Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

What does it mean to be a crisis ready organization?

Andrew Griffin details six principles for ensuring that your organization is truly crisis ready.

Most of the work done in the name of crisis management is in fact crisis preparedness. “Are you ready to face the worst?” is a question that boards ask, regulators ask, governments ask and investors ask. They want to know that an organization and its senior management are in an advanced state of crisis preparedness. This article looks at how an organization can become ‘crisis ready’.

1. Preparing policy

Principle: Crisis management is a distinct component of an organization’s wider resilience framework.

Crisis management policy should explain how the organization thinks about and prepares for crises as a distinct component of a wider resilience framework.

The crisis management policy should have a clear definition of a crisis. Every organization needs to know what constitutes a crisis because a crisis management modus operandi should not be invoked lightly. One client once told me at the start of a crisis management improvement project: ‘if the boss says it’s a crisis, it’s a crisis’. This is not helpful.

A crisis is an exceptional, unusual and severe situation. It is not something that happens every day, despite what the fraught communications department might sometimes think. So the definition should reflect this. Also, it is better to focus the definition on consequences rather than causes. At the moment of crisis declaration, it does not matter what has caused it; what matters is the severity of the situation, the potential impacts on the commercial, financial and reputational interests of the business and the need to manage it strategically.

After defining a crisis, the second key purpose of a crisis policy should be to explain how strategic crisis management fits within the wider resilience framework. Crisis management is not the same as emergency response, incident management, business continuity or issues management. But the policy should explain how these operational functions relate to crisis management, and should make reference to other procedures. In a real crisis the strategic nature of crisis management necessarily sits on top of any other management function. Where there are multiple teams managing the same situation, the CMT (crisis management team) must have sight of – and ultimate authority over – all other teams.

2. Preparing leaders

Principle: Crisis management requires strong, effective leadership in both preparation and execution.

Leadership guru John Kotter (1996) has written that leadership defines a vision of what the future should look like, aligns people with that vision, and inspires them to make it happen despite the obstacles. This is true of leadership at any time, and certainly true of crisis leadership.

Crisis management requires creative decision-making, not blind rule following. Leadership therefore makes a huge difference to a crisis response, and leaders must be prepared to fulfil their role.

There are two different leadership roles in a crisis. The first is about leading an organization in crisis, maintaining the support and confidence of colleagues; the second is about maintaining confidence and support outside the organization.

Not all leaders will have the skills and experience to play all roles equally well. This is not a sign of weakness in a leader, merely an acceptance of reality. Some will play the organizational and public leadership role effectively, inspiring confidence and trust whilst leaving others to lead the CMT. Others will be better utilised running the crisis response and allowing others, where possible, to continue business as usual and take the more visible leadership roles. Indeed, anyone who has been involved in a major crisis will know that combining the role of spokesperson and CMT leader is often too much to ask.

There is not only one leader in a crisis. In fact, many senior executives and managers will take on some sort of leadership role in a crisis. As well as being part of a CMT, they may be leading their functional or business support team. And, if the crisis involves multiple geographies, businesses or other ‘tiers’ of a crisis management structure, it is easy to see how a large number of people will be expected to demonstrate crisis leadership skills.

Leadership of a crisis team is different from peacetime leadership. It is a different skill and style. There is no ‘right’ sort of leadership or leader, but a crisis needs decisiveness and direction. A good leader must know what he/she wants the end of the crisis to look like and must be able to persuade the team that it is worth achieving and can be accomplished, despite what may seem at the beginning to be a dire situation.

Crises cannot be managed by consensus, but neither can they be managed by a strident leader whom nobody is following. A collaborative, if not consensual, leadership style is often seen as the critical skill at the strategic response level. It is easy to list out the attributes one might look for in a crisis leader – motivating, providing direction, staying strategic, listening, thinking long-term, being decisive, allowing creativity, delegating, etc. – but the danger is this becomes just a list of ‘nice-to-haves’. The way to prepare leaders is not to try to mould them into an ideal, but to help them better understand and appreciate their styles and skills. This will help them deploy their strengths and recognise their shortcomings, and adapt themselves and their teams accordingly.

Preparing leaders for a crisis therefore involves auditing, testing and refining leadership skills amongst a potentially large group of diverse people. Leaders should be aware of the role they might be expected to play, and should be comfortable with it. Their skills should be assessed in exercises and improved through coaching. Crisis exercises provide CMT leaders with an opportunity to demonstrate their ability to lead under pressure, develop their skills and to gain the confidence of those they will be leading.

