crisis management - blue moon consulting group · crisis management would, on the face of it, seem...

Crisis ManagementA PROACTIVE & STRATEGIC APPROACH TO MANAGING REPUTATIONAL RISK

2015.

The perceived effectiveness of the

response can have more influence on an organization’s reputation than the underlying event or issue

From United to Uber, BP to VW, Wells Fargo to Experian, the daily headlines are a

constant reminder of the high risk of an ineffective response to significant issues

and crises. And while it’s easy to blame the prevalence of these stories on today’s

24-hour news cycle and highly skeptical, social-media charged environment,

is that really the cause or merely a symptom of something more significant?

Certainly, traditional and social media play a role, but while the blame game is

popular in political discourse when used by corporations it leads to a dangerous,

albeit convenient, reason to ignore what could and should be done to prepare

for and mitigate reputational risk.

It’s important to keep in mind that every headline grabbing crisis that develops

traction—whether product or service related, a leadership scandal, ethical

or financial impropriety, cyber-attack or business disruption—has one thing

in common, a poor response. And more than the underlying event or issue

itself, it is the response that has the single biggest impact on the viability and

reputation of the organization. A poorly conceived, slow, uncoordinated and

insensitive response challenges our assumptions about the ability of a company,

and by default the leadership team, to manage not just the crisis at hand but

the company itself. And only then, when stakeholders begin to ask difficult

questions, does reputational risk suddenly become a very real issue for leaders

as they struggle to maintain their authority to lead and their right to operate.

It should be no surprise then, that skittish boardrooms across the country are

asking the question, “Are we prepared?” But when there is so little understanding

about what crisis management really should be, is it surprising that the answer is

generally misleading and almost always overly optimistic?

In the following, we define what crisis management is (and what it is not);

identify the four critical components of effective crisis management; address

crisis management’s alignment with business continuity, emergency response

and crisis communications; and explore related issues around corporate culture

and decision-making.

2 | BLUE MOON CONSULTING GROUP

Crisis management would, on the face of it, seem a fairly clear term. However, it often gets confused and co-opted. Similar

terms—disaster, emergency, incident—should and actually do mean different things but are often jumbled up, either

consciously or out of laziness.

EMERGENCY RESPONSE ≠ CRISIS MANAGEMENTOne of the most common mistakes is to equate emergency response with crisis management. Emergency response is a

critical component of a company’s approach to protecting its staff and sites. It typically defines general procedures for

evacuation, lock-down, shelter-in-place and employee accountability, as well as procedures for site-specific risks such as

hurricanes, earthquakes or tornados.

BUSINESS RESILIENCY ≠ CRISIS MANAGEMENTA second common mistake is to equate business resiliency with crisis management. A critical component in reducing

operational risk; the resiliency process evaluates potential operational impacts, outlines clear procedures to continue and/

or recovery normal functions as quickly as possible when business is disrupted, and prioritizes investments that increase

redundancy or expedite recovery.

CRISIS COMMUNICATIONS ≠ CRISIS MANAGEMENTA third common mistake is to equate how an organization communicates to its stakeholders, typically with a specific focus

on media, at a time of significant external negative scrutiny with crisis management. While communications certainly is

the “tip of the spear”—a critical, visible and impactful part of crisis management—it should not be mistaken for the whole.

From a crisis management standpoint, equally critical to “what are we going to say?” should be the questions, “why didn’t

we know about this earlier?”, “who is responsible for what?” and, of course, “what are we going to do?”

THE FOUR CRITICAL COMPONENTS TO EFFECTIVE CRISIS MANAGEMENTWithout addressing these questions, you have – to continue the analogy – the equivalent of the “tip” without the “spear”

which will have no momentum, direction or impact. Your organization’s response will not only be lacking, but the risk is

high that the fault for reputational damage will be laid on the doorstep of poor communications when the challenge is

more fundamental.

Crisis management is a senior-level management process that allows an organization to make fast, coordinated, and proactive decisions

that can withstand the credibility test of intense stakeholder scrutiny.

