0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:29 Page 2

Crisis Management
of Critical Incidents

EISF Briefing Paper

European Interagency Security Forum (EISF)

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:29 Page 3

European Interagency Security Forum

The European Interagency Security Forum is an independent platform for Security
Focal Points from European humanitarian agencies operating overseas. EISF
members are committed to improving the safety and security of relief operations and
staff, in a way that allows greater access to and impact for crisis-affected populations.

The Forum was created to establish a more prominent role for security management
in international humanitarian operations. It provides a space for NGOs to collectively
improve security management practice, and facilitates exchange between members
and other bodies such as the UN, institutional donors, research institutions, training
providers and a broad range of international NGOs.

EISF fosters dialogue, coordination, and documentation of current security

management practice. EISF is an independent entity currently funded by DFID
and hosted by Save the Children UK.

Acknowledgements
This Briefing Paper is authored by Pete Buth, and edited by the EISF Secretariat.

EISF would like to thank the following, who contributed to this paper either through
interviews or the peer review process: Jim Arbogast (Médecins du Monde), Shaun
Bickley (independent consultant), Jane Gibreel and Michael O’Neill (Save the Children
Alliance), and Wouter Kok (independent consultant).

While all provided significant input and feedback, any errors remaining are EISF’s alone.

Disclaimer
This document has been prepared by Pete Buth, an independent consultant (the “author”), and
has been distributed by the European Interagency Security Forum (“EISF”). EISF is a member-led
grouping and has no separate legal status under the laws of England and Wales or any other
jurisdiction. References to EISF in this disclaimer shall mean the member agencies, observer
agencies and Secretariat of EISF.

While both EISF and the author of this document endeavour to ensure that the information in
this document is correct, they do not warrant its accuracy and completeness. The information in
this document is provided “as is”, without any conditions, warranties or other terms of any kind,
and reliance upon any material or other information contained in this document shall be entirely
at your own risk. Accordingly, to the maximum extent permitted by applicable law, EISF and the
author exclude all representations, warranties, conditions and other terms which, but for this
legal notice, might have effect in relation to the information in this document. EISF and/or the
author shall not be liable for any kind of loss or damage whatsoever to you or a third party
arising from reliance on the information contained in this document.

Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:29 Page 4

Contents

Foreword 02
1 Introduction 03
2 Definitions 04
3 Rationale and Objectives 05
4 Crisis Management Planning 06
4.1 Organisational Responsibility 06
4.2 Crisis Management Plan 06
4.2.1 Key Pillars of Crisis Response 07
4.2.1.1 Communications and Reporting 07
4.2.1.2 Crisis Management Team (CMT) 07
4.2.1.3 Incident Management Team (IMT) 09
5 Crisis Management 10
5.1 Operational Response 10
5.2 Human Resources Management 11
5.2.1 Administration 11
5.2.2 Family Support 11
5.2.3 Staff Support 12
5.3 Media Management 12
5.4 Information Sharing with Other Stakeholders 12
6 Post-Crisis Follow-Up 13
Annex 14
Checklist 14
Decision-Making Flowchart 15
Sample Format: 1st Critical Incident Report 16
Sample Format: Logbook 17

01 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:29 Page 5

Foreword

The two EISF Briefing Papers entitled Crisis Management of Critical

Incidents (April 2010) and Abduction Management (May 2010)
should serve as reference documents for reflection on how to
improve the prevention and management of critical incidents within
the humanitarian sector. They benefit from the knowledge and
experience of a wide range of organisations, experts and victims.
The papers are intended for those responsible for and involved in
the management of critical incident and crisis management
mechanisms within humanitarian agencies. However, all
organisations deploying and contracting employees in
environments where the infrastructure to deal with critical incidents
is limited or unreliable, should find them valuable.
Prevention is key. By establishing robust crisis management
mechanisms you can optimise preparation and reduce the risk of an
incident occurring, or diminish its impact.
Crisis management is both an art and a science. Best practice is
constantly evolving in response to the changing humanitarian
environment. We would therefore be grateful to receive your
comments and feedback, to ensure the Briefings are kept up-to-date
and improved on where we can.

