How an event that affects day-to-day business operations is handled has a significant impact on the extent of the damage. Therefore, not only should precautionary measures be implemented in the company in advance to keep the residual risk as low as possible, but reactive measures should also be planned. After all, there is no such thing as 100% safety and the residual risk will never be zero. In case of an event, there will be an impact on the company. However, the reactive side of emergency and crisis management should not only be available as a nice document for auditors, but should above all be handy and applicable. If the planned actions are not applicable, the impact of the event is reduced only imperceptibly or not at all. How handy the reactive side was actually planned cannot be checked only by a theoretical examination. It is also not sufficient if the existence of an emergency manual is known to all those who play a role in it and is also checked by these very people and described as practicable in theory. After all, in the event of an incident, there is not enough time to look up again precisely how the crisis team is to be alerted, who should be convened exactly, where to meet, or what emergency plans and resources exist at all. These procedures must be familiar in order to respond adequately. For them to be familiar, they must have been rehearsed at least once. Doing this the first time during a crisis is not advisable. There is defacto no confidence in the procedures and the reactive measures are hardly effective. The scope of the impact would be comparable to the scenario where there is no reactive side at all. The figure below illustrates how functioning precautionary measures and response have an impact on the extent of damage. It also shows that precautionary measures can only go as far as the damage potential of corresponding hazards for the organization is known.
Figure 1 Effect of precaution and response on the extent of damage for an organization in case of hazards
The impact of hazards, which are still below the surface, can only be responded to when they occur. Therefore, it is essential for a fully comprehensive emergency and crisis management that the processes within the organization are known and that possible hazards have been identified. Cascade effects are often problematic because the complexity of the company has not been fully grasped and dependencies between different processes, especially between different departments, are not known. If a hazard occurs, unknown interactions may occur for which preparation was not possible due to a lack of knowledge. To prevent this very thing, the processes in the company should be identified as part of a business impact analysis (BIA). But a BIA goes further than a mere process analysis. The most important aspects of a BIA amount to completeness and timeliness, dependencies, risk readiness and risk reduction plans, inclusion of non-monetary impacts, and prioritization of risk reduction plans and continuous improvement process. If you want to learn more about this, feel free to stop by our blog article The 5 Key Points of a Business Impact Analysis.
To ensure that on the reactive side, the processes on the strategic, tactical and operational side function smoothly, they can be practiced and tested in a variety of ways. On the strategic level, there is the crisis team, which has the task of keeping track of the situation and making decisions regarding further measures. For more information on the structure and tasks of a company’s crisis team, see Keeping an overview: The Emergency and Crisis Management Team.
As the decision-making body, the crisis team in particular should have a high level of confidence in its actions in the event of a crisis. How the cooperation and processes in the crisis team function can be tested in advance as part of a crisis team exercise. In this case, the crisis team reacts to a scenario that has been prepared in advance. The scenario is tailored to the company and contains elements that the crisis team must address in addition to dealing with the major problem. In particular, the exercise is designed to familiarize the people in the crisis team with their role and to learn how to work in such a constellation, since the role they have to take on is not the same as their everyday work and the colleagues who sit on the team with them may be familiar, but they have not yet worked with them. In addition to testing whether the planned measures are practicable, an exercise also helps to refine these measures to make them even more handy. Through an exercise, the individual participants notice what would make their work even easier and what may not have been thought of yet. Another side effect of conducting a crisis management exercise is the networking of participants from different departments. This ensures that there is a greater understanding of the work of others and in this way brings appreciation and indulgence. This can have an impact on everyday work and make processes between different departments run more smoothly. And even though an exercise can bring some artificialities that would not be solved in the same way in reality, there is a noticeable added value to be noted should it come to an event in reality.
In May 2019, we at IUGITAS conducted a Crisis Management Team exercise with one of our clients to practice the strategic level. This was the very first exercise conducted by the crisis team, having been established only a short time before. Even before the crisis team was formed, the company was dealing with incidents and had to respond to impacts. The response that the company had before the introduction of a formal emergency and crisis management was described by the company as rather uncoordinated and unsystematic. The exercise was designed in particular to learn the methodology of the management process and communication channels and to strengthen them in practice. Likewise, the participants were to understand their own role in crisis management by working through a scenario that we had prepared, and to learn adequate resource management. A total of eleven participants took part in the exercise, which included various consultants, the logistics department, on-site operations managers and members of a decision-making group, as well as those responsible for implementation. The scenario was mastered confidently and optimization potential was identified in some areas. This could subsequently be incorporated by the company into its emergency and crisis management.
In the middle of the night, about a year after the exercise, the time had come. A message came in that a potentially very serious event had occurred. Without responding to the event, there would be unacceptable impacts to the company. Quickly, the relevant people were informed to work on a solution. The majority of those present had participated in the 2019 exercise and the procedures for being alerted and working together were still familiar. Also, dealing with a potentially very complex situation very quickly was no longer unfamiliar. This gave the individuals the needed confidence to act sovereignly when responding to a real event as well. Compared to previous incidents, the response was more systematic and more calm. And while one never hopes that an event with devastating consequences will occur, it is better to be prepared for such a possibility.
Would you like to challenge your crisis team and put it to the test? Write us!