Leadership matters perhaps more than anything else in a crisis. It is often easy to tell fairly early in a crisis (whether it is an exercise or the real thing) how it is going to pan out by observing the leadership skills on display. Some leaders relish the opportunity, while others dread it. Some have the humility to understand it is not their forté, and decide to focus their attentions elsewhere; others do not.

What is certain is that leaders will not succeed just because they are senior. They need to be prepared to perform well through good training which focuses on self-awareness of strengths and weaknesses. A mature crisis-ready organization will have a bank of leaders able to take on a crisis leadership role in their function, business, geography or at the most senior level.

3. Preparing structure

Principle: Crisis management requires a clearly defined structure delineating powers between different teams.

Crisis management requires structure that empowers the right people and teams at the right levels to make, implement and communicate decisions.

It is the framework which enables successful crisis management.

A crisis management structure must be clear, intuitive, effective, aligned with internal cultures and practices, reflective of best practice and resilient. As each crisis is unique and all crises are fast-moving, this structure needs to be adaptable. But at the same time there must be a clear demarcation of powers and limitations.

The first structure question is: “Who can have a crisis?” A crisis can, as we have seen, come from many different sources and erupt in different parts of a business. But invoking the crisis manual should be a very formal declaration on behalf of an entity that is empowered to do so.

Some organizations have a one-tier crisis management structure in which the term ‘crisis’ is reserved for the most senior group management only. This is unusual but has the benefit of simplicity and reserves the emotive term ‘crisis’ for only the most serious of global threats. Others have a two, three or even four-tier crisis structure in which a business unit, a country, a region and/or a site can also call a crisis. The current trend is to reduce complexity, with many global organizations now moving to a two-tier structure based on geography: a crisis is either limited to a country/region or is global.

Crisis structure should also be clear about who has the power to call a crisis at the different levels. In the above two-tier structure based on geography, for instance, a ‘group crisis’ might be declared by the group chief executive whilst the country crisis is declared by the country managing director (MD), both of whom should have one or two alternates if he/she is not available.

A clear escalation model is crucial in a crisis structure. It is also sometimes misunderstood. Rarely, if ever, does one crisis team ‘take over’ the responsibilities of another. The different levels have different roles and responsibilities. For example, if a country crisis has been declared, but is then deemed to have escalated beyond the country’s borders, it might be declared a group crisis. But this does not mean that the group crisis team takes over from the country crisis team. It means that, while the country crisis team continues to manage the crisis at its level, a group crisis team has formed to consider implications and actions on a global scale. It would be madness to stand down the country crisis team which is, after all, closest to the matter.
The key is to set the right mandates: authority to make decisions but also an understanding of when to consult more senior bodies or individuals who may in turn declare a crisis at a higher level. The principle of ‘inform one level up’ should apply. Even a group CMT will need to inform or defer to the board on certain matters. The crisis structure should explain these powers and limitations.

Structure should specify the composition of a CMT at any level. The basic formation, and role descriptions, of a CMT should be the same across the organization, so that people in different teams at different levels can liaise with their counterparts and know how other teams are operating. This is the thinking behind the ICS system used in the US (see Chapter

Crisis teams should be formed by roles, not named individuals. A structure that specifies that John Smith will perform a particular role will fall at the first hurdle if John Smith is, for whatever reason, unavailable.

Structure sometimes needs to be overhauled: this might be in light of organizational changes, after a merger or acquisition, after an internal audit into organizational resilience or after a real-life crisis. In the past year, the company I run has helped three organizations to overhaul their crisis structures: one needed to change in light of a crisis that exposed its weaknesses and lack of reputation thinking in what was a business continuity-driven structure; one needed to change from a three-tier to a two-tier structure to reflect a changing global business model; one needed to change because exercises had shown that its structure was overcomplicated and it needed to shift crisis accountability to country rather than business managers. It is sensible to reflect every so often and certainly after real crises, on whether the crisis structure currently in place is the right one.

4. Preparing procedures

Principle: Crisis management requires procedures that guide an organization’s crisis response.

The structure is the framework in which people and teams manage crises. Procedures are there to provide them with some rules and guidance.
Crisis procedures are not procedures in the sense familiar to those in business continuity or incident response. Crisis procedures – or a ‘crisis manual’ which I think is a more helpful term – should be a handful of pages long. It is not a step by step guide as to what to do next in any given situation, but is a set of rules within a working framework in which good decisions can be made, implemented and communicated.

