Chapter 4 Management of Crisis

A crisis management plan prepares an organization for the unpredictable, defines roles and
responses, and minimizes the damage to the organization, its employees, and its customers.

Distributed enterprises and teams can complicate how a crisis team builds, evaluates, and tests a CM
plan. The dispersed nature sets up challenges and introduces many distractions to a team responding
to an incident or business disruption.

Building a Crisis Management Plan

A timely and precise response to each critical event is essential to minimize the impact of the crisis.
A CM plan must prevent delays, missed tasks and assignments, or laggy crisis response times. Even
if crises aren’t all digital, “digital-first” is the best way to approach developing a crisis management
plan. For example, if the organization has only one physical campus, an on-premises solution could
prove a pitfall if the operations center were to become inaccessible.

When building a CM plan, an organization must facilitate communications and coordination that are
clear and quick, relying on CM technology that ensures the safety of people, the protection of assets,
and the effective recovery of business as usual.

Successful CM plans address five essential topics: people, facilities/critical infrastructure,

People: People are every organization’s most important asset, and enterprises have a duty of care to
their employees. Ensure that in every critical event, the crisis team can answer whether lives are in
danger, if there is a physical safety issue, and whether there will be an impact on employees,
customers, visitors, and vendors. How will they be notified with emergency notifications?

Facilities/Critical Infrastructure: Facilities and critical infrastructure must be checked to ascertain

Technology: A crisis management plan must cover technology as well. Ask yourself: is there a
service disruption, an information security issue, or risk of either? Who is on point for addressing
potential or actual failures in technical infrastructure during a critical event?

Business: In a crisis, business processes and activities need to be included in the CM plan. Can the
organization still perform mission-critical business processes? Is this crisis affecting customers or
having a significant financial impact on the company?

Brand Reputation: In a crisis, brand reputation may seem less of a priority, but that’s why it must
be included in the plan. In a crisis, brand reputation is always at stake. How will team members
collaborate to respond q\ickly to prevent any extreme brand-reputation fallout?

Evaluating a Crisis Management Plan

Evaluating a CM plan requires determining whether the components of the plan are necessary and
adequate to protect, manage and recover from a critical event, and to assess the feasibility of planned
actions.

For example, higher education institutions orchestrating a return to in-person classes amid a global
pandemic have entirely new sets of requirements and potential scenarios. The following questions
require evaluation to determine whether there are more resources needed and to identify how the
intended results will be attained:

 What happens when one person gets sick? What happens when a cluster of people gets sick?
 How do we maintain compliance with regulations requiring timely notifications of illness on
campus?
 How are we tracking this reporting and communications data?
 How are we coordinating these communications between Health Services/HR/the student and
faculty body?
 How do we monitor the overall operations on campus at all times?

Answering the set of questions above (and so many more criteria) is a necessary step in the creation
and evaluation of a crisis management and response plan.

Testing a Crisis Management Plan

Testing a CM plan is a non-negotiable step in validating the plan’s ongoing efficacy. It ensures the
CM plan can be executed as designed and reveals any gaps in the intended flow of operations or
personnel assigned to the task force. Periodic testing also affirms that no aspects of the plan become
obsolete.

A CM plan should be tested against specific scenarios. Simulations of hurricanes, earthquakes, flash
floods, utility failures, active shooters, or bomb threats are examples of scenarios to test against.
Scenario-based testing will allow the CM team to ensure accurate contact information and scenario-
specific messaging is loaded into the CM communications solution and the execution of emergency
notifications goes as intended.

Testing a CM plan can identify gaps and enable the organization to account for conditions such
as:

Gaps in CM

 Human error: Crises are high-stress situations. “Shaky finger syndrome” is inevitable in such
moments, so it’s critical to ensure the CM team isn’t experiencing the CM plan actions for the
first time in a crisis.
 Email fatigue: When employees get so many emails per day that they tune out crisis notification
emails, how do you cut through the noise in an emergency event? Try phone notifications.
 The time-consuming nature of emails and phone trees: In a crisis, where every second
counts, the answer is to digitize the crisis response actions using defined policies and a tool
offering automated, one-click alerts.
 Dispersed workforce: Does your CM plan use a centralized solution that enables
communication with all stakeholders through one integrated platform?

When seconds make the difference, any number of minutes spent to regroup, repeat, update, or
coordinate is too many. To implement complete crisis management, an automated, end-to-end
solution like Everbridge Critical Event Management platform (CEM) covers all the bases: emergency
notification, critical communication, risk/situation comprehension, crisis management, reporting, and
analysis. The CEM platform automates manual processes, increasing speed and decisiveness, and
improving the accuracy of a leaders’ risk assessment and response. It also uses ad hoc data feeds to
provide richer intelligence and correlate threats with locations of assets and people, and enabling
more rapid and comprehensive incident assessment and remediation.
6 Steps to Create a Crisis Management Plan

If your company is one of the 51 per cent of organizations that admits to not having crisis
management playbooks in place, now is the time to sit down and start planning. The very future of
your business could depend on it.