It also provides a defined process that, through its prompt and tangible incorporation of stakeholder concerns into decision-making,

protects the credibility of the management team and the overall reputation of the organization.

A PROACTIVE & STRATEGIC APPROACH TO MANAGING REPUTATIONAL RISK | 3

One of the typical criticisms of crisis response is that the organization reacted too slowly and that the incident wasn’t taken seriously until it became public. This invariably exacerbates reputational risk and can lead to the organization becoming defensive and reactive. But it’s hard, if not impossible, to be proactive on an issue or event if you find out about it too late!

The ability to nip a crisis in the bud is only possible with:

• A Clear Reporting Process & Criteria Defining the what, how, when and to whom issues and events, that have the potential to create significant reputational risk, are identified and reported.

• A Strategic Incident Screening Process Analyzing and assessing information in a broader context. Crises never happen in a vacuum and it is critical that an organization can “connect-the-dots” to proactively anticipate the risks and the response required.

• Defined Parameters for Crisis Team ActivationDetailing when and how different teams across the organization will be engaged such that it is understandable, predictable and repeatable.

Neglecting to put a formal reporting and escalation process in place, assuming “we’ll know it when we see it,” virtually ensures that your organization will be behind the eight ball by the time you become aware of a crisis.

1: “WHY DIDN’T WE KNOW ABOUT THIS EARLIER?”

KEY BENEFITIncorporating Issue/Event Reporting & Escalation into a crisis plan allows an organization to take pre-emptive measures to mitigate the impact of the issue or event, potentially preventing it from becoming a crisis in the first place. It also prevents the following problems:

• Relevant information not being escalated promptly leading to a real or perceived slow response

• Increased confusion resulting from different parts of the organization having completely different information and perspective on the risk

A proactive reporting and escalation process can also demonstrate to stakeholders the seriousness with which the institution takes the issue.

Issue/Event Reporting & Escalation


BUSINESS RESILIENCYReliability and accessibility of products or services are critical customer expectations and fundamental to an organization’s value proposition and ongoing success. As a result, in many organizations, business resiliency programs are a top priority and often a driver of the overall approach to preparedness. Well-known standards, NFPA1600 in the US and ISO22301, internationally provide parameters for these programs and can prove a useful guide for program development.

A solid business resilience approach that includes a continuous improvement cycle of risk assessment, plan development, exercising/training, and plan refinement and which is governed by a clear policy for program maintenance, metrics, accountability is an excellent place to start in terms of preparedness. However, it is imperative that that your business resiliency program be paired with a robust crisis management plan to ensure effective coordination between the incident, emergency, and continuity responses.

Regardless of who “owns” the overall approach to preparedness, what is/was the initial driver, what is already in place, and where the organization starts; where you end up is what matters. An explosion at a site or a protest outside of HQ can be a crisis, a business disruption and an emergency all at the same time! What is critical is that each piece—business resiliency, emergency response and crisis management—are properly defined, properly aligned and actually work together when needed.

As the parable goes, each of the blind men touched a different part of the elephant – one the tail, another the tusk, a third the leg – and each drew completely different and erroneous conclusions about what they had touched – a rope, a pipe, and a tree. The purpose of the incident analysis and screening process is to metaphorically take the blinders off so that the elephant in the room can, in fact, be seen for what it is.

TAKE OFF THE BLINDERS!


Earlier, we defined crisis management as a proactive senior-level management process that allows an organization to make fast, coordinated decisions that can withstand the credibility test of intense external scrutiny. While a Crisis Management Team (CMT) will be responsible for the strategic decision-making, that is obviously not the only thing that needs to happen in a crisis.

