The range of potential issues and crises that face the modern organization can seem impossibly daunting when taken as a whole.  This can lead management to decide, explicitly or implicitly, that there are simply too many potential threats to effectively prepare for, and thus they end up preparing for none.

While it is true there are a vast number of potential crises threatening any given organization, not all of them have the same probabilities for all organization types.  Further, organizations themselves are not uniform in terms of risk exposure, reputational capital, executive experience and a host of other factors that determine their overall risk profile.

It is thus important for the relevant management actors to review the range of potential issues and crises based on the company’s own risk profile and environmental situation.  The most effective way to do this is to segment these potential threats into logical categories.  This also helps make it easier to divide up the review process among team members as well as make the whole task much more ‘doable’.

One approach to categorization of issue and crisis sources is to look at internal sources, external sources and overlapping sources.

Internal Sources

Some issues and crises are directly attributable to factors or actions within the organization.  Because they are within the organization’s control, mitigation should be easier than would be the case for external sources.  When a crisis is traced to an internal source the organization is often subject to harsher treatment because stakeholders feel that it was clearly within the organization’s power to prevent it.  A good example of this is the recent Volkswagen emissions cheating crisis.  There is no way the organization can blame some external factor for the crisis, it was 100% within the company.

Internal sub-categories include:

• People – the actions of management and/or staff
• Culture – the nature of the organization’s corporate culture (e.g. the hyper competitive cultures found in many large financial institutions prior to the 2008 sub-prime crisis)
• Product/Service – the specific items produced by the organization or the services it provides
• Process – the processes / ways of work within the organization
• Operations – the sourcing, manufacturing, distribution systems employed by the organization
• Financial – the organization’s financial systems and/or status

External Sources

The potential sources of issues and crisis found outside of the organization such as the political, economic, cultural and demographic environments in which the organization operates.  These tend to be macro risks that can manifest themselves as a crisis for the organization depending on its relationship with its external stakeholders.

External sub-categories include:

• Regulatory – the nature of the regulatory environment in which the organization operates
• Legal – the legal system(s) and potential for hostile litigation that the organization is exposed to
• Environmental – the potential impact the organization has on the natural environment and the level public awareness regarding environmental protection
• Market – the market(s) in which the organization operates including stability of demand, competitive systems, and overall health of the economy
• Societal – cultural, religious, national, ethnic and demographic factors that can impact the organization’s relationship with its stakeholders

Overlapping Sources

Increasingly organizations are exposed to sources of risk that span the internal and external categories.  This is especially true for larger organizations that offer a range of products or services and use an array of suppliers and service providers.

Overlapping sub-categories include:

• Supply-chain – increasingly, major corporations and brands are being held responsible for the actions of organizations throughout their supply chain, even if these organization have no formal/legal relationship beyond the selling and buying of goods or services
• Organized labor – the potential impact of local, national and international labor organizations and/or organizations advocating for the rights of labor on an organization – in terms of its relationship with its own employees as well as its overall reputation

The above segmentations should be considered as a potential starting point and certainly not a comprehensive listing.  Further, each organization will need to review the various sub-categories to see if they are relevant and then to determine the probability that they will be the source of an issue or crisis.  The crisis management team must be brutally honest with themselves in this process.  For example, an organization that is highly leveraged or utilizes complex derivative instruments, probably has a greater financial risk exposure than a more conservative company – regardless of how smart or successful management is.

By breaking down the potential sources of issues and crisis and then reviewing them in light of the organization’s own unique situation the crisis management team can begin to define an overall picture of the risk environment.  With this information, management can make more informed decisions regarding the allocation of resources to be tasked for risk mitigation.

Top 5 Takeaways:

• Issues and crises can emerge from a wide range of sources.
• Organization management needs to assess where they are most at risk regarding potential crises
• The most effective method of undertaking the risk assessment is to disaggregate the potential sources of issues and crises
• A useful way to break down the potential sources is to look at internal, external and overlapping sources
• When conducting the assessment the crisis team needs to be very honest with themselves about where their organization faces significant risks

When an organization has to deal with a crisis, the situation almost always feels like a bolt from the blue experience.  One minute things are going along as per normal, and the next all hell breaks loose – sort of like Pearl Harbor on the morning of December 7, 1941 or the Tet holiday in January 1968.

While this reaction my appear normal, the fact of the matter is the organization facing the crisis should not feel quite so blindsided, as there are almost always advance warnings for those who choose to see them.  With the benefit of hindsight organizations are able to recognize the warning signs that precede most crises.  These organizations also take steps to address the factors that led to the crisis, which while necessary, is a bit like closing the stable door after the horse has bolted.

Organizations that take crisis preparation seriously focus on the issues and threats that come before the crisis, as well as the preparations for the crisis itself.

For most types of crisis there is a clear pattern of increasing danger to the organization, which can be characterized as a progression from issues to threats to crisis.