The manual will likely cover mobilisation, roles and responsibilities, access to resource, crisis team composition, escalation etc.

Manuals are simple and user-friendly, not weighty tomes. Otherwise people will simply not refer to them in a crisis. They are also not filled with templates, phone lists, facilities checklists etc. These are important but should not confuse a simple manual. Instead they should be covered in a separate handbook.

Procedures are still crucial, which is why the fact that they are changing is a good sign. They are getting shorter, more user friendly and less comprehensive. Most companies have now binned the A4 bound manuals in favour of a thin A5 folder and a credit card sized version which contain the basics. And enlightened companies are realising that manuals will never provide the answers to the many questions that a crisis poses. They are therefore designing them as enablers, not straightjackets; guidance, not instructions.

Having worked with many companies during crises, it is clear that people must come first. Competent, trained people will find their way through convoluted process; incompetent, untrained people will make a mess of the best processes in the world. But – best of all – good process can enable competent people to make better decisions.

5. Preparing people

Principle: Crisis management requires trained, skilled professionals to fulfil specific responsibilities.

Process is a necessary but not sufficient factor in good crisis preparedness. The rest is about people. Crisis management requires trained, skilled professionals to fulfil specific responsibilities.
There are plenty of training sessions – crisis best practice workshops, crisis spokesperson training, crisis communications training, media response, relative response etc. – which companies habitually run to prepare their people. First and foremost, people must understand their roles as detailed in the crisis manual or supporting guidance (e.g. functional manuals like the crisis communications manual). But competence development should also look at ‘soft’ skills and behaviours: team-working, persuading, speaking up.

Perhaps the most important people intervention is the crisis simulation exercise. This is a one day or half day exercise that tests aspects of an organization’s crisis preparedness. Working through a realistic scenario under pressure is an invaluable way to assess the strengths and weaknesses within the crisis response, the abilities of the individuals on the CMT and other teams, and dynamics within and between these teams. Of course, the ‘real thing’ will pan out differently to the crisis exercise, but that does not matter: leadership, structure, processes and competencies can and should be practised.

In crisis management, people matter. And the best way to prepare people is to give them plenty of opportunities to practise. Practise does not make perfect, but practise makes better.

6. Preparing culture and relationships

Principle: Crisis management requires a culture that values reputation and the importance of external goodwill and relationships.

Companies that have a positive internal culture where reputation is genuinely understood and valued as a strategic asset will have a good backdrop for successful crisis management. It makes people want to exhibit the right behaviours, do their best, do the right thing and work hard for a company under pressure and scrutiny.

Culture is the internal context; goodwill and relationships provide the external context.

For all large organizations, managing a future crisis starts today. All the crisis policy, structure, process and competence will come to nothing if you do not have goodwill and good relationships to call upon when things are not going well. One of the most important things a company can do to prepare for a crisis is ensure during peacetime that it has a good reputation and a good network of support.

This is what BP found when it experienced the Deepwater Horizon oil spill in the Gulf of Mexico in 2010. The company was tolerated, but certainly not loved, by most stakeholders. It found that, when it was down on its luck, there was a queue of politicians and others ready to make matters worse rather than lend it their support. And banks are experiencing the same problem now. Now is not a good time for a bank to have a crisis. There is currently limited goodwill for banks amongst stakeholders and the general public. Any issue or incident is likely to escalate into a crisis given the strength of bad feeling.

The importance of relationships and goodwill is especially salient for the communications department, usually tasked with driving stakeholder engagement and measuring the organization’s reputation. But it is something that an entire organization should be aware of. Third party advocates give their support based on trust. Trust is in short supply in the middle of a crisis, but can be established in advance.


Crisis preparedness is about being ready for the worst at a strategic level. This means preparing leaders and others to perform at their best in the toughest of circumstances. They need policy, structure and process to help them, and they perform best in a culture that values reputation and the importance of good will and relationships. But above all they need the competence and confidence that come from awareness raising, training and testing.

The author

This article is an edited excerpt from a new book ‘Crisis, Issues and Reputation Management’ by Andrew Griffin, CEO of Regester Larkin. Continuity Central readers can obtain the book at a 25 percent discount. Go to www.koganpage.com/CIRM and enter the discount code: RL25 during the checkout process.

•Date: 23rd April 2014 • UK/World •Type: Article • Topic: Crisis management

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here