COORDINATION AND ALIGNMENT An effective, focused, and coordinated response relies on a defined response structure that provides clarity and alignment in roles and responsibilities for each part of the organization that may be required to respond to an issue or event. Each team will need to understand their unique area of responsibility, how they should coordinate with other teams, and how information should be shared. For smaller organizations, this response structure may be fairly simple but the larger and more complex the organization, the larger and more complex the response. But along the full spectrum, each team—whether a country management team, an issue-specific incident response team, a corporate support team or the crisis management team—should have a distinct and defined role, different from the role of any other team. In addition to the CMT and depending on size, these teams are likely to include:

• A Corporate Support Team to provide support and coordinate with either international operations or specific business units that are facing a significant issue/incident but which is not a corporate crisis

• Business Unit or Country Level Incident Response Teams to manage country- or business unit-level incidents

• Site-specific Emergency Response Teams

• Function or Site-Specific Business Continuity Teams

• A Crisis Communications Team to coordinate communications across all stakeholders (employees, customers, investors, vendors, governmental and regulatory bodies, as well as traditional and social media)

• Corporate Risk-Specific Incident Response Teams, such as a data breach or privacy response team or a product recall team etc.

CMT/CST MEMBERSHIP With the overall response structure understood and defined with clear roles and responsibilities, you are then in a good position to agree to specific team membership. With the CMT, it is critical to start by defining roles rather than selecting individuals. This should not default to an existing group – the Executive Leadership Team or similar construct. Rather, it should be a pre-selected, core team of leaders who have the expertise and authority that is critical for effective response. While this will be different for every organization, core team membership might include General Counsel, Chief Financial Officer, Head of Corporate Communications, Head of Sales/Customer Relationships, Chief Operating Officer, Head of Product etc. In addition to the small core team that is

2: “WHO ELSE IS INVOLVED AND WHO IS DOING WHAT?”

Sample Response Structure


KEY BENEFITDefining the Response Structure & Team Roles in your crisis plan can help alleviate the tremendous stress on your leadership team as well as prevent the following problems:

• Lack of coordination across the organization – the proverbial left hand not knowing what the right hand is doing

• Unnecessary delays caused by selection of an ad hoc team

• Internal confusion over who is responsible for what

• Organizational silos impeding effective response

• Decisions being made prematurely or not at all

• Duplication of effort caused by lack of clear division of labor

When every move is critical and your leadership is under intense scrutiny, the last thing your organization needs is to be perceived as disorganized. Your stakeholders – whether customers, employees, investors or the media – are not going to care about internal org charts and will not tolerate confusion and contradictions. An established response structure and practiced teams ensures that the right people are in the right room and ready to act when the situation requires.

consistently required, additional extended team members will join on an ad hoc basis depending on the specifics of the event or expertise required. These extended team members should also be identified in advance.

For the CST, team membership could include leaders from the following functional areas: Facilities, Physical Security, Procurement, HR, Risk Management, Supply Chain, Customer Service, as well as potentially support from Legal and Communications functions.

For both teams, leadership, authority, core membership, specific functional roles/responsibilities, backup, and extended team membership need to be defined. Members must understand when their team is activated; how information about the full range of negative issues and events is reported and escalated; and how their team is expected to function and coordinate. Most importantly, the CMT must recognize its role is to focus on the strategic impacts and consequences of the issue/event—not replicate the responsibilities of other teams.

Finally, regardless of the size and complexity of the organization, it is important to note, that there should be only ONE Crisis Management Team (CMT). The responsibility for this team is to make significant business decisions, to change or make prompt policy decisions, and to communicate across multiple stakeholders. This team only engages when and if these criteria are met; otherwise, the issue or event can be effectively handled by other pre-defined teams or processes.

Understanding in advance who is responsible for what ensures a fast, cohesive, and effective response.

