How to Build a Crisis Management Plan

The WDYMB…Crisis? article explained what a crisis is and how these can arise. One of the most important points stressed is that crises are often avoidable and in many cases, survivable. Ultimately, this might come down to good luck and obviously the skills and abilities of the team responding play a big part. However, the chances of surviving a major event are significantly increased if the organization has prepared in advance. As far as a crisis is concerned, one of the key elements of this preparation is a crisis management plan (CMP). This article will explain what a CMP is, what it should contain and how you can develop one for your organization.

Overview

What the CMP does

Think of the CMP as something which ensures that the right people, with the right training, are in the right place and provided with the right information to allow them to determine the best course of action for the organization at that time of crisis. This means that the CMP has both a preparatory function — explaining how to prepare those people beforehand — and an executive function — telling them what to do in an actual crisis.

As a quick aside, I am using the term crisis management plan (CMP) here because it is the most common term used but you will also see these referred to as handbooks, playbooks or manuals. As long as you have a document that meets the requirements laid out here, what you call it doesn’t really matter.

Firstly, sitting above the CMP will be some kind of standard which provides the top-level framework for crisis management in the organization. There are number of different standards but we will be using BS 11200 as a reference. At the moment, this is the most widely referenced standard and BS11200 is also the document referenced in the WDYMB…Crisis? article.

The CMP is the organization’s own interpretation of the standard. It explains the crisis preparedness measures that the organization will put in place prior to an event and the processes it will utilize during a crisis. So the standard outlines what should be in place and the CMP details what that looks like in the specific organization.

The CMP needs to be an actionable document, written in such a way that someone can open the document and follow it easily during a time of high stress.

Because it covers both preparation and the response itself, the CMP is not just something that you use during a crisis. The CMP also outlines how to develop and maintain the crisis management structure before an event in addition to what to do afterwards.

Generally, the CMP covers the before, during and after stages of an event as follows:

• Before — The CMP explains the structure that should be put in place, the role of the CMT, the people who should be identified to form a CMT and the kind of training and skills required for this team. Any specific equipment purchases or infrastructure requirements should also be identified prior to an event.
• During — The CMP provides guidance for how the CMT should operate during a crisis. This includes internal processes for the team and mechanisms to allow the CMT to coordinate with other groups such as the operational response and external stakeholders. Tools, template and responsibility checklists help guide the CMT during the crisis.
• After — The CMP explains the actions to take to declare a crisis over and how to manage subsequent investigations and implement lessons learned.

In addition to explaining what the CMT should do, the CMP should also provide an explanation on how they should do this. However, having these two elements side-by-side can make the CMP confusing so my recommendation, reflected in the structure below, is to separate the what from the how to make the document more user-friendly and easy to follow.

This means that the first section is a roadmap to follow from start to finish as the crisis progresses. Part two supplies the explanatory materials to help users understand each step in part one. The CMP should also include the tools, templates and checklists that the CMT may need in a crisis and I normally put these into a final section. This allows the CMP to be the single reference that the organization can use for preparation and training prior to a crisis and to guide the CMT during the crisis itself.

Despite this scope, there are some things the CMP cannot do.

What the CMP Doesn’t Do

Every possible crisis situation cannot be anticipated, so a CMP is not a step-by-step guide of every single action required to deal with a crisis. The role of the CMT is not to manage all elements of the response. Rather, the CMT is there to provide the strategic guidance, decision-making and direction for the response. The majority of the actual response activity takes place outside of the CMT. The CMP should therefore support these strategic activities. It should not cover operational actions for all eventualities.

In addition to the CMP, you need specific response plans for the most likely, high-risk events or anything that requires detailed, technical plans such as managing a chemical spill.

While you are using your CMP, ensure that everyone involved is aware that the document is there to provide a framework for the operation of the CMT. It provides guidance on how to address the situation but it won’t contain all of the answers that they’re looking for. Finding these answers is the main role of the CMT.

