A coach of the German football was once asked what made the team so successful at winning competitions. He replied that to do well in the first half of the competition you needed energy and desire, but to do well in the second half you needed technique and discipline. It is similar in developing effective risk, resilience and crisis management capabilities. There certainly needs to be support and buy-in at every level of the organisation, from the car-park attendants and toilet cleaners through the general staff and the team leaders, all the way to the divisional directors and the chief executive officer, but there also needs to be the technical skills that will allow the organisation to understand its own capabilities, identify its weaknesses, and create an on-going culture of risk management that will allow it to become a truly resilient organisation.
The ten points on the checklist below can be used as a quick guide in assessing how mature the organisation’s risk management culture is, and how strong (if at all) the underlying risk management foundations are.
Point 1: Risk Sensitivity
The first point that needs to ask is how mature an organisation is in terms of recognising and acknowledging risk. Just as a teenager will do things that are clearly (at least to older, wiser eyes) foolish and potentially injurious, but they will nevertheless completely ignore anyone who tries to tell them that, so many organisations have an attitude towards risk that is clearly, at least to an outside observer, potentially harmful. If the overall approach to risk is one of wilful ignorance and an inability to discuss it in a meaningful way, then there is little else that can be done.
Point 2: Time Gap Management
There are two time gaps that are critical in assessing the ability to manage a crisis. The first is the time that it takes from a potential or actual crisis to be triggered, and the organisation to recognise it as such and then start to do something about it. Most organisations will spend a significant amount of time and effort trying to pretend that there isn’t a crisis, during which time the crisis itself is developing, growing and becoming more destructive. The second time gap is the time it takes between the organisation acknowledging the crisis and then having the ability to respond in a way that will actually impact on the external event, as well as increasing the organisation’s chance to either manage it or, if it has got to that stage, survive it.
Point 3: Development of Crisis Management Team (CMT)
The ability to put together a crisis management team that can take control of the situation at the very start of the actual or potential crisis is a significant issue for any organisation. Crises are, by their very nature, rare events, and if the people involved in the CMT are not aware of their roles, have not practiced them or do not understand the specific challenges associated with crisis management, then it is almost certain that the crisis management process itself will fail, and that within a very short time it will be the management failure that becomes the focus of attention as well as the actual crisis itself.
Point 4: Information Overload – Creating a Common Operating Picture
The problems in crises is not that there is not enough information, but that there is an overload of information, much of which will be partial, muddled, contradictory and without any context that can give it an overall meaning, all of which needs to be assessed and judged as to its veracity, its relevance, and its place in the overall picture. The single issue that emerges in all post-crisis reviews is that the information management system was overwhelmed within the first few minutes, and that that in itself became a critical issue in the development of an effective and meaningful response. The presence of a team that can sort that information, and pass it on in a structured form to the decision-makers , creating a Common Operating Picture that can be shared by all stake-holders, will be a critical step in creating an effective crisis management response.
Point 5: Interoperability
Any crisis response is going to involve a multiple of response teams, both internal and external, formal and informal, and it is the ability to create immediate working relationships with all of those teams that will set the foundation for an effective multi-agency response. All crisis response operations will be made up of a mixture of command and control, coordination, collaboration and cooperation, and it is the ability to understand the differences between these relationships, and to make them work in the pressures and challenges of an actual crisis response, that will allow the different teams to develop effective working practices.
Point 6: Distant Management
Although many organisation talk about ‘empowerment, and ‘decision-making autonomy’, once an actual major incident occurs, the natural reaction of most organisations is to try and control decision making. They do this by bringing decision-making authority back to the centre (the headquarters), and restricting it to a few chosen people, without whose authorisation nothing can be done. Although it is easy to understand why an organisation does this, that does not justify it. In fact, the desire to take decision-making authority away from the people who are actually involved in the management of the situation s one of the chief cause of response breakdown. The basic rule is, that the further away the person making the decisions is from the scene of the event, the more time it will take for responses to be developed, the less effective they will be, and the greater the impact on the actual response operation.