This is only possible with:

• A Clear Response Structure – identifying the teams that may be activated, their roles and responsibilities

• A Defined CMT – detailing leadership, core members, extended members (who are only required for certain specific issues and events) and back-ups when primary members are unavailable

THREATUNCERTAINTY

URGENCY

CRISIS

WHAT IS A CRISIS?One of the earliest books on crisis management defines a crisis as the following: “a serious threat to the basic structures or the fundamental values and norms of a system, which under time pressure and highly uncertain circumstances necessitates making vital decisions.”1

At BMCG, we define a crisis as an immediate threat to your organization in which events are unfolding rapidly, accurate information is scarce, and the pressure to respond is high. It is the exact moment when strategic decision-making is the most critical. Unfortunately, it is also the moment when you recognize that the very processes you rely on day-to-day are simply not engineered to navigate the treacherous and fast-moving waters of a crisis.1. Coping With Crises: The Management of Disasters, Riots, and Terrorism Uriel Rosenthal, Michael T. Charles, & Paul T. Hart, 1989


Crises are difficult enough to manage without making up the response process as you go along. Getting the team into the “room” (virtual or otherwise) is critical but insufficient. Unfortunately, crisis management plans tend to say little about how the CMT or other teams should function beyond a room location and who should show up!

Too much happens too fast for the management process not to be clarified or for CMT meetings to go on for hours. Chaos is not an acceptable operating model and a defined management process helps effective response. Succinct and focused meetings are only possible with:

• Efficient Time Management – Scheduled meetings, defined agendas and set end times

• An Effective Information Update/Coordination Process – Increasing situational awareness in a consistent fashion, particularly critical if other teams are involved

• Action Tracking and Accountability – Utilizing simple management tools help ensure everyone is clear on priorities, action items, responsibilities and deadlines

• Proactivity – Ensuring a deliberate process to anticipate future risks and identifying strategic issues which will need to be addressed

The goal of crisis management is to manage the crisis, not merely respond. The same level of diligence and clarity that is often defined in how your tactical, site-based emergency response team operates should be applied to how leadership operates too!

3: “WHAT ARE WE GOING TO DO?”

KEY BENEFITHaving a Defined Management Process as part of a crisis plan facilitates focused and efficient team meetings and prevents the following problems:

• Members having an out-of-date understanding of the situation

• Meetings that are too focused on the specifics of the incident, too tactical or operational and don’t anticipate broader, strategic challenges

• Meetings that do not lead to decisions or where there is confusion about whether or not decisions have been made

• Wasted time with meetings that last for hours

ISSUES MANAGEMENTIf crisis management is about managing potentially high impact and/or unexpected events, issues management is about identifying and managing longer term and perhaps slower-moving issues that can have a significant and corrosive impact on the reputation of your organization. While typically in the domain of a communications department, issues management can only be truly effective if it is aligned with the organization’s priorities and proactively incorporated into strategic decision-making.

Issues management takes the same stakeholder-centric approach that is critical to effective crisis management and applies it to day-to-day decisions using the following steps:

Step 1: Issue Identification – Who are your stakeholders? How well do they know your organization? What issues are important to them? Ideally you will identify both issues that could become problematic down the line as well as those that provide strategic opportunity for strengthening stakeholder relationships in the future.

Step 2: Options Analysis & Decision-Making – Prioritize issues based on their threat level (or opportunity), how strongly priority stakeholders feel about the issue and how pervasive the issue is across stakeholder groups. Identify tangible steps to either “protect” against downside risk or “build” on underutilized strengths or opportunities.

Step 3: Stakeholder Engagement – Deepen stakeholder relationship by actively engaging and incorporating their perspectives back into key decision-making.

Through issues identification, options analysis & meaningful stakeholder engagement, issues management can serve as an early-warning indicator and, through strategic changes or more effective communications, can prevent an issue from becoming a crisis.


Explaining in a consistent, credible and compassionate way the organization’s response is not only critical but will be the major determinant in shaping how the company and its leadership will be perceived. The sheer number of stakeholder groups – customers, employees, investors, business partners, community groups, NGO’s, the Board, not to mention the media – coupled with the pressure and time constraints of social media, highlights the importance of having key aspects of effective crisis communications defined well in advance. This is particularly important since “day-to-day” responsibility for communicating with these various stakeholders frequently resides in different parts of the company which may, or may not, coordinate effectively.

