Creating A Crisis Management Plan - crisisconferences.com · Agenda. 1. Why Having a Crisis Management Plan is Imperative 2. Start Creating Your Plan 3. About the Plan 4. Crisis Communication

Creating A Crisis Management Plan

September 28th, 2017 – 1100 - 1200hrs EST

Agenda1. Why Having a Crisis Management Plan is Imperative2. Start Creating Your Plan3. About the Plan4. Crisis Communication5. Training the Crisis Management Team6. Exercising the Crisis Management Plan7. Plan Execution and Triggers8. Periodic Updates and Maintenance9. Summary10. Questions & Answers

T h e I n t e r n a t i o n a l C r i s i s M a n a g e m e n t C o n fe re n c e , L L C - 2 0 1 7

About Mark Hoffman

T h e I nte r n at i o n a l C r i s i s M a n a ge m e nt C o nfe re n c e , L LC - 2 0 1 7

• Originally from New Jersey (Exit 1), now a citizen of Canada• IT Background• 18 years crisis management / business continuity experience • Certified Business Continuity Professional (CBCP)• Owner: Anesis Consulting Group, Inc.• Professional Member: ICMC• Collaborative, Relationship Building• Extensive Experience in Multiple Industries

• Financial Services• Insurance• Utilities• Service Industries

Crisis Management

Business Continuity

Disaster Recovery

In Touch….

+1.705.252.6150

[email protected]

@Mark Hoffman_CBCP



1. Why Having a Crisis Management Plan is Imperative

• Respond vs. React• Mitigate Impact• Control Your Communications• Define Roles & Responsibilities• Reduce Chaos• Prepare Yourself to Put Your Best Foot Forward


“With all due respect sir, I believe this will be our finest hour.”


2. Creating Your Crisis Management Plan

• Get Senior Leadership Buy-in• Build the Team• Lay the Foundation

• Program Framework & Governance• Gather Appropriate Data: Business Impact

Analysis• Intelligence Driven Crisis Management

• Risk (Impact) Based

• Write, Vet, Repeat


Lay the Foundation: Framework & Governance

• Avoid ad-hoc activities• Define the scope• Establish Objectives, Functions and Mitigation Strategies *

• Protect People and Assets, Prepare Communications, Ensure Availability of Technology, Manage Risk, Continue Operation of the Business

• Build the Team• Identify team members and their collective purpose• Determine specific roles & responsibilities for each member

• Determine overall rules of engagement for the program• Reporting, authority, exercises, maintenance

Example: Objective, Function, Mitigation Strategy

• Objective: Protecting Our People• Function: Develop instructions and implement tools to

track travelers and to notify and update employees during an emergency to make sure they are safe.

• Impact Mitigation: Fewer people are impacted. Determines if people are in the affected area and provides communication protocols to notify impacted employees.



Lay the Foundation: Gather Data

• Business Impact Analysis• Understand Risks through Impact Assessment

• Financial• Reputation• Operation• Legal & Regulatory

• Two key sets of data:• Priority Matrix < Understand operationally what needs attention first• Impact Profile < Proactive understanding of impact to the organization


3. About the Plan

• Varying Views on Content: Minimal vs. Robust• Must be Easy to Find• Must be Easy to Use• Must be Current• Must be Thorough • Must Know When to Use the Plan

• Including what triggers a crisis • This is a benefit of having a plan that is part of a program


4. Contents of the Plan• Guiding Principles: Crisis Management Team Lead• Call to Action• Roles & Responsibilities• Initial Response Agenda• Guiding Principles: Lays out tasks assigned to team leads

• People• Assets• Communications• Technology• Cyber / Privacy• Risk• Business

• Contacts


5. Crisis Communications• Nothing more critical than having a solid crisis communications plan

“Exposure is not just limited to the breach itself, but also how companies respond to that breach.”~ Lawyer, Handing Cyber Security Breaches


5. Crisis Communications• Nothing more critical than having a solid crisis communications plan• Communications team lead is an active participant at the crisis management table• Communications team documents all communications:

• Press Releases, Media Advisories and scheduling of Press Conferences• Internal communications to employees, department heads, etc.

