While the scope and nature of an organizational emergency is hard to predict, between the COVID pandemic, the SolarWinds Cyberattack and innumerable ransomware attacks, modern times demonstrate that emergencies are guaranteed to arise. “In today’s fast-moving, electronic world, your reputation could be enhanced or denigrated in a moment,” says Ed Powers, faculty of Northeastern’s Master of Science in Corporate and Organizational Communication program.

For organizations, crisis management has become a baseline where having a solid response plan and team in place for managing and communicating about the incident is the norm. Board preparation and buy-in with the crisis management and communication strategy is a must.

Fundamental for building a Crisis Management and Communications strategy are:

• Building Effective Crisis Management and Communication Teams
• Developing a Crisis Playbook
• Identifying Crisis Management and Communication Leaders
• Determining Actions to Take Before, During and After a Crisis
• Defining Crisis Management and Communication Team Roles

Building Effective Crisis Management and Communication Teams

An effective crisis communications team works in close partnership with a crisis management team. Depending on the size of an organization, these functions may be within one team. However, the skills required to manage a crisis and those required to communicate about the event are not the same. Your organization may deal with many incidents – but not all rise to the crisis level. Make sure your event definitions are clear – for example, when does an incident become a crisis? When does a hand-off need to occur so that the crisis communications team has the appropriate information with which to craft their response? Crisis managers will continue to work toward resolving the incident while the communications team provides updates to stakeholders.

A crisis management team should be flexible and extensible so that Subject Matter Experts can be called upon depending on the nature of the crisis.  The following areas should be represented so that all implications can be considered:

• Information Security
• Security Operations Center
• Physical Security
• Third Party Risk Management
• Legal, Privacy, Compliance
• Technology
• Property
• Business Continuity

If an extreme technology incident is suspected, Disaster Recovery teams should also be engaged. The severity of the incident will dictate when senior Executives or Board Members should be involved.

Developing a Crisis Playbook

Across various types of organizations, a crisis management and communications teams may look different. This is a function of resources. A very large organization will likely have an internal team which is augmented by outside crisis management firms that are often held on retainer and engaged when necessary. A small organization may have to handle all events internally. However, given the exorbitant and potentially unrecoverable cost of damage to reputational risk, even small organizations should consider engaging a crisis communications firm to help develop – at a minimum – a playbook. This playbook should outline the roles and responsibilities to be followed once an incident is declared a crisis. Once established, it is best to consistently include the same resources to ensure status and remediation information is disseminated carefully, rapidly and controlled.

Identifying Crisis Management and Communication Leaders

Whether it is managing a crisis or communicating about a crisis, one should look for individuals who can communicate clearly, concisely and calmly. It is essential these individuals have a solid understanding of the organization so they can understand and quantify the impacts of an incident. These leaders are authoritative and must be able to command respect and instill confidence in others.

The responsibilities of crisis communication leaders varies from organization to organization. In large organizations, crisis communications is often the purview of the communications/public relations team. Specific to communications, the manager of the team has overall responsibility and accountability for the detail and tone of the messaging – pending approval by the C-Suite and Board of Directors. The manager may have team members helping to craft the messaging – with some concentrating on social media; some on print; and some on broadcast venues.

The crisis manager must focus on responding to incidents, engaging appropriate key stakeholders, conducting touchpoint calls, documenting and tracking risks to mitigation closure, and reporting incident status in line with timelines outlined in the incident response playbook.

Determining Actions to Take Before, During and After a Crisis

Each phase of a crisis is equally important. But what is done before a crisis occurs will often determine the success of how an organization deals with crises. Regardless of size, organizations should routinely consider what a crisis would be for their organization and think through different scenarios and their ramifications including how they will communicate to stakeholders. Crisis Management Tabletops should be conducted at all levels of an organization – up to and including the Board of Directors. If an incident becomes a true crisis, the C-Suite and the Board of Directors will be facing off with stakeholders (including but not limited to customers, shareholders, press, regulators, etc.), so Crisis Management Tabletops should include and stress communications.

During a crisis, the teams should stick to their plan. This is no time to reinvent the wheel. Focus on resolution – returning the organization to business as usual – and providing communications teams with accurate information – stressing that in a dynamic situation, information can and will change over the course of the crisis.

After a crisis, it is time to assess and determine what if anything in the processes need to be changed or updated. Not only in the communications processes – but did the crisis expose weaknesses in other organizational controls that need to be remedied. And what follow-up communications are your stakeholders anticipating or expecting?

Defining Crisis Management and Communication Team Roles

There are key players in every crisis:  the managers who establish and maintain order throughout the lifecycle of a crisis; the respondents who are taking the steps to resolve the crisis; and the communicators who are crafting the message. In a small team the crisis manager and the crisis communicator may be the same person. As mentioned earlier, this could be problematic. You can be a great crisis manager – riding herd over a myriad of moving parts but not necessarily be able to craft a written or oral response fit for diverse and complicated audiences. Similarly, you may be a brilliant communicator, but be unable to handle the pressure cooker of crisis management.

Summary

While not every ‘incident’ is a crisis, every incident has the potential to evolve into a crisis if mismanaged. Once a crisis, the damage will increase exponentially if communications are mishandled. Practice makes perfect, or in this case prepared makes perfect. Holding quarterly incident or crisis management scenario-based tests and engaging the right stakeholders will help to build the critical relationships to survive a crisis at any level and impact. Take key learnings and update your playbook accordingly to ensure they are covered in future tests. Most importantly, be sure scenario-based exercises are realistic so that anyone taking part gets substantive value from the experience.

To gather some more common sense tips for Incident Management, read When Business Resilience Falters: The Criticality of Incident Management.