Effective crisis communications is only possible with:

• A Clear and Expeditious Approval Process for Key Messaging – Identifying who can/must approve in a fast-moving, fluid situation. Normal approval processes generally will not be sufficient

• Defined Spokesperson – Ensuring that there is clarity regarding the role of the CEO, key business leaders as well as spokespeople and who will be attributed in statements and/or speak to the press

• A Social Media Crisis Policy – Proactively detailing the role social media will play in a crisis

• A Communications “Hold” Policy – Clarifying that CMT activation immediately suspends all communications – even those completely unrelated to the event at hand – unless explicitly approved

• A Defined Coordination Process – Ensuring effective communications coordination, regardless of typical reporting lines, so that stakeholders are receiving consistent messaging and facts

• Pre-Agreed and Approved Messaging For Specific Issues/ Risks – Expediting response at time of event, including holding statements, hard Q&As etc.

More detailed crisis communications addenda (or a separate communications plan) can define individual team members’ roles and responsibilities, press conference logistics, key reporters contact info, media training requirements for identified spokespeople etc.

4: “WHAT ARE WE GOING TO SAY?”

KEY BENEFITEnsuring Crisis Communications is clearly defined as part of a comprehensive crisis plan prevents the following problems:

• Slow or insufficient communications

• Premature communications based on misunder-standing of the situation risks leading to damag-ing retractions

• CMT meetings degenerating to wordsmithing press releases with “happy-to-glad” edits rather than addressing unresolved strategic issues

• Inconsistent messaging or poor timing/sequencing of communications across multiple stakeholder groups (i.e. employees hearing about events from media reports; on-going promotional activities that suggest misplaced priorities etc. exacerbating reputational risk)

• Wasted time with meetings that last for hours

If your crisis plan only defines the functional requirements of communications, it will undermine the critical, strategic role that communications should play in a crisis. Poor crisis response is almost guaranteed when communications is not at the table when decisions are being made, leaving them in the unenviable position of having to “explain” potentially poor decisions that will not withstand stakeholder scrutiny. Which brings up the final point…

A press release can’t save an organization—

only action can.


Crisis management is about having the right organizational mindset that actively incorporates reputational risk into the decision-making process. Reputation must be viewed as a critical input into decision-making, not just an output, a by-product of decisions already made. Reputational risk is created when there is a significant disconnect between what the organization does and what its stakeholders expect. A premium must be placed, therefore, on understanding the perspective, the expectations, and needs of the range of stakeholders who are impacted by your company’s decision.

Developing a crisis plan with the four components discussed:

• Helps ensure that you learn about events sufficiently early to be proactive

• Removes internal silos and barriers to coordinated and effective response

• Defines not only who needs to be involved in decision-making but how that will be implemented throughout the organization

• Gives communications a fighting chance – the opportunity to help inform strategic decision-making and develop a credible message and communications strategy to reduce the reputational damage the underlying event or issue could cause.

The approach outlined must be aligned with any existing business continuity, emergency response and risk-specific processes and plans. It is simply more robust and holistic and recognizes the importance of having a defined and consistent process to manage the full range of issues and events – beyond physical disruption – that potentially threaten the reputation of an organization.

This broader approach to crisis management, particularly when supported by a solid risk management program and aligned with a proactive approach to issues management, will protect your organization both in advance of and during a crisis.

CRISIS MANAGEMENT IS ABOUT MORE THAN A PLAN

WHAT IS REPUTATIONAL RISK?

An organization’s reputation is the collective beliefs that your multiple stakeholders have about your services, values, and management capability. Reputational risk occurs when there is a significant gap or disconnect between stakeholder expectations and your organization’s decision-making resulting in potential long-term and sometimes unrecoverable damage. Reputational risk is highest during a crisis event,but slow-evolving, unaddressed issues can be as corrosive over time as any crisis.

Unfortunately, reputation is typically viewed as a by-product of all the other things an institution does. We believe, however, reputation and reputational risk should be a critical input into strategy and decision-making, not simply an output.

PROACTIVE REPUTATIONAL RISK MANAGEMENT

Built on a solid risk management program, Reputational Risk Management is a framework and process that identifies strategic opportunities as well as risks, effectively manages crises or significant issues when they do arise, and creates the reservoir of goodwill among the multiple stakeholders your organization requires to thrive.