• Information is released upon approval of the Crisis Management Team• Distribution of materials is shared depending on audience• Prepares company spokesperson for interviews / press conferences• No other member of the crisis management team is authorized to release information

• All media requests for information are to be directed to the company spokesperson• Employees are not to speak to the media or post information on their own personal

social media pages (Facebook, Twitter, Instagram, etc.)• Pre-draft commonly used documents (templates)

• Press releases• Employee updates


Learn From Other Incidents: Lac Magantic

“From every mistake, we must surely be learning.”~ George HarrisonWhile My Guitar Gently Weeps

Presenter

Presentation Notes

Railroad president Ed Burkhardt “The most despised man in Quebec” The CEO arrived 4 days after the event. He was unprepared to meet with the media. He made the interviews about how he felt and the ‘best use of his time’. He talked business – rather than focusing on the people. He had poor demeanor and was condescending. At one point even said to a reporter “Were you here a few minutes ago when I answered that?”


6. Training the Crisis Management Team• Know Your Audience

• Executives have their own ‘style’• Strong personalities, used to making decisions• Not crisis managers per se

• “Coaching Up”• We want to eliminate “Alexander Haig Syndrome”

• Establish clear line of command• Define roles and responsibilities

• Walk through the plan• Make sure the team is fully aware of the process• Must be aware of the scope of the plan• Must understand what (and who) triggers the plan

• And How the plan is triggered• Make communication protocols clear

“I’m in control here at the White House…”~ Alexander Haig


7. Exercise the Crisis Management Plan• After the walk through conduct a tabletop exercise (TTX)• Write an Exercise Plan

• Sets the schedule• Defines the participants• Sets the scenario to be followed• Identifies the objectives• Establishes success criteria and verifiers• Defines tasks required to prepare for the exercise

• Publish the Exercise Plan as early as you can• Allows the Crisis Management Team to understand what they’re

attempting to do• Turns the Exercise Plan into a project plan as you work against your

schedule to prepare for the exercise


Tips for a Successful Exercise• Plan it out• Pick a plausible scenario

• Will help you to avoid arguing during the exercise about how practical the scenario is

• Layout a reasonable timeline of the crisis• Establish the time of the incident and add details as your virtual clock moves

forward• Add challenges such as worsening conditions, injuries or rumors

• Use tools and graphics to increase realism• Avoid the Pass/Fail mentality

• Every exercise has the opportunity for lessons to be learned• Update the plan based on lessons learned


8. Plan Execution & Triggers• Define your initial response protocol. • Identify

• Your crisis management point person is made aware of a potential incident.

• Triage & Investigate• A quick response establishes if the incident is serious and if there is impact to the

organization. Further investigation is conducted if warranted.• If required, declare a crisis…

• Respond• Execute the Crisis Management Plan.

• Report • Every incident requires an incident report.

Identify Triage Respond Report

The Incident Report


• Recommended even if the incident doesn’t trigger Crisis Response• Every incident is an opportunity to learn

• Captures details of the incident• What, where, when

• Shows communications trail• Time, message, communicated to/from

• Documents impact• Documents response• Identifies Lessons Learned

• What worked well• Recommendations

• If you can learn from non-crisis incidents, it’s almost like running an extra exercise!


But What Triggers the Plan?• What is a crisis?• Will be specific based on your organization• A disruptive event affecting your

organization’s people, assets, technology, operations or reputation – that cannot be managed by normal day-to-day operations

“I shall not today attempt further to define the kinds of material to be embraced, but I know it when I see it.”~ Justice Potter Stewart (1964)

Identify Triage Respond Report


8. Maintenance & Updates• Should be dictated by the Framework or Policies established by your

Program• Annual review and general maintenance is required• Do as part of annual exercise schedule

• Contact updates done in preparation for the exercise• Material changes done as a result of the exercise


9. Summary• Crisis Management Plan is a tool use as part of an overall Program• Use key data that has been collected to establish priorities and

understand risk / impact• Establish buy-in• Socialize the plan, roles & responsibilities• Know what triggers the plan• Practice, practice, practice

Questions and Answers



www.crisisconferences.com

Professional Member Features and Benefits:

- Monthly Webinars from Industry Experts (Sept 20th, Components of Organizational Risk Management )

- Access to the Virtual Crisis Management Conference - Discussion Forums- Videos (Over 20 Hours of Conference and Webinar Video Presentations)

- Presentation Downloads- Access to a Growing Community of Likeminded Professionals

- Special Offers on Future Events- Many Additional Features and Benefits

http://www.crisisconferences.com/


Special Events

October 10th – 12th Annual Virtual Conference

6 Speakers and Presentations Over 3 Days

Paid Event Unless You're a ICMC Professional Member

https://www.crisisconferences.com/virtcon2017/

https://www.crisisconferences.com/virtcon2017/

WE’RE SOCIAL

CONTACT US!

+1.401.236.1364 X714

[email protected]

@CrisisCons


LIKE WE RESPOND”“WE SHOULD TRAIN

PHOTO CAPTION