Every success,
Oliver Behn
Executive Coordinator

eisf-coordinator@eisf.eu

02 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:29 Page 6

1 Introduction

Safety and security incidents are a daily reality for aid Abduction is by far the most complex type of critical
and development workers. By default, deployment of incident an agency may be confronted with. Whilst the
staff to remote and often insecure areas lacking basic essential pillars of effective crisis response apply to
infrastructure, implies acceptance by humanitarian abduction management, its complexities require
organisations that incidents may occur. Instances in a more specialised response and thus warrant specific
which staff are threatened or experience serious harm consideration and preparation within an overall crisis
are commonly referred to as critical incidents. A small response plan (training, expertise, protocols, etc.).
percentage of critical incidents may become crises: Characteristics of abduction incidents and tenets of
those requiring an immediate, dedicated organisational abduction management are addressed in a separate
response beyond the scope of in-country contingency EISF Briefing Paper on Abduction Management.2
planning and management structures.
The contents of this document are intended to serve
Such crisis situations fortunately remain rare, yet as general guidelines only. They are not prescriptive,
instances are rising, particularly in an expanding group nor do they set any standard or norm required for the
of contexts including Afghanistan, Pakistan, Sudan and successful resolution of crisis situations.
Somalia, among others.1 Establishing and maintaining
capacity to adequately respond to incidents is thus
increasingly a priority for aid organisations.
This EISF Briefing Paper focuses on preparation for
responses to critical incidents constituting crises. As is
the case for all risk management mechanisms, a one-
size-fits-all template for incident response does not
exist: crisis plans must be tailored to organisational
structures and capacities. The purpose of this document
is thus not to prescribe a blueprint for crisis planning,
but to emphasise the importance of robust crisis
response capacity as part of a comprehensive security
risk management system. The essential facets and
mechanisms required in designing such a plan are
also outlined here.

1 Abby Stoddard, Adele Harmer and Victoria DiDomenico, 2009. Providing aid in insecure environments: 2009 Update. HPG Policy Brief 34 (April).
2 To be published in May 2010.

03 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:30 Page 7

2 Definitions

A standard lexicon for incidents requiring a specific Critical incidents frequently constituting crises include
organisational response, the management of this but are not limited to:3
response, and appropriate plans and protocols,
• Abduction, kidnap or hostage-taking
has not been agreed amongst humanitarian NGOs.
Irrespective of the varied terminology in use across • Murder or death in suspicious circumstances
the sector, such a vocabulary should be well defined
• Incidents causing multiple casualties and requiring
and consistently applied throughout an individual
urgent response (medical, operational, psycho-social)
organisation’s crisis response documentation
and management. • Arrest or detention
Definitions of the terms used in this Briefing Paper • Other security situations or events causing
are as follows: a high degree of threat to staff
A crisis is an event that significantly disrupts normal • Complicated or large-scale evacuation,
operations, has caused or is likely to cause severe or medical evacuation (“medevac”)
distress or have severe consequences for individual staff
When such incidents occur, special structures and
or organisations, and requires out of ordinary measures
policies may be activated to supplement regular
to restore order and normality, thus demanding
management capacities.
immediate action from senior management. Crises can
come in various forms, and include events threatening A Crisis Management Team (CMT) manages a crisis
an organisation’s reputation, image, programmes, situation at headquarter (or regional) level. A CMT is
assets, financial stability or the safety and security of its activated when a critical incident or any other situation
staff. In this last case, a crisis may be precipitated by a is determined to be a crisis by senior management. The
critical incident. composition and role of a CMT differs according to the
type of crisis.
A critical incident (CI) is an event or series of events that
seriously threatens the welfare of personnel, potentially An Incident Management Team (IMT) manages a
resulting in death, life-threatening injury or illness. Most critical incident at country level. In the case of a critical
critical incidents – although they may have potentially incident constituting a crisis this will occur under the
severe impacts on individual staff and programmes – direction of the CMT. IMTs may also be formed in cases
do not have wider implications for the organisation as a of incidents not constituting crises, where they will
whole and are thus managed by regular management operate under regular management structures.
structures, with additional support from headquarters
A Crisis Management Plan describes mechanisms,
if required.
responsibilities and protocols to be activated by an
A critical incident or series of such incidents becomes organisation in the event of a crisis.
a crisis when its nature, severity or broader
This Briefing Paper focuses upon the management of
consequences for an organisation warrant a
crises precipitated by critical incidents. Crises can be
response beyond the capacity of routine programme
caused by other events – for instance, an NGO may
management mechanisms, i.e. requiring leadership
experience a financial crisis due to its major donor
and coordination from senior management level.
countries suffering economic recessions – but these
are beyond the scope of this paper.