But where should you begin? If you are new to the process, building issue and crisis management
plans likely seems like a daunting task. Luckily, there are just six key steps required to create a
plan—and the process will likely become easier after you have gone through it the first time.

Here is how to get started:

The first step is a risk assessment, which identifies potential issues and crises that would disrupt your
business function and/or processes. Work with members of leadership, your crisis response team, and
other key stakeholders to begin listing all relevant threats and vulnerabilities that could impact the
organization. These might include public relations blunders, social media gaffes, product recalls,
cyber-attacks, workplace issues, and extreme weather events.
2. Determine the business impact.

A business impact analysis (BIA) qualifies the potential impact of a business-disrupting issue.

Completing a BIA can reveal a variety of impacts, including:

 Customer dissatisfaction or attrition

A BIA is an important step to make sure your organization is truly considering every angle of a
threat. It also can help to make a business case to anyone who does not see the value of issue and
crisis management plans. Ready.gov offers a free BIA template that can help guide you through the
process.

3. Identify contingencies.

Now that you have determined what risks could impact your business and how, begin identifying
which actions will help your organization to respond effectively to each threat.

Think about the steps that would be required to resolve the issue, what resources would be required,
and how employees can help.

For example, for the response to a social media blunder might include your digital team issuing
statements across all your social media platforms, while your customer service team is briefed on
what to say on incoming calls.

Meanwhile, the plan for a product recall requires help from IT and logistics to determine how to fix
the problem, while customer service, sales, and public relations work together to answer customer
questions and protect the company’s good standing.
4. Build the plan.

Once you have determined a contingency for each potential threat, flesh out the plans by working
with relevant stakeholders. Key employees, such as department heads, can help to provide insight
into available resources and potential hurdles. You also may need input from outside parties, such as
contractors and partners that work closely with your business.

In addition, keep in mind any relevant regulatory requirements, and determine how you will continue
to meet them, even in the midst of a crisis. For example, if your organization must remain compliant
with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), be sure to account
for this in the crisis response plan.
5. Familiarize users.

It is important that all employees understand their roles during a crisis. Stress and panic can make it
difficult to remember your role in a crisis response. However, there are two ways to mitigate the
effects of stress.

First, ensure that your employees have the information they need. During the tense moments of a
crisis, people require immediate access to straightforward information. Consider ways to quickly and
effectively distribute a crisis playbook, such as through a crisis management app, which includes
real-time access to up-to-date documents, incident reporting, contact lists, messaging capabilities,
and collaboration tools.

Second, be sure to frequently train stakeholders on your issue and crisis management plan. Stage
regular drills and rehearsals to ensure that every individual is familiar with the plan, can respond
confidently, knows where to get additional information, and understands his or her role.

6. Revisit the plan frequently.

Once your plan is written and approved and has been tested, be sure to revisit it frequently. It is vital
to keep the plan up to date, especially as employees join or leave the company, new technologies are
implemented, and other changes occur. It is helpful to review and test the plan at least annually to
keep the content fresh.

This is another area in which an issue and crisis management app can help. The platform supporting
the app automatically pushes all updates to each user’s smartphone, so you can rest assured that all
stakeholders have immediate access to the most up-to-date resources, no matter when they require it.
If a PR nightmare or a product recall strikes on a Saturday afternoon, your team still has immediate
access to the information to activate the response.

FOUR STAGES IN CRISIS MANAGEMENT

1. Mitigation/Analysis
2. Preparedness
3. Response
4. Recovery
It may be wrong to ignore mitigation and preparedness when you’re in the middle of a crisis and
move right to response and recovery modes. However, it’s essential to give the first two stages
careful thought and analysis.
A crisis like COVID-19 is a dynamic situation with long-term implications. It’s good governance
practice for the board to carve out time or dedicate a committee to consider the next phase of crises
and determine what preparation measures can be implemented. Managing in Adversities Management
of Crisis

