Dermott White takes a ringside seat for an intriguing session on crisis management at the RIMS conference in Chicago.
Although the effects of September 11 still reverberate, the absence of a major catastrophe since that fateful day has seen companies begin to relax about the possibility of a serious crisis. Of course, crises are not restricted to horrendous terrorist attacks, but September 11 was the strongest possible reminder of the inherent vulnerability of business to a disaster, whether it be financial or life- threatening.
"Every company is at risk," James Connolly, the managing director of Marsh Crisis Consulting, told a well-attended RIMS session in Chicago. "If you go back and look statistically, about every four or five years a major or large organisation will potentially have a crisis. That doesn't mean they will go out of business but it certainly means they will face a serious event that will potentially threaten their firm."
Most large companies have some crisis management plans in place but the planning is often unpracticed, siloed - specific to each division, not organisation wide - and many companies often commit the cardinal error of planning only for the crises they expect. In addition, many companies overlook the importance of planning for the human impact of a crisis.
For these reasons, said Mr Connolly, crisis management was a key issue - one that had to be dealt with by a company's top level executives. "Leadership is the key in this process," he said.
A crisis is a "high-stakes test of leadership". The ability to handle a crisis is a vital new standard of good corporate governance because it has a major and immediate impact on shareholder value and a long-term impact on reputation or brand and, therefore, market share.
"If you talk to the people who really think about this, the 'Warren Buffetts' and others who look at the value in companies, they really focus on ... reputation or brand. You can make up the financial loss but it's very difficult to make up the reputational or brand loss," said Mr Connolly.
He added that Marsh's statistics showed that a crisis well managed could ultimately strengthen a company, and its share price, by proving that it had the management, planning and resources to handle even the toughest situations.
Mr Connolly defined a crisis as "any event, or series of events, that threatens a severe negative impact to an organisation's financial results, brand, reputation or relationships with employees, customers or suppliers" and he outlined a variety of crisis triggers (see figure 1).
The good news is that although many companies may have become a little complacent about the possibility of a crisis, they are now more than ever aware of the need for crisis management. This is thanks to uncertainties created by factors such as the war on Iraq, the threat of terrorism, the weak global economy and the growing emphasis on corporate governance.
"The bad news is that many companies don't have a [crisis management] plan and if they have a plan, they don't exercise it," Mr Connolly said. There are two main reasons for having a crisis management plan. Firstly, it is an attempt to shorten the duration of the crisis - the lost time and productivity. Secondly, it is about reducing the impact on the brand and the financial side of the business.
The plan has to be comprehensive and flexible. It should incorporate deterrence, detection and then intervention. If the problem reaches a crisis stage, the company in question has to be able to respond to it in real-time and, having dealt with it, get moving with the recovery and analysis - measuring the impact, learning the lessons and revising the crisis management strategy.
According to Mr Connolly, for the plan to be successful, a company will need to put several key disciplines to use, including: crisis communications, business continuity, security, human impact and emergency response. However, he emphasised the need for communication and to integrate those disciplines: "These things often go ... in silos. The point is that in a true crisis, the odds are you're going to need to implement more than one of these at the same time. Crisis management is about the integration, and how the senior management team interfaces with those people or processes in the organisation."
Mr Connolly said Marsh Crisis Consulting had identified three steps to effective crisis management.
"Step one, name that team. It's like going to the ball game and fielding nine players but it's really nice to know who the nine players are before you get into the game. Have they practised? Have they worked together before?"
He added that although there was no right answer about who should be on the team, it had to fit the organisation and should integrate senior management from operations, finance, security, human resources, risk management, legal and public affairs.
Step two involves establishing clear procedures and protocols. This involves answering questions such as: who chairs the crisis management team? How is it called into session? What are the alerting procedures and protocols? Who tracks the action items? How are decisions made? Where does the team find the necessary resources?
Step three, he said, could be summed up in three words: "Exercise, exercise, exercise. Many organisations ... will build a plan, put it on the shelf, lock it away and say, 'We've got a plan.' That's generally a wasted plan. A plan not exercised is no plan."
Regular exercises allowed the team to think about the unthinkable while testing the plan, he said. Regular exercises are equivalent to a regular "audit" of crisis management.
Mr Connolly said crisis management best practice was the final requirement for executive-level managers. He said they had to validate and confirm current levels of crisis management by running assessments and doing exercises, and that crisis management capabilities should be constantly enhanced.
"But don't try to solve it all at once ... incrementally improve your programs."
Underestimating the impact of a crisis on staff is another key mistake that many companies make in their attempts to get operations back to normal. Mark Braverman, a psychologist who is a senior vice president at Marsh Crisis Consulting, said: "Every crisis is a human crisis and there is no business continuity without people who are in good enough shape and who feel good enough to continue working ... the biggest mistake a company can make in its planning for crisis management is to focus on systems, operations, infrastructure and public relations but ignore the effects of a crisis on its people... You have to take care of people as people."
A vital part of looking after employees is communication. Dr Braverman said a CEO and an executive team that was visible to staff, making decisions and communicating them on a daily basis was a very important part of the crisis management plan.
"Things like communication, team-work and loyalty not only have to do with response to the needs of people after a crisis, or in the midst of a crisis, but they have to do a lot with prevention... The best crisis management is prevention. Who are the people who are going to give you the information that you need? If you've got a crisis that may be brewing, or a product defect that may be in progress, or a possible act of sabotage or disloyalty? Who are those people? Are they loyal? Do they trust the company? Do they trust what would happen if they blew a whistle or communicated? Parts of a good crisis human impact plan involve prevention, which means we're looking at the entire life cycle of a crisis."
The correct treatment of people after a crisis can also help to reduce costs. Dr Braverman used an example of an increase of 500% in workers' compensation premiums for a Manhattan-based company after it lost employees in the World Trade Center attacks.
"If you take a look at this figure ... you know what underlies figures like this. Yes, because of the difference in claims experience ... but you need to look behind the difference in premiums. Think about the absenteeism, the loss in productivity because of people who are sick or utilising health insurance more than they did before. This is the tip of the iceberg. A premium increase is the aftershock of costs that are already in the system."
He added that traumatic stress affected organisations because it affected their people. But, he said, where dangers existed after a crisis (see figure 2), there were also opportunities, such as changing and growing an organisation, enhancing communication, boosting morale, preventing stress-related illness or absenteeism and preventing disability claims and legal action.
"So that's what human impact is," he said. "There is no business recovery or continuity or disaster recovery without people who are healthy enough to return to work. Who want to come back to work and are willing to return to work because they feel safe.
"People will enter a battle zone if they trust their leadership and they feel that sense of loyalty and that sense of teamwork has been reinforced ... and you can actually have an increase in share price. This is about people, in communities it's not about numbers. The numbers are simply a reflection of what's going on with the people."
Table 1: crisis triggers - every company is at risk
Source: Marsh Crisis Consulting
Figure 2: crisis - dangers to employees
Source: Marsh Crisis Consulting
By Dermott White
Dermott White is a journalist on Global Reinsurance.