3 Note that the types of incident listed here do not automatically constitute crises. For example, the abduction of a national staff member may be managed
within the regular management line (with additional support from headquarters) if all stakeholders are present in the area of operation and wider implications
for the organisation are minimal.

04 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:30 Page 8

3 Rationale and Objectives

The objective of crisis preparedness is to mitigate the 4. Ensure programme continuity.

impact of an incident. Since the quality of crisis response
In addition to mitigating the impact of a crisis on
has potentially significant influence over an incident’s
organisational management, good crisis
outcome, it should be regarded as fundamental to the
preparedness contributes to the ability of agencies to
humanitarian risk management system. Strong capacity
continue programme activities during a crisis and/or
for crisis response and preparedness is necessary
re-start operations in its aftermath.
in order to:
5. Fulfill organisational responsibilities and reduce
1. Prevent (further) harm and ensure the health
the risk of litigation/liability claims.
and/or safety of victim(s) and other staff affected
by the crisis. Contractual obligations and related litigation risks
vary by country, since they are subject to national
The first hours following (the onset of) a crisis are often
legislation. Agencies must ensure that they are fully
the most crucial, rendering instant reporting, a clear
aware of relevant legal labour frameworks, including
division of roles and responsibilities, and fast
those for national staff in each country of operation.
decision-making an absolute necessity.4 This requires
comprehensive preparedness: protocols and 6. Safeguard organisational image and reputation.
flowcharts in place, and relevant staff trained and
Inadequate crisis response, or perceived mishandling
available.
of a crisis (in the eyes of media and/or family), can
2. Assure families of victims and agency staff negatively affect organisational image, with myriad
of a responsible and effective response. consequences in countries of operation and at the
international level (fundraising, recruitment, etc.).
Obtaining and maintaining the confidence of families
Again, a strong and professional crisis response
of victims is important in terms of establishing good
will help to mitigate this risk.
relations and making sure all stakeholders are “on
board” during and after the incident. This naturally A caveat: safeguarding organisational reputation,
also applies to agency staff. while an important consideration, should never
take precedence over the safety and well-being
3. Ensure continued organisational management
of staff, which remains the primary objective of crisis
and output during the crisis.
management within humanitarian agencies.
Crisis management, especially for enduring incidents
(for example, abductions), is resource-intensive.
Crisis planning and preparedness will mitigate the
risk of unnecessary distraction of senior
management, thus contributing to the ability of
agencies to continue functioning.

4 For example, in urgent medical emergencies, or when the security situation requires immediate evacuation of staff.

05 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 9

4 Crisis Management
Planning

As explained in Section 2, not all critical incidents Insurance

require a formal crisis response. At country level, critical
Adequate insurance policies (health, medevac, life,
incident preparedness is part of the Country Security
disability, etc.) are a key component of critical incident
Management Plan.5 At headquarter level – which will
response preparedness. The main purpose of such
be activated when a critical incident is determined to
policies is to:
constitute a crisis – critical incident response planning
forms part of the organisational Crisis Management • Fulfill legal and contractual obligations carried
Plan. This section outlines the dimensions of such crisis by the employer
management planning.
• Manage organisational financial risk
• Provide clarity for victims, families and managers
4.1 Organisational Responsibility during crisis response7
Agencies must determine the level of responsibility
they are prepared to accept for all categories of
4.2 Crisis Management Plan
staff: contracted staff, seconded staff, volunteers,
consultants, staff of partner organisations, national The purpose of crisis response preparedness is to
and international staff. create and maintain organisational ability to adequately
respond to and manage a crisis. Whilst every incident
First and foremost, organisational responsibility with
is unique and will require a tailored response, it is
regard to crisis response is determined by the relevant
paramount that essential capacities are in place before
contractual and labour law frameworks, which outline
an incident occurs, to enable an agency to adequately
legal responsibilities carried by the employer. These vary
manage the situation in real-time.
by country. In addition, agencies should be explicit
about whether and to what extent they will accept These capacities are stipulated in Crisis Management
security responsibility (including crisis response) for Plans, which specify:
individuals for whom they have no legal responsibility
• Definitions of various types of crisis
but may have a moral duty.6 Lastly, agencies should
ensure that these responsibilities are communicated to • Decision-making structures for activating (and
relevant staff and partners, to curb unrealistic terminating) formal crisis response mechanisms,
expectations and potential liability issues. This can be illustrated by flowcharts for communication and
achieved by including discussion of crisis response in decision-making
pre-deployment briefings, security workshops in the
• Roles and responsibilities of the key actors
field, contracts, and other relevant formal agreements
(senior management, CMT, IMT)
(for example, a Memorandum of Understanding with
partners). • Protocols and formats (medevac protocol,
abduction protocol, attainability protocol, incident
reporting format, logbook format, checklists, etc.)

