have made themselves feel really good about their crisis preparedness by validating their arrangements with scenarios that are, frankly, far too tame. The scenarios you choose have to test your organisation; prepare for the reasonably foreseeable worst case, instead of something you reckon you can cope with.