Remember, as Always, KISS

Getting this balance right is very difficult and, although I have written dozens and dozens of CMPs, I’m still looking for the perfect blend of simple clear instructions and thorough guidance. Whenever I cut back and focus on simplicity, someone asks for more explanation. Alternately, if I make sure that section two is nice and detailed, people will complain that the document is too long. Sometimes, I’ve had both comments from the same group about the same document.

The standard that I now apply is that the document should be as simple as possible but should still allow anyone with a basic understanding of crisis management to pick it up and use it to become an effective member of the CMT. As a consultant, this was a basic test that I applied to any document I was reviewing: ‘as an outsider, could be an effective member of the team, just using this document?’. If the answer was yes, then that was a good start.

Not only does the document need to simple and clear, but the processes inside it should also be easy to use. Remember, crises are times of high uncertainty and great complexity. Having lots of complicated processes on top of that will just make things more confusing. The speed and efficiency of the CMT is of great importance as delays at this level will slow down the whole response. Although the CMT will develop and direct the overall strategy, the majority of the actual response will be conducted by other groups, like the operational response team or the crisis communications team. Therefore, simple, robust process which facilitate and speed up the CMT’s activities have a dramatic and positive effect on the overall response. If you are familiar with the OODA loop, that’s essentially what we are trying to speed up here.

Building the CMP

Preparation

Before you build the CMP, you need to develop your understanding: your understanding of the organization and your understanding of what ‘good’ crisis management looks like.

Understanding the organization is key because you will need to work out how to adapt the standard to fit your needs. There is no point building something that is theoretically sound but has little or no chance of being adopted. For some other thoughts on how to develop this kind of understanding and how to later embed a capability, take a look at the article on integrating a risk management system.

Understanding what good crisis management looks like requires you to become well acquainted with something like BS 11200. Even though understanding the system in theory is necessary, experience is also important. If you only have a theoretical understanding of crisis, speak to people who have had to deal with these situations in real life. These insights will be invaluable when it comes time to translate the standard into practical steps. As a last resort, read up on case studies to understand how to apply these theories in practice.

As with all procedures, the CMP should be developed to be ‘personality neutral,’ meaning that if a set of responsibilities is delegated to a role, anyone who might take that position in the CMT should be able to fulfill those duties. There will always be a mix of skills and experience in any organization so there will be a tendency to favor the most experienced (or sometimes the loudest) team members. However, a CMP that is overly reliant on specific individuals is not really a procedure because instead of relying upon the system, they are relying on a small group of individuals. Some of these individuals may not be available and all of whom will eventually leave the organization.

However, as a practical matter, you should be alert to the different personalities and operating styles of the key individuals in the CMT. Although you shouldn’t reflect these in the CMP, individuals’ personality and character will have a significant impact on the way the CMT works in practice. You need to be aware of these ‘quirks’ if an actual crisis occurs.

The Foundation

The proposed framework for the CMP is based on the nine principles for effective crisis management from BS 11 200.

• Principle 1 — Control. Organizations in crisis must achieve control as quickly as possible. This requires a way to classify events by severity and an effective notification and mobilization system.
• Principle 2 — Communicate. Organizations must be able to communicate effectively in a crisis, both internally and externally. This requires trained communications teams, good stakeholder understanding and processes for messaging.
• Principle 3 — Structures, Roles and Responsibilities. Clear, universally understood structures, roles and responsibilities are required in a crisis. This requires an identified team to lead in a crisis (a CMT), a framework to link crises to other types of response and clear roles and responsibilities for the CMT.
• Principle 4 — Situational Awareness. Organizations must be able to build and maintain situational awareness in a crisis. This requires a risk-led approach, horizon scanning and an information management process linked to decision-making.
• Principle 5 — Decision-Making. To facilitate clear, well-rehearsed decision-making and actions in a crisis, organizations require a clear, information-driven decision-making process and an action tracking process to monitor progress.
• Principle 6 — Leadership. Organizations in crisis need effective leadership at all levels. This requires leaders throughout the organization to be identified and prepared for crisis. There also needs to be strong support from senior leadership.
• Principle 7 — Competence. To develop and maintain the competency of staff with crisis management responsibilities, organizations should train and exercise all staff with crisis responsibilities regularly.
• Principle 8 — Logging and Reporting. To ensure a comprehensive record and policy log on, organizations should have a series of standard logging and reporting templates. They should also have staff who are trained in information management and log keeping.
• Principle 9 — Learning. To learn from mistakes and make changes to prevent reoccurring problems, organizations need a process for identifying, capturing and applying lessons learned.