5 Critical incident response planning and management at country level fall outside the scope of this Briefing Paper.
6 For example, if an INGO considers an area too insecure for its own staff and hence chooses to fund/support another agency willing to accept a higher level of risk.
7 For instance, to avoid discussions about the costs of a charter plane delaying an urgent medical evacuation.

06 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 10

As Crisis management plans are (hopefully) rarely The quality of information shared is as significant as the
used, particular attention should be paid to enforcing speed of information flows. In the wake of an incident,
maintenance of the plans, and interactive testing at information may be sketchy, and facts may mingle
frequent intervals. This would normally include: with unconfirmed information or speculation. Incident
reporting formats aid the collection and reporting of
• Regular training (including simulation exercises)
information in a systematic fashion. Detailed record-
for relevant staff on their roles and responsibilities.
keeping, to allow thorough analysis during and after
Practising crisis response at regular intervals is
the incident, is also essential (see Annex).
strongly recommended in order to familiarise CMT
members with crisis plans, enhance CMT team
dynamics, allow disagreements amongst team
4.2.1.2 Crisis Management Team (CMT)
members to surface within a safe environment8,
and identify weaknesses in crisis plans. CMTs form the core of Crisis Management Plans. A
CMT is automatically activated when a critical incident
• Reviews carried out after each crisis (i.e. internal
is classified as a crisis by senior management (see
lessons-learnt workshops, or external evaluations)
Section 2). CMTs are exclusively dedicated to the
• Regular updates of protocols, flowcharts, checklists successful resolution of crises, and usually operate
and phone numbers as required (see Annex for outside of regular management structures: the Head
more details) of a CMT reports directly to senior organisational
management9; CMT members report to the Head
of a CMT rather than their regular line managers.
4.2.1 Key Pillars of Crisis Response
The composition and functioning of a CMT should be
For appropriate response to and management defined by the following key characteristics:
of a crisis, it is essential that a number of key facets
• As small as possible yet including as many areas
are in place and managed professionally:
of expertise as is necessary to allow for fast decision-
• Communications and Reporting making and information flows, and efficient
information management
• Crisis Management Team (CMT)
• Diverse expertise, namely: Operations (context
• Management of the crisis and relevant
and incident management), HR (including psycho-
operations as required
social support), and Communications/Media. Input
• HR and family support from other disciplines should be sought as required,
although these are not normally permanent
• Media management
CMT members
• Post-Incident Follow-Up
• Ability to implement decisions; a problem-solving,
“can-do” attitude
4.2.1.1 Communications and Reporting • All members are able to fulfil their respective roles
and responsibilities (experienced, fully-trained
Time is of the essence in crisis response. Since timely
and available10), which are clearly delineated
and appropriate decision-making and reaction often
impact on the development or outcome of a crisis,
it is essential that reliable means of communication
(hardware) are in place. Robust communications
protocols, including a “24/7 HQ On-Call Protocol”, are
also key to ensuring that the occurrence of an incident
is communicated to relevant managers without delay.

8 Disagreements may result from confusion or disagreement about the decision-making process within the CMT, the level of information to be shared within the
Team or the wider organisation, or from personal rivalries.
9 CEO, Senior Management Team, Board, etc.
10 Availability refers to being present at headquarters as required, including after office hours and at short notice.

