Plans ‘just pieces of paper’ without practice

While firms might have detailed crisis management plans, this alone is not enough to ensure appropriate risk management during a crisis, says Graeme Newton, partner of risk at Deloitte. He says it’s all about “practice, practice, practice”.

“When you get mobilised [during a crisis] that should not be the first time the team has come together in that situation,” Australia-based Newton says.

“If a particular situation breaks, and you are not practiced or well-drilled in it, then you are caught flat-footed and there is a lag effect which puts you behind the pace.”

The former head of the Queensland Reconstruction Authority and director-general of the state’s Department of Infrastructure and Planning says there are a range of risk plans, such as continuity plans, crisis management plans, critical infrastructure, and IT disaster recovery, which form the fundamental platforms of risk planning.

However, the most vital aspect is the people involved and the teamwork.

“You can have as many plans as you like, but if they sit on the shelf and do not get practiced and rehearsed, by the people who have to make the critical decisions, then they are just pieces of paper,” he says.

“The value comes in not only crafting plans but also bringing the team together and practicing.”

Newton says the practice and simulation process should be seen as part of continuous training and improvement.

“You cannot just do it and say ‘well, that’s done, we will not do anything for another five years’. It is something you need to build over time,” he says.

Preparation is key

Steve Hather, partner at Entamio Education Group, agrees that it is critical that companies have an easy-to-follow crisis management plan, with people that know how to use it, and have practised it.

“The companies that are well-prepared [for a crisis] are in control with sensible actions and consistent communications,” he says.

“They acknowledge that a problem has occurred and they are getting on with addressing the concerns and expectations of stakeholders.”

Hather says that while an appropriately prepared company is created through good leadership, even more vital is good preparation.   

“Plan and practice. Develop a plan that includes good guidance on the most important elements of incident response – investigation, assessment, strategy and communication.

“Train your people in how to use the plan and develop the key skills, then practise through a realistic simulation exercise.

“I do not mean the normal ‘mock recall’ which is not much more than a traceability exercise, I mean actually including role-playing key external stakeholders such as irate customers, concerned consumers and regulators.

“The middle of a crisis is not the time to find out that you do not have adequate processes and your people do not respond effectively in a crisis situation because they have not been trained and have not practised it.”

Serious scenarios

Newton also warns that the practice scenarios must be as realistic as possible.

“You need all the members of the [risk and response] team, including the CEO. I witnessed one [practice scenario] recently where the CEO was involved and they even performed a simulated all staff telephone call,” he says.

Something that inhibits the implementation and success of crisis plans is the ‘it’ll never happen to me’ strand of thinking, says Newton.

“They look across the board and see their competitors who experience it and they say ‘look, we are smarter than them, so it will never happen to us’,” he says.

Hather adds that as risk response processes should be simple and intuitive, this can cause senior executives to become complacent.

“As a result, if an incident occurs, senior executives think they will calmly sit down as a group and figure it out.

“They do not think they need to practise that.

“Tell that to the very smart and experienced business leaders around the world who still cringe at their first response to an incident.

“The truth is that even the most experienced people will struggle with a response to a potential crisis without a whole lot of work having gone beforehand to make sure the leaders are well-briefed on what happened, what the company is doing about it, and addressing some key concerns and expectations.”