When Disaster Strikes – Keeping the C-Levels Busy During a Crisis

Posted by admin at 2:44 pm 5490 Comment2011-09-15+14%3A44%3A26admin Print

Here are nine basic functional areas to manage the environment of your crisis.

By Kenneth Schroeder, CBCP

Ok, you’ve got your business continuity plan in place and you’ve exercised it, so you’re confident it will work just fine. Everyone’s signed off on it, and even your examiners have not torn it apart during their last visit. (They never praise anything, right?)

You’re feeling confident.

Disaster strikes. Of course, Murphy’s Law comes into effect, striking at the worst opportune time, and the disaster isn’t anything you listed in your risk assessment or your plan. A lightning bolt from the blue, a sewer backup that floods your building, a drunk driver plows his pickup through your lobby. It doesn’t matter what it is. It’s happened. It’s a real disaster. It’s time to implement.

If you are a C-Level type, you can quit reading now.

You’re still reading, aren’t you! What follows is advice to the movers, shakers, and do-ers in your credit union. Not you! These instructions are to help them to clear the way so they can implement their recovery procedures. It tells them how to occupy you C-Level types so they can get the real work done. So stop reading already!

OK, movers, shakers, and do-ers, are you ready? In order to begin executing your recovery procedures, it is really important that you manage the environment of the crisis. You have some key issues to understand: what happened, what you need to do to make the environment safe for your staff, what parts of the plan have to be activated, what outside agencies are involved in your incident, what to tell your staff and members about the incident, what actions to take to manage the media who’ll be coming out of the woodwork, what people might be affected, and what of the many other facets of the incident that have absolutely nothing to do with any recovery procedures documented in your plan.

This is called incident management. The incident management activities complement, but do not replace the activities of the three other plans that form your arsenal for combating a disaster—the business continuity plan (BCP), the disaster recovery plan (DRP), and the crisis communications plan (CCP).

Yes, your credit union needs its own Incident Management Plan (IMP). It really doesn’t matter to me if it is written under separate cover, or if you use your business continuity plan to act as the master, and include the IMP as a subsection. Normally, for a business the size of most credit unions, the organization I prefer is the BCP as the master plan, with the IMP, DRP, and CCP as subsets. (I also include the pandemic plan as a subset as well.) In the end, it really is just a matter of preference. The important thing to know is that the activities of each plan do different things, and in the chaos of a crisis it is vital that all the necessary activities receive their proper attention.

C Level Executive OK, C-Level, I know you’re still reading. It’s the micromanager in you that won’t let you do anything else. Don’t get offended at what comes next.

Have you ever noticed that when a disaster strikes, the C-Levels want to get right in and start fixing things? Basically, it’s the micro-manager in them that comes out. They can’t help it. It’s their irresistible urge to be in charge. Often, they’ve been too busy to really understand what’s in your BCP anyway. They’ll sit at the table and ask, “What do we do now?” But I digress.

Back to our IMP. Most business continuity plans refer to a “Command Team,” “Crisis Response Team” or a “Management Team,” but really don’t do a good job describing what they do. Most plans spend pages listing generic responsibilities, but drop the ball after that. As a result, during an exercise, their activities are usually simulated, because the C-Levels who make up these teams usually just get in the way or don’t have the time for the exercise.

How about giving them something really useful to do? How about getting them out of your hair? How about keeping them occupied, but at the same time letting them not only feel like they’re really contributing, but actually contributing?

It’s really easy to do, and in fact, I strongly recommend it. What you need to do is ensure that you implement the Incident Command System (ICS). ICS is a methodology that lets you control the environment of your crisis. It is nine basic functions that must be handled to ensure you have a safe environment for your staff to implement their recovery procedures. ICS is a standardized organization of activities that stem from the National Fire Protection Association in a document titled NFPA 1600. This was adopted by all national, state, and local emergency managers under the direction of FEMA. The same standards should apply to your emergency management team, whatever you’ve named them. For the sake of argument, let’s say you call them the Incident Response Team, or IRT for short.