07 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 11

Responsibilities The composition of a CMT may vary depending on the

type of crisis, but should always include:
The scope of CMT responsibility should be clearly
defined in Crisis Management Plans. Agencies should • CMT leader: In charge of crisis management and
determine the extent of CMT authority in accordance accountable to senior management
with their respective management structures and
• Human Resources: HR issues, family liaison
philosophies. It is, however, strongly advised that
and support
capacity for fast decision-making is in no way
compromised. Since managing a crisis may conflict with • Media and Communications: Implementation
operational objectives and activities in a context/country, of media strategy
CMTs should also be given authority over regular
• Assistant: Minute taking, logbook keeping
in-country management structures.11
and other tasks
Key responsibilities of CMTs include:
Depending on the type of crisis, input and expertise
• Operational decision-making concerning the crisis may be sought from:
and the affected mission
• Head of operations in the country concerned
• Defining and implementing a crisis response strategy
• Context specialists
in consultation with senior organisational
management • Security specialists
• Authority to ensure implementation of defined • Medical specialists
strategy, including staffing and directing the IMT
• Legal specialists
• Defining and implementing a media strategy
• Logistics specialists
• Managing family support and liaison
• IT specialists
• Managing the internal information policy
• Consulting with all relevant internal and external
Location
stakeholders
For many organisations, the most obvious and suitable
• Managing crisis information (collation, analysis,
location for a CMT is the head office. However, agencies
distribution, storage)
with a decentralised structure may choose to establish
• Defining the moment that the crisis ends, dismantling CMTs in regional offices, or alternatively to include
the CMT, and handing-over to regular management regional staff in a head office-based CMT by virtual
structures (in consultation with senior organisational means. Decisions about where to create CMT capacity
management) will be based on the following criteria:
• Regular working locations of CMT staff
Composition • Length of communication lines (between head office
and the field)
CMT members are pre-identified based on their
disciplines and competencies, and should receive • Proximity to senior management and other key
relevant crisis management training. Every CMT stakeholders (family, media, national governments)
member should have at least one shadow/replacement for communication and coordination purposes
to ensure presence at headquarters when the primary
• Infrastructure (office space, reliability of means
CMT member is unavailable due to leave, illness, field
of communication)
visits, etc. Replacements are also crucial for operating
rotation systems during long-term crises such as • Time difference between the CMT and the
kidnaps. Replacements must also be pre-identified incident location
for the regular roles of CMT members, to guarantee
continued functionality of the organisation during
a crisis.

11 For example, when incidents involving the detention of staff require strong advocacy that could strain long-term relations with national governments.

08 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 12

4.2.1.3 Incident Management Team (IMT)

Composition of an IMT is case-specific, but members
are usually drawn from existing coordination teams.
Depending on the scale, severity and complexity of an
incident, as well as management capacity at field level,
CMTs may opt to deploy additional crisis management
staff to support or coordinate.12 The potential psycho-
social impact exerted on team members by incidents
should also be taken into account when assessing field
incident management capacity.
Common tasks undertaken by an IMT include:
• (Temporary) suspension of activities
• (Medical) evacuation of staff and repatriation
of deceased persons
• Liaison with local and national authorities, embassies,
aid agencies, and other relevant actors
• Support to families of national staff victims
• Management of local media
• Support to affected project and mission staff (including
psycho-social support)
• Immediate revision of risk analysis in light of the
incident.

12 For countries with long visa processes, agencies may consider ensuring that crisis support staff are always in possession of a valid visa, to allow for rapid deployment.

