You're feeling pleased with all the focus and effort being given to risk management in your organisation.
The business units have taken responsibility for the risks in their operations, and the Board and Senior Executive monitor the external environment regularly for threats and opportunities whilst applying solid risk evaluation techniques to the overall strategic plan.
And the risk team monitor and report on key risks and their status regularly. Even other teams in the second line of defence understand what they need to do, and are doing it, to enable effective risk management across the organisation.
Then, disaster strikes! A product has quality issues and is recalled, a senior executive's relationship with a staff member is called into question or a natural disaster impacts a key facility.
This is reality - despite the best efforts of everyone involved, sometimes stuff happens.
Believe it or not there are organisations that eschew a formal risk management program and choose simply to deal with a crisis if and when it arises.
Whilst I don't agree that this is a sustainable strategy, I do wonder how much effort these organisations put into their Crisis Management arrangements.
This blog will examine the key elements that should exist in a Crisis Management Plan for any organisation - whether they have a formalised risk management program or not.
In his article in the Harvard Business Review*, Norman Augustine outlines six stages of Crisis Management:
Avoiding the Crisis
Preparing to Manage the Crisis
Recognising the Crisis
Containing the Crisis
Resolving the Crisis
Profiting from the Crisis
Avoiding the Crisis is self-explanatory. It is far better for the organisation to take the time and effort to prevent a crisis happening in the first place than it is trying to deal with the consequences. I have written before of the need to maintain a 'healthy unease' when thinking about risk - especially during the good times when all seems to be working out as planned.
An effective Enterprise Risk Management framework is a great start.
Preparing to Manage the Crisis is all about planning. Taking the time to think about who needs to do what and when before a crisis occurs. Understanding key responsibilities, which facilities are critical to business operations, and how to respond to certain scenarios is all part of the process.
And the time to test that the plan works? Before a crisis! Rehearse the plan, adjust as necessary and then rehearse some more. Most organisations will hold a crisis management exercise at least annually.
And be sure to include key 3rd parties in the rehearsals - the first time you meet the head of an emergency services branch shouldn't be in the middle of a crisis!
Recognising the Crisis surprisingly, can take way longer than it should. Sometimes executives will struggle to accept that in fact they are in a crisis. This is commonly the case where the company is in the right regarding a technical issue but has completely misjudged the public reaction to it.
In today's world of social media and the fact that anyone carrying a smartphone is a potential broadcaster, organisations need to be quicker than ever at recognising a groundswell of public discontent rapidly building into a crisis. Whilst 'jumping at shadows' is not the answer, management needs to monitor incident reporting trends and feedback from the public to recognise a potential issue in a timely manner.
Containing the Crisis means, in Augustine's words '...triage: stopping the haemorrhaging'. And the difficult part is that to some degree you are flying blind. All the information about the crisis issue is not yet available and much of what is available is speculation and opinion.
But this is not the time to wait for perfect information. Decisions need to be made and they need to be made quickly. The public, regulators, shareholders, the media and other stakeholders are looking for decisive leadership at this time. Doing something is generally better than no response at all. And the additional challenge for CEO's at this time is that they have a barrage of advisors all telling them how they think the crisis should be handled.
Along with acting, the organisation needs to communicate and communicate a lot. In the absence of this, the media will find someone who has an opinion on the crisis and it may not be even close to the truth of the matter. Having a trained and professional company spokesperson is essential for getting out your key messages in a timely and consistent manner.
Resolving the Crisis is the phase where you try to get back to business as usual as quickly as possible. The sooner you can show the public or other stakeholders that you are on top of the situation and have taken appropriate actions, the quicker the crisis situation will subside.
Whether this is recalling a defective product, disciplining or separating the wayward executive or looking after staff and customers affected by a natural disaster, any hostility or anger will tend to abate once stakeholders see that the organisation has taken the situation seriously and responded accordingly.
But how do you end up Profiting from the Crisis? Going over and above the expectations of stakeholders is a lot of the answer. Where a business recognises that the trust of it's customers is key to future success, the cost of these additional actions - which might be measured in many millions of dollars - shows that the organisation is prepared to put people before profit.
Not every crisis will present such an opportunity, but in the noise of the lawyers telling you not to take action because of potential litigation or the CFO forecasting the grave impact on results, sometimes a leader has to stand up and do what they are paid to do - lead!
Crisis Management forms part of a broader Business Resilience Framework - generally made up of Business Continuity Planning, Emergency Response Plan, It Disaster Recovery and Crisis Management.
We'll review Business Resilience in a later blog.
As always, should you wish to discuss any of your risk management needs, please contact me on 0404 829 040 or via my website www.proximityriskassurance.com.au
* Managing the Crisis You Tried to Prevent Augustine, N. Harvard Business Review Press, 2000