You want your IRT to address these nine functional areas of ICS:

Command. Who’s in charge of the incident? There should never be any doubt. The commander is responsible for all decisions relating to the crisis. For larger organizations, this may not be the CEO, but for your credit union, it should be. For the Deepwater Horizon it was Thad Allen. For New Orleans Katrina, it was Lt. Gen Russel Honoré.
Safety. This is the absolute top priority of any organization, especially during a crisis where people can easily get injured trying to do things outside their comfort zone when they’re at the point of exhaustion. Appoint someone as safety officer for the IRT. This person can call “STOP” whenever the need arises to prevent injury or death.
Communications. The communications officer is responsible for implementing the CCP. There isn’t enough room here to detail what your CCP should do. Suffice it to say it needs to address three critical targets: getting information to and from internal staff, communicating to external stakeholders (your members), and managing the media. The details of that plan are the subject of a future article.
Liaison. The point person for dealing with the local emergency management organizations. This is the most often overlooked person, but one of the most critical. If the fire department, bomb squad, hazmat team, or SWAT team shows up at your building responding to an incident, you don’t own your building until they release it back to you. Most CEO‘s don’t understand that concept. (I told you C-Level types you wouldn’t like what you’ll see!)
Intelligence. This function is often not assigned to any one person, but represents a collection of information about the incident you are experiencing. What happened? How will it affect us? When’s the next shoe going to drop? This recognizes that you don’t control the incident. Rather, it controls you, and you have to gather as much information about it you can in order to plot your course of actions (see “Operations” and “Planning” below.)
Finance/Admin/HR. These can be separated, but many organizations lump them together. Who pays for the incident? Who is the historian? Who publishes critical documents? Who takes care of staff? Who provides cash advances to deploying staff? Who arranges travel & lodging? These functions are often critical to any successful recovery, and there should be someone in charge of them.
Logistics. This function is responsible for getting whatever needs gotten to support the IRT, and to support the recovery teams. This activity can be monumental. Stand ready to get the person responsible some help. Be ready for rounding up things like Post-It Notes, toilet paper, desks, chairs, water, meals, office space, cots, pencils. Imagine resupplying an office from scratch, which is what you may be doing in a crisis.
Operations. OK, what assignments are we going to make? Here’s the part where we actually reach into and implement our business continuity and disaster recovery plans. The daily operations tasking from the IRT should direct the specific activities to the recovery teams. This is especially critical for a long-term event (think about the Deepwater Horizon incident.)
Planning. “Wait a minute!” you say. “We already have a plan.” True.This planning function is where you take what you’ve already published in your business continuity plan, and make modifications based on the facts at the incident site. You may salvage equipment instead of purchasing new. You may delay implementation because logistics may need time to secure workspace. Planning is what forms the basis for the daily operations tasking in the “Operations” paragraph.

That’s it. Nine basic functional areas to manage the environment of your crisis. The figure below shows a “standard” ICS organization to give you a feel of the textbook organization You can organize yours any way you want. You can have one person cover several of the functional areas. You can have an IRT of three people if you want. The organization is flexible, scalable, and highly functional. It uses a common terminology with the public emergency management organizations. But make no mistake! No matter how you organize it or what you call it, during a crisis, you have to cover all nine of these areas.

Fig 1-Typical ICS Organization

Oh yes, now that you have some organization to your IRT and documented their activities in your Incident Management Plan, you have to exercise them as well (a tabletop is a great place to start.) That lets them instill confidence in themselves, identify improvements in their checklists, and improve their confidence in you.

As I promised, here’s a way to get your C-Levels out of your way during a crisis. Here’s how you keep them busy, make them productive, and let them feel like they’re in charge. In fact, they are. They provide the safe environment for you to do your recovery. That said, you have to give them the confidence that you and your recovery teams will do your jobs without their interference. That’s why you exercise!

If they do their jobs, your recovery is a lot easier. You’ll be back in business faster, with a lot less confusion.

After all, that’s what your business continuity plan is all about. Right?

Right, C-Level types? I know you read the whole thing, despite my warnings!