09 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 13

5 Crisis Management

Crisis response should be guided by a comprehensive During the first hours after the onset of an incident, the
set of flowcharts and protocols, which guarantee that focus is on preventing further harm for victims and other
the appropriate mechanisms are activated in a timely affected staff, obtaining and confirming essential facts,
fashion.13 The severity and type of incident will determine establishing internal information flows (phone numbers
the shape of the response, specifically: whether the and frequency of contact), setting in motion procedures
crisis management mechanism is to be activated, or to inform next of kin and other relevant actors, carrying
alternatively the incident can be managed through out a stakeholder analysis and, if warranted, agreeing
regular line management structures; and which set of on a media strategy.
protocols are to be applied. These decisions must be
The duration of a crisis may influence, but is not equal to,
taken immediately after an incident is reported.
the length of the actual event. The event of an accident
or violent robbery ends even before the incident is
reported, but the impact may warrant a lengthy crisis
5.1. Operational Response
management response, such as emergency medical
Due to the nature of crises, their management usually assistance, psycho-social support, evacuation or
requires a more centralised decision-making structure repatriation. Detention/arrest and abduction are “live”,
than regular operations. Thus, in accordance with the ongoing events, the duration of which is unknown.
mandate issued by senior management, a CMT is Outcome scenarios should be contemplated from the
responsible for directing operational response and beginning of an incident. As crisis response at field level
strategy. The role of an IMT – whilst it will of course is resource-intensive, it may be necessary to temporarily
participate in decision-making due to its detailed downscale or suspend other in-country activities to
knowledge of context, incident details and other practical avoid over-stretching field management capacity, and
issues – is therefore primarily an implementing one. ensure that a thorough review of the risk assessment is
conducted before full programme activities are
The type of incident – medical evacuation, abduction,
resumed.
repatriation of deceased persons, traumatic events,
general crisis response – will dictate which protocol is to Other actors may be part of, or leading, an operational
be applied. The CMT leader, who manages and crisis response, as is the case in large-scale evacuations
coordinates the incident response, should ensure that organised by the UN, embassies or the military. This
decisions and directives are communicated in an should not induce a passive, reactive approach:
unambiguous and timely fashion, and oversee the agencies should ensure that they retain an appropriate
implementation of decisions as well as adherence to the level of decision-making, influence and access to
relevant protocol(s). Taking control and responsibility, information. Thus, strong coordination and
rationalising the incident, and providing a “structure” for communication channels to relevant actors must be
the incident response, the CMT leader may also have a established immediately.
calming influence on the affected team in-country,
Decisions about when to formally declare an end to a
enabling them to better fulfil their respective roles.
crisis, dismantle a CMT and revert to normal
Amongst the skills, abilities and traits associated with
management structures are dependent upon
crisis management and leadership, are perspective-
circumstances as well as the capacity of regular
taking and the promotion of a mindset of resilience
structures. For example, a CMT may retain responsibility
within staff.14
for arranging a safe and comfortable return home for
victims and staff involved, especially if media attention is
anticipated and/or active media work planned.

13 Separate protocols should be designed for medevac and abduction, as these incidents require very specific procedures.
14 See Lynn Perry Wooten and Erika Hayes James, 2008. Linking Crisis Management and Leadership Competencies: The Role of Human Resource Development. Advances in Developing Human Resources, 10 (3/June), pp.352-79.

10 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 14

5.2. Human Resources Management With respect to delivering difficult news, the organisation
itself is deemed the most appropriate messenger in
Human Resources management responsibilities can be
many cases. However, social, cultural and personal
grouped into three categories:
circumstances may dictate that police, community
• Administration elders, religious leaders and other authorities should be
included in the process. Ideally, the bearer of bad news
• Family support (liaison and psycho-social support)
should be experienced in this or appropriately trained. If
• Staff support (psycho-social support for incident from the organisation itself, he/she should be a senior
managers and other affected staff) staff member.
Each of the above categories plays an important role Designated family liaison officers (FLOs) must be
throughout the entirety of crisis management, and introduced to families as soon as possible. The type and
during the post-crisis follow-up. frequency of contact between the FLOs and families will
depend on the type of incident and the degree of
uncertainty about the outcome, as well as personal
5.2.1. Administration preferences on the part of families.
Robust administrative support is required in crisis Aspects to consider in family support include:
response and during the aftermath. As soon as a crisis
• Psycho-social support from the beginning of an
is reported, administrators should retrieve files related to
incident
personnel, provide details of named emergency contact
persons, and relevant details of victims (for example, • Assistance in finding support for day-to-day
passport details). Insurance and contract details should practicalities (child care, shopping, etc.)
also be checked. Depending on the type of incident,
• Advice on information sharing (with media and other
administrators may also be required to liaise with
third parties)
insurance companies, support international (medical)
evacuations or repatriation of deceased persons, and Family attitudes and (re)actions are not static.
compile lists of (ex-)colleagues to be informed of the Approaches may change during and after incidents as
incident. families experience changing emotions over time. The
longer a crisis lasts, the greater the risk that an affected
family will lose faith in an organisation’s ability to
5.2.2. Family Support adequately manage the crisis, and seek alternative
options for resolution.
How swiftly and through which means named contact
persons of victims (most often, but not always, family If an incident involves multiple victims, it is important to
members) should be informed, depends largely on the provide the same information to all families
severity of the incident and whether it is likely to be simultaneously, and to facilitate contact between
reported in the media.15 It may not be necessary to families according to their wishes. Further, a good
immediately communicate a late night incident that understanding of family dynamics and tensions should
does not make news headlines, and does not result in be built, so that any buffers to equitable information-
severe physical harm to victims; less stress may be sharing within the family unit are identified and, if
caused if contact persons are informed by victims necessary, multiple contacts (always sharing the same
themselves on the following morning. information) are made.
If an incident causes significant harm to staff, a face-to-
face meeting will be the preferred method of
communicating difficult news clearly and
compassionately. However, the benefits of this must be
weighed against the implications, i.e. potential delay
due to geographical distance. A situation in which next
of kin/contact persons hear bad news via the media first
should be avoided in all cases.16