Point 7: ‘Support and Adapt’, not ‘Command and Control’
The use of the phrase ‘Command and Control’ presupposes a traditional, military-style centralised, hierarchical command-based management system. Although this may be effective in the highly disciplined and well-trained environments within which a military operation will be operating, it does not reflect the reality of the more chaotic and less well-structured response frameworks that most emergency and crisis management operations are dealing with. The truth is that most response teams on the ground do not need a hierarchical command system to tell them what to do – it is clear to them from their own assessment as to what needs to be done. The role of the management system then is to understand what is needed, and to ensure that the necessary supplies, man-power and other resources are provided so as to enable the response teams to manage their own operations as effectively as possible.
Point 8: Creating an Information Exchange Network
All emergency response operations are complex, and involve high levels of interaction of multiple teams at different areas of the operation, all operating at extreme levels of stress on both an immediate and long-term basis. One of the critical responsibilities of the strategic management team is to ensure, a s much as possible, that there is a Common Operating Picture, that is, that as many people as possible involved in all aspects of the operation are sharing as much information as possible. This aspect of ‘information exchange’ and ‘information sharing’ means that all of the different teams and agencies are able to feel themselves as being part of a unified response operation that is working together to achieve a common goal, rather than each team working in isolation, with little if any understanding of what else is happening around them in the wider response context.
Point 9: Protecting Reputation: Managing the Message
In the modern world, there is no such thing as a ‘private incident’. Any incident that affects people or impacts on them in some way, can be considered as potentially global in the nature of the media coverage it can attract, both from traditional news sources – television and newspapers – and modern – social media in its various forms. The ability to manage that message, and to use it to protect an organisation’s reputation, is a critical part of any crisis response operation. Recent examples that have hit the headlines, and from wildly different events, include the failure of the local council in north London to response effectively or appropriately to the Grenfell Tower fire disaster, the failure of British Airways to respond effectively when the failure of its ticket-booking system led to the disruption of hundreds of flights worldwide (and which they initially blamed on a minor power failure), and the catastrophic response of United Airlines when two security staff were filed dragging a passenger of one of its planes after they had over-booked the seats. The fact that the mobile-phone footage on the United Airlines incident went viral (together with the failure of the CEO to respond effectively), led to United losing $900 million in two days from their share price. Social media is a powerful tool that can allow an organisation to be in the best position to manage and influence the response to any incident it is involved in, but just as with any aspect of emergency response and crisis management, that capability cannot be created in the middle of an actual crisis event. The ability to plan and for and prepare the organisation to make the maximum use of social media in order to protect its own reputation and brand value is one of the critical aspects of any modern crisis response framework.
Point 10: Effective CM Capabilities are Dependent on Sustained Support from the C-Suite
As important as the individual skills are, it is the corporate risk attitude and culture that will have the greatest impact on the ability of the organisation to identify potential crises at the earliest opportunity, to respond in a timely and appropriate manner, and to embody the concepts of organisational resilience that will allow the speediest recovery in the post-crisis period. Real crisis management does not start when a crisis is discovered, but is an embodied value intrinsic to every aspect of an effective organisation’s operation. We put this tenth point in as the last one, because we consider it to be the killer argument, the one that we want our audience to remember at the end of our presentation to the Executive Committee, that they will carry with them, and which – hopefully - they can then use to support the development of an on-going, organisational capability development programme.
Point 11 ... Point 12 ...
Although it is nice to make lists, and it gives us a feeling that we can bring some sort of order and coherence to what is often a chaotic and incoherent reality, these ten points are only a guideline to what could more appropriately be considered as a corporate attitude or ethos.
As you may have noticed, we have left two points blank. That is because there are a whole load of possibilities that we could put in there, but it is up to each person and each organisation to decide for themselves what the final two points should be that are most appropriate to their own needs and requirements.
Some possibilities for Points 10 and 11:
Deltar Training Solutions
Deltar Training Solutions runs a range of specialist risk and crisis management training programmes around the world, including three-day Level 4 Management Awards in Strategic Risk and Crisis Management, and a 12-month distance-learning Level 6 Diploma in Strategic Risk and Crisis Management. Both qualifications are accredited through Ofqual, the UK government’s registry of qualifications.
Dr David Rubens DSyRM, CSyP, FSyI is widely recognised as one of the leading authorities in strategic risk and crisis management, having worked at the highest level of academia, corporate and government risk and crisis management programmes. He currently runs the Deltar Training programmes around the world.