"It takes 20 years to build a reputation, and five minutes to ruin it.

If you think about that, you’ll do things differently.”

Warren BuffettIndependent (London)

October 28, 2009



At Blue Moon Consulting Group, we understand the challenges you face and we are committed to helping you build innovative, sophisticated, and practiced crisis management, business resilience, and emergency response programs to protect your hard-earned reputation. Every member of our team has had first-hand experience, in the trenches, in the midst of crises and significant business disruptions. We know what works, what doesn’t, and how to prevent needlessly making a situation worse. We take these hard-learned lessons and use them to help our clients:• Effectively manage real-time response to significant issues and crisis events• Mitigate issues and avoid crises altogether through the development of a proactive strategy including capabilities

assessments; crisis, continuity, emergency response and issues management plans; exercises and leadership training

THOUGHT LEADERSHIP

WE APPROACH THINGS DIFFERENTLY When you partner with BMCG, you will quickly discover that we are not like other consultancies. Our approach, methodology, and services reflect our belief that in today’s economy an organization’s reputation is its most valuable and fragile, intangible asset. As a boutique firm focused on reputational risk, we believe we are uniquely positioned to offer a better service model than large, generalized consulting firms. Our goal, in fact our singular purpose is to help you build an organizational culture in which reputation is viewed as a key asset and fundamental strategic input into decision-making.

Simon Barker, Managing Partner Holding senior roles at Edelman, Visa and Marsh, Simon provided crisis management counsel in response to protests, cyber attacks, product failures, workplace violence, natural disasters and a broad range of ethical, financial and social issues. Bob Wilkerson, Senior Advisor, Crisis Management As Director of Public Safety for the State of Florida and for FEMA, Bob led response efforts for major natural disasters, civil disorders and infrastructure disruptions. Over time, he created many of the principals and practices that have become core to emergency response, continuity and crisis management today.Lynn Tierney, Senior Advisor, Crisis LeadershipServing as Deputy Commissioner in the FDNY, Lynn was a member of the top management team that Mayor Rudy Giuliani assembled after 9/11. As former Head of Communications for the FAA as well as the University of California system, she is one of the most experienced crisis communicators in the country. Mary Oakie, CBCP, Business Resiliency Practice LeaderAs Director of Business Continuity and Crisis Management, Mary led Ally Financial’s preparation and response to Hurricane Sandy, active shooter threats, data compromises, and multiple site and process-specific business continuity risks.

• We truly are client-focused – in fact, we each left far larger organizations specifically to go back to what we do best and most enjoy – working side-by-side with our clients.

• We are value-driven – our partnership and overall business model is designed to keep costs low. • Our team is your team – the team you meet is the same one that will do the work. We are committed to full and

meaningful, long-term partnerships. • We take what we do very seriously – but, we also believe a little levity can build great relationships and help us all

manage the magnitude of some of the issues and events to which we must respond.

OUR COMMITMENT

Each member of our senior leadership team brings on average over thirty years of crisis management, crisis communications, business resiliency and emergency management experience. We’re not just "book-smart" consultants. We’ve all worked on the “front lines” and, as crisis management and business continuity practitioners, have direct experience with significant disruptions and crises.

PRACTICAL KNOW-HOW

Core to our approach is our Reputational Risk Management Framework—a rigorous, comprehensive methodology that views reputational risk as a key driver of business strategy, risk management, and preparedness. This approach is evident in everything we do – in fact, we believe that a strategic, holistic approach and a culture that values reputation is the only way an organization can maintain an authority to lead, a right to operate, and an expectation of success over the long term.

OUR SENIOR LEADERSHIP TEAM

ABOUT BLUE MOON CONSULTING GROUP

Optimism is NOT a Strategy™

[email protected]

O: 415.316.0075

mailto:info%40bluemoonconsultinggroup.com?subject=

crisis management - blue moon consulting group · crisis management would, on the face of it, seem...

Documents