15 In instances such as large-scale bombings and earthquakes that are rapidly reported in the media, it is wise to get in touch with named contact persons even if no member of staff has been affected. Reassuring family members of the well-
being of the agency’s staff will help to prevent unnecessary distress.
16 Regardless of how families/contact persons are initially informed, a visit should be arranged as soon as possible.

11 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:31 Page 15

5.2.3. Staff Support 5.4. Information Sharing with Other Stakeholders

Staff witnesses to an event, staff who are close to victims Aside from families and the media, meticulous
or who are otherwise affected by an incident, as well as management of the identification (and potentially the
members of IMTs, may require psycho-social support control) of information flows to other stakeholders is
during or after the incident. Additionally CMTs should essential. There is an inherent tension between demands
have access to professional psycho-social support for updates made by stakeholders, and the general
structures offered by the organisation. If such structures principle of “inform on a need to know-basis”.
do not exist internally the identification of external support
The timing of initial notification, identification of focal
should be a part of crisis preparedness planning.
points, frequency of contact and level of detail of the
information to be shared, must be carefully balanced in
order to prevent unnecessary delays, unhelpful
5.3. Media Management
speculations and frustrations. Grouping stakeholders into
Media reporting can have a significant impact on how a concentric “information circles” can be a useful tool: those
crisis develops (particularly in abduction and detention who require full knowledge will be at the centre of this
cases), and therefore on (often enduring) perceptions of diagram, with stakeholders requiring less and less
an agency. Hence, media management is a key priority information in circles in increasing distance from the
in “high profile” crises that are likely to trigger media centre, and those requiring the least information (for
interest at national and/or international level. example, the press) at the circle’s outer edge.
A media strategy cannot be defined in isolation, since it Common stakeholders include:
must support the operational strategy of a CMT. In the
• Families and the media (see above)
majority of cases, a low-key approach will be adopted.
The incident circumstances will determine whether, how • Staff in the affected mission
fast, and which information about the incident will be
• Friends and ex-colleagues of victims
accessible to the press. However, from a crisis
management perspective it is generally advisable to • Employees (senior management and support staff in the
keep the media at arm’s length to contain the situation affected programme area)
effectively, and to protect victims and their families. This
• Senior organisational management
can be achieved through reactive Q&A sessions, or brief
press statements simply acknowledging that an incident • Relevant local and national authorities
has happened. Agencies are advised to develop a set of
• Community leaders and beneficiaries
general “off the shelf” media lines as part of their crisis
response planning.17 If warranted by media interest and • Relevant embassies
an agency’s media strategy, designated spokespersons
• Other aid agencies
should be appointed to whom all media enquiries can
be referred. • Insurance companies
The following measures are sensible during most crises • Home governments of victims
(regardless of the level of media interest):
• Institutional donors
• Instruct field staff not to speak to the media
• Contain “info-leakage” by briefing staff on what
information they can and cannot share with friends,
families and colleagues
• Monitor (national and international) media reporting
on the incident
• Remain acutely aware of, and try to influence,
relationships between the various stakeholders and
the media

17 Proactive media strategies may be chosen when public pressure and advocacy are considered instrumental to the successful resolution of an incident.

12 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:32 Page 16

6 Post-Crisis Follow-Up

Although the extent is dependent on incident type, all Operational Implications

crises require some degree of follow-up.
Crises are likely to alter organisational risk profiles in the
Aftercare contexts in which they occur. Perceptions, organisational
image, relations with key stakeholders, and potentially
Agencies should ensure that victims, family members,
organisational risk thresholds in particular contexts, may
colleagues who are witnesses to a critical incident,
have shifted. Thus, a review of the risk analysis may be
others who may be psychologically affected by the
necessary.
incident, and crisis managers, receive appropriate
aftercare. This entails psycho-social and practical
support (i.e. additional paid leave, or special
Follow-Up with External Stakeholders
considerations during the next deployment), and
administrative follow-up (insurance, contractual issues). It is vital that organisations make provisions for the
The appointment of a case manager may facilitate and extension of gratitude to all relevant actors for their
streamline coordination of the aftercare process. efforts in helping to resolve incidents.