Core principles © BSI, ref BSI 11200 Crisis management — Guidance and good practice, 2014.

If you ensure that the CMP addresses each of these principles, you should have everything your organization needs to prepare for respond to and manage the outcome of a crisis. (As a way to check this, there is an assessment tool here to help assess your organization’s CM maturity as this process develops.)

Structuring the CMP

As I noted above, split the CMP into three sections to ensure that it covers both the what and how elements while still remaining easy to use. The three sections I suggest are:

• Section 1 — Crisis Management Road Map. These are the steps that the CMT should follow when responding to a crisis, laid out in broadly chronological order from initial notification through to declaring a crisis closed. I try to keep this as short and clear as possible by using flowcharts and checklists whenever possible.
• Section 2 — Explanation / Guidance Section. This sections provides more detailed guidance on each element of the CMP and can be used for training and preparation. This can be part of the written document or a separate annex but I am beginning to use PowerPoint presentations and even explanatory videos. These are easier for people to use and it saves having to take a lot of written material and convert it into training materials at a later date.
• Section 3 — Tools and Templates. This section contains any forms required by the CMT, record keeping templates and ‘pull out’ guides for the individual team members.

Structuring the document in this way allows you to achieve a good balance between the what (Section one) and the how (Section two) without making the whole document too unwieldy. Make good use of references and hyperlinks to assist with navigation and ensure that you have both electronic and some paper copies of the plan available for the CMT.

Section One

Outlined below is a proposed structure for Section one of a CMP. The nine principles from BS 11200 have been rearranged to make the document more user-friendly. This will provide the CMT with a roadmap which they can use in an actual event. Note: any principles not directly related to the response, such as competence and skills training, are not included in Section one but these should be explained in Section two.

1. Event Severity

Outline a standard way to assess and describe how severe an event is up to and including a crisis.

2. Notification and Escalation

Describe the process used to notify the appropriate teams required to respond to the event and to escalate notifications up to the appropriate level based on severity.

3. Mobilization

Describe the process to use to decide if the CMT needs to be mobilized, who will make that decision and how the team will assemble.

4. CMT Structure

Explain the membership of the CMT, the reporting structure within the team and between the CMT and other elements of the response. Include the details of the primary team members and alternates for each position. Names and contact for the CMT should be included in the CMP but this can be in an annex or via electronic links to help with document maintenance.

5. Immediate Actions on Mobilization

Set out the initial steps for the CMT to take once they are mobilized. These include receiving an update on the situation, responding to immediate, urgent requests for support, notifying key external stakeholders and authorities and preparing the initial press release (if appropriate).

6. CMT meetings.

Set out a simple agenda to allow the CMT to achieve a good understanding of the situation, track progress of the response and address key issues that require CMT consideration. The agenda should be flexible to allow the CMT to tackle a range of topics but also remind the team of the need for timely decision-making to avoid slowing the overall response. A template should be included in section 3.

7. Understanding and Decision-Making

Describe a clear, simple process for developing understand and making decisions during CMT meetings. Ideally, these processes should be similar to techniques used in the organization’s day-to-day activities to help with familiarization and to cut down on the training required. Supporting templates should be included in section 3.

8. Coordinating the Operational Response

Explain how the CMT will issue directions to the various components of the operational response. It should be clear who has responsibility for liaising with each element of the operational response and how and when this should take place. Note: the responsibility may change depending on the specific situation and this should be reflected in the process.