Phase 1: Mitigation
There are six items to consider during the mitigation phase:
Create a risk management team.
Designate a coordinator who is ready to act.
Create, or evolve, a business continuity plan (BCP) to determine how you will serve your
institution’s community during a time of crisis.
Create a communications strategy for communicating with stakeholders and communities both
on and off campus.
Determine your best sources of information in times of crisis and establish communications
channels.
Understand budget ramifications and which areas of revenue and expense are most likely to be
impacted so you can access financial resources when needed.
Phase 2: Preparedness
There are three items to consider during the preparedness phase:
Periodically review insurance policies to make sure what is covered andmake adjustments as
needed.
Put a plan in place to hold remote/virtual board meetings.
Create a crisis communications plan. The board can help during this phase by:
Defining parameters for accessing financial reserves
Reviewing your bylaws to determine whether virtual board meetingsand voting are an option
Reviewing the crisis communications plan
Phase 3: Response
There are nine items to consider during the response phase:
Triage the most pressing issues.
Communicate regularly with your key stakeholders.
Analyze budget implications and create contingency plans.
Implement the business continuity plan.
Institute remote work.
Reconfigure staffing needs.
Manage the stress response from all stakeholders: staff, students,trustees, donors,
funders, etc.
Access response/recovery funds and insurance benefits and stabilizecash flow.
 Observe where the disaster reveals weaknesses in your organizationand begin prioritizing
how to fix them in the future.
The board can help during this phase by:
Supporting college and university leaders and back up to them on alldecision-making
Supporting the implementation of the business continuity plan
Empowering the administration to be creative
Triaging and managing the amount of “help” being offered bycommunity members
Beginning documenting the organizational stressors
Meeting frequently to address real-time issues and keep the full boardinformed
Supporting staff’s short-term decision-making while also advancinglong-term needs
Arranging for mental health support for staff, as needed
Phase 4: Recovery
There are 10 items to consider during the recovery phase:
Rebuild learning models to evaluate what is possible in this newenvironment.
Talk to your peers – learn from others.
Adopt a strategic plan as needed.
Access recovery funding.
Address any organizational weaknesses revealed during the crisis.
Create transition plans for the new normal for all stakeholders.
Acknowledge and manage the ongoing stress and trauma for allstakeholders.
Emerge from triage decision-making and make better long-termdecisions.
Identify new areas for investment and divestment.
Renegotiate stakeholder agreements, contracts, etc.
The board can help during this phase by:
Being unified in supporting the work and staff
Celebrating the good work that was done during the crisis response
Identifying and capturing “lessons learned” during the crisis response
Creating a plan for addressing the organizational stressors
Meeting as needed to address real-time issue

Case study
What Happened?
In February 2018, KFC had to close more than half of its 900 stores in the United Kingdom
because of a shortage of…chicken. The social and mainstream media enjoyed the irony of a
chicken shop without any chicken and went to town on the story. The cause was a delivery
problem after the chain switched its contract to DHL which said that due to ‘administrative
problems’ a number of deliveries were cancelled or delayed.
Loyal customers vented on Twitter and took their families to McDonalds. Some even
complained to their local politicians. Then KFC, even while struggling to get the restaurants re-
opened, managed to switch the narrative entirely. It ran an apology advertisement that was
extremely funny (especially to the brand’s core younger consumers) while taking ownership of
the problem.
The company was widely applauded by customers and the media for its deft handling of the
situation and became the poster child for how well to handle a crisis.

What We Learned:
Among the key elements in a best-in-class crisis response plan are:
 An understanding of the brand’s key stakeholder, particularly the core consumers. Who are
they? Where are they? What are their key considerations? What’s likely to be on their minds
when the brand is facing challenges?
 An understanding of the brand’s promise and ‘voice’. How is it positioned? What’s likely to
support or break the trust in the brand in how it responds to a crisis?
KFC’s clever, authentic and borderline obscene response showed it deeply understood both these
factors.
Case 2
In 2016, Korean electronics company Samsung faced a crisis when its Galaxy Note 7
smartphones exploded due to a battery problem. Sales slumped as airlines banned passengers
from carrying the phone on board. Samsung responded by immediately taking accountability,
being transparent about not immediately knowing the cause, and vowing to determine the
problem.
The company put 700 engineers on the problem and opened the research to third parties. When
the problem was identified, the company communicated the issue clearly and introduced quality
assurance and safety features.
Samsung also launched a campaign aimed at tying its brand image to a larger purpose and
improving its culture. In the next year, Samsung’s brand value rose 9 percent, according to
Interbrand, and its Galaxy S8 yielded record profits the following year.

Case 3
Industrial Disaster Crisis Management Example: Bhopal Gas Leak
In 1984, a toxic gas leak from a Union Carbide India pesticide plant in Bhopal, India killed up to
30,000 people from immediate and long-term effects (according to estimates) and injured about
575,000. The accident isone of the world’s worst industrial disasters.
The leak was caused by the introduction of water into a chemical tank, which resulted in a heat-
generating, runaway reaction. Several inquiries found evidence of company negligence, but an
internal analysis blamed employee sabotage.
Researchers have written extensively about the accident, and some of the lessons cited are
universally helpful in crisis management, including the following:
 Rehearse Emergency Procedures: The plant did not have an emergency plan, and plant
operators did not know how to handle an emergency. No effective public warning system or
public education about the risks were in place.
 Prioritize Crisis Readiness: The company reduced training and staffing at the plant to save
costs. Supplies of gas masks were inadequate, and several plant safety mechanisms were either
deactivated or faulty. Additionally, several experts found that there weren’t enough operators for
the unit to function safely. On the night of the accident, the supervisor delayed investigating an
initial small leak until after a crew break, rather than being proactive.
It knew its audience (young, hip and irreverent) and it followed through in exactly the kind of
tone and language that was consistent with how the brand was positioned in other, more positive
marketing.
The result was a swift abatement of the criticism for the closed stores – and the sound of
widespread applause for a model crisis response
Challenging and supporting the staff to renew long-term decision-making
Addressing board structure, relationships, and policies that hinderedthe board during the crisis
Challenging board and staff to address what’s been left unsaid and unaddressed.