Debrief and Evaluation

A thorough operational debrief is necessary for crisis
managers and incident victims. This facilitates proper
analysis of the incident, and a review of quality in the
crisis management, thus fostering good institutional
memory. Debriefing should be well-documented, and
lessons learnt should feed into a review of crisis
response planning.

Information Management
Documents and electronic data related to the incident
must be filed systematically and stored in a central
location. All duplicates should be destroyed to avoid
leakage and inconsistency at a later stage.

13 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:32 Page 17

Annex Checklist

General Human Resources Management

✔ Crisis response plan updated and distributed to Personnel file
relevant players
✔ Contact details of next of kin and emergency
✔ CMT members, including shadows/replacements, contact persons
identified
✔ Contracts and insurance policies
✔ CMT training/workshops conducted at regular
✔ Health Information Form (including blood type,
intervals and roles and responsibilities of CMT
chronic illnesses, allergies, medications, etc.)
members clearly delineated and well understood
✔ Proof of Life (abduction-specific)
✔ Mechanism in place to ensure presence at
headquarters of at least one CMT member of each ✔ Access to passwords for online social
discipline at all times networking sites
✔ 24 hr access to office possible Other
✔ Office space and equipment (computers, printers, ✔ Staff available to act as family contact person
phones, video conference, etc.) available
✔ Psycho-social capacity available at short notice
✔ Specific briefings for staff deployed to high risk
Protocols, Flowcharts, Formats
countries
✔ 24/7 On-Call protocol
✔ Decision-making flowchart
✔ Crisis response Protocol for Operations, Human
Resources, Communications/Media
✔ Specific protocols for:
• Medical Evacuation (medevac)
• Repatriation of Deceased
• Abduction Management
• Sexual Gender-Based Violence incidents
• Traumatic events
✔ Logbook format
✔ Incident report format

14 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:32 Page 18

Decision-making flowchart

Flowcharts must be tailored to an organisation’s management structure. The

model below is therefore simplified, reflecting only major steps in the initial
decision-making process.

1. Field reports critical incident to HQ (describe reporting

chain in the field)

2. HQ (describe who receives incident report, whom the

recipient must inform, and who decides whether
incident constitutes a crisis)

3. Decision on whether to activate the Crisis

Management mechanism

YES NO
Activate: Regular line management retains
responsibility for incident management.
• CMT
Activate:
• IMT
• Relevant protocol
• Relevant protocol
• Logbook
Consider activating (incident-dependent):
• IMT
• Additional CI management support
• Logbook

15 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:32 Page 19

SAMPLE FORMAT

1st Critical Incident Report

REPORTED BY
COUNTRY
PROJECT
DATE
EXACT LOCATION OF INCIDENT
TIME OF INCIDENT
CURRENT LOCATION OF VICTIMS
IDENTITY OF DECEASED STAFF 1 2 3
NAME
NATIONALITY
IDENTITY OF WOUNDED STAFF 1 2 3
NAME
NATIONALITY
MEDICAL CONDITION OF WOUNDED 1 2 3

Incident Description
Describe incident details, including who reported the incident, witnesses and perpetrators, current security situation if
applicable. Stick to facts (what you know at this moment).

Decisions Taken
What action has been taken/is in process to prevent further harm to victims and other staff?

Actions Proposed
Which steps need to be taken to prevent further harm to victims and other staff (medevac, evac, etc.)?

Contact Details
List contact details (phone numbers, email addresses, locations) of key players (Country Rep, Field Coordinator, etc.)

List of other staff in project location

16 Crisis Management of Critical Incidents

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:32 Page 20

SAMPLE FORMAT

Logbook

NO DATE TIME EVENT PARTICIPANTS CONTENT DECISIONS

(Meeting, Phone, etc.)

17 EISF Briefing Paper

0000_EISF_CMOCI_PRF3:Layout 1 14/4/10 10:28 Page 1

European Interagency Security Forum

c/o Save the Children
1 St John’s Lane
London EC1M 4AR

EISF Coordinator
+44 (0) 207 012 6602
eisf-coordinator@eisf.eu

EISF Researcher
+44 (0)207 012 6726
eisf-reseach@eisf.eu

www.eisf.eu design and artwork: www.wave.coop

First published April 2010