9. Coordinating Stakeholder and Community Relations

The process for identifying stakeholder, developing key messages and communicating externally should be explained in detail. These activities will be shared between communications, HR and some senior managers so responsibilities must be clear. There also needs to be a clear approval process for the release of statements and information. Templates for key message development, stakeholder mapping and approval for the release of information should be included in section 3.

10. Logging, Reporting and Information Management

The CMT needs an efficient process to receive and share information with other parts of the organization and a way to maintaining detailed records and logs. Responsibility for information management and document control should be specified. Log-keeping templates should be included in section 3.

11. Demobilization

Have a clear process for determining that the crisis has abated and for formally declaring it over. Include a list of parties to inform when the crisis is over and who is responsible for notification.

12. Investigations and Learning

Have a clear process for initiating an investigation using objective internal or external parties. Detail how an investigation by the authorities will be handled. Explain who is responsible for ensuring that any lessons identified are shared and implemented appropriately.

In a perfect world, none of these 12 elements should be more than two pages long. You should keep Section One as clear and tight as possible. Additional explanation can be included in Section Two. The tools and templates in Section Three will supplement the processes.

If you find that the CMP is becoming too big or you are struggling to get it finished, that may be a sign that the plan is becoming too specific or complex. Don’t forget KISS.

What I have tried to outline above is a simple approach and a basic structure that you can use to develop your own plan. Even if this isn’t enough to build out an entire CMP by yourself, it will at least give you a start point to consider the kind of information you need when it is time to tackle this project using an external expert or another resource.

Testing, Revising and Maintaining the CMP

Unfortunately, developing the CMP is the easy part. Training and exercising the CMT and keeping the plan up to date will require a large amount of time, effort a significant commitment from your senior managers. However, without these activities, the CMP will be nothing more than a document on a shelf or in a hard drive. Make sure that once it is developed, you have steps in place to embed the CMP in the organization and to keep it current.

Training and exercises are key elements of this and you should plan on a ‘little and often’ training regime which allows people to tackle unfamiliar skills in bite-sized chunks. Moreover, this approach also helps keep crisis management fresh and front of mind, rather than being something that you only do for an afternoon, once a year.

Once individual and team skills have been built up with training, you can move on to exercises. These should begin with desktop walk-though or ‘page-turns’ where you use a simple scenario as a basis to discuss what the team should do and to practice using some of the processes in the CMP.

From desktop exercises, you can move on to simulations. These can be simple, modest events or as advanced as time and budget will allow. A full simulation should place the team in a stressful situation using a scenario that is as realistic as possible. As long as things remain safe, you should encourage the participants to push the boundaries of the exercise to gain the maximum benefit.

Importantly, exercises are also an opportunity to test the CMP itself. You should continually ask ‘do these processes work?’ as you are conducting the exercise. Remember, if something doesn’t work in a training session, it certainly won’t work in a the high tempo environment of a real crisis.

Although stressful, exercises will help the team develop and ensure that the CMP is robust.

Finally, in addition to any lessons learned during training, the CMP should be revised and updated with any learning gathered from actual events. These can include near misses, incidents that the organization or a peer has experienced or changes in the operating environment. All of these will potentially expose flaws in your CMP so make sure that lessons are captured and that the plan is updated. Don’t forget to also keep an eye on changes to regulations and standards which will be updated every few years.

Summing Up

A well-trained team has a decent chance of success in a crisis but they will also benefit from a clear plan to help guide them. A less trained team has very little chance of success without a plan. Often, even experienced teams confronted with a crisis were unsuccessful because they didn’t follow their plan.

Having a CMP — and following it — makes an enormous difference in a crisis and can easily be the difference between success and failure. Unfortunately, there is no way to guarantee that senior leaders will follow any plan. If you don’t even have a plan to put in front of them, then you are ensuring that the response is going to be much, much harder than it needs to.

So please, build a CMP.

Originally published at dcdr.io on April 12, 2018.