Issues are relatively long-term trends that have the potential to harm the organization at the some point in the indeterminate future.  Issues may be well publicized, but they are often not immediately linked to a specific organization.  As they became better understood and their causes and/or ramifications more widely recognized, they become associated with organizations and at this point they transition to become threats.

Some examples of issues that have made the jump to threats include:

• Growing evidence of the negative health ramifications of using tobacco products
• The steady increase in childhood obesity and related non-communicable diseases
• Concerns over labor practices in Southeast Asian apparel manufacturing operations

Threats are clearly associated with an organization and should be factored into its crisis planning process.  Unfortunately, the most dangerous threats are those that are unrecognized.  For example the increasing power and unity of OPEC was a clear threat to the US economy in the early 1970’s but this was largely unrecognized until the oil embargo of 1973.  The increased quality and decreased cost of digital photography equipment posed an existential threat to traditional film manufacturers (and related industries) that remained largely unrecognized until it was too late.

For a threat to become a crisis it only requires a trigger or catalyst.  This could be any one of a thousand events such as a consumer complaint, a negative media story, a new piece of legislation, an accident on the shop floor or an O-ring failure.  The organizations that have taken the time to study the issues and threats relevant to their particular situation will obviously still face a crisis, but they will be infinitely better prepared to deal with it than those who truly feel that it has fallen on them in a deus ex machine fashion.

Of course, it is easy to say the organization should keep watch on both near and far horizons for issues and threats that may, one day, become a crisis, but there are significant challenges to acting on this advice.  Some thoughts on how to go about environmental scanning will be covered in the next post.

As I have noted previously, the crisis communications plan is the primary physical output of the crisis planning process.  While the specifics of the plan are determined by the nature of the organization, its industry or activity, its history, and its current environment, there is a basic structure that most plans adhere to.

The purpose of the plan is to improve the organization’s performance in dealing with an actual crisis through the creation of pre-approved materials and standard operating procedures (SOP) that can be acted on without discussion or debate.  The key to success in a crisis situation today is largely based on the speed with which the organization can respond and the coherence and efficacy of that response.  A well-structured and up-to-date plan should be able to significantly reduce response time and mitigate the risk of stress induced error on the part of the crisis communications team.  The logic of having SOPs and detailed plans has long informed military, police and other emergency service organizations.

The components of the plan will be briefly introduced below and presented in greater detail in later posts.

The Standard Components of the Crisis Communications Plan

I Introduction – A statement by senior management that reminds the readers of the organization’s mission and/or vision and reiterates the importance of the organization’s reputation.  This is often linked to a statement that crisis preparedness and response is the responsibility of every member of the organization and especially those who have been provided with the crisis communications plan.

II Instructions – A set of instructions on how to use the crisis communication plan document including a review of the logic of the document’s organization.  There is often a quick reference guide to the key elements of the plan.

III Risk Assessment – An overview of the primary types of risk facing the organization, their relative likelihood, and the mitigation steps that have been taken to address these risks.  This section should be periodically updated as the organization’s risk environment is subject to change due to a range of both internal and external factors.

IV Contact Lists – Detailed contact information, with annotation regarding previous engagements, with various stakeholders that could be relevant during a crisis situation.  These lists might include:

• The organization’s crisis team
• Other senior management
• Employee and/or union representatives
• Local police contacts
• Other emergency services
• Local regulatory contacts
• Major trade organizations
• Key media outlets (general)
• Friendly journalists/editors

V Checklists – Pre-determined checklists of immediate actions to be taken in the event of various crises.  These should include priority notifications to both internal and external stakeholders and specific information to be gathered as soon as the crisis situation is recognized.

VI Step-by-Step Procedures – A series of guides that carefully and thoroughly explain how to accomplish specific crisis communications tasks.  These should be designed at a level of detail that would allow an employee who is not a regular part of the crisis communications team to function effectively.  Examples of procedures include:

• Process for establishing the crisis communications center
• Informing and rallying the crisis communications team
• Securing approval for the initial crisis holding statement
• Issuing a press release regarding the crisis

VII Templates of Key Communications Materials – A set of ‘fill in the blank’ templates of the standard internal and external communications documents necessary for the immediate handling of a crisis situation.  These documents can be completed using the information gathered as a result of following the relevant checklist referenced in section V above.  Some of the standard communications documents include:

• Initial holding statement
• Initial media statement for company spokesperson
• Initial press release
• Q&A (for both internal and external stakeholders)

VIII Forms and Logs – A set of standard forms and log sheets to capture information that will be required for the effective handling of the crisis, reporting to internal and external stakeholders regarding actions taken during the crisis, and conducting the crisis post-mortem.  Examples of forms and logs include:

• Media call and response log
• Witness information form (for use with employees)
• Meeting notes forms
• Materials distribution log (for use with both internal and external stakeholders)

IX Background Information – A collection of materials related to the organization, its history, its products/services, management and social responsibility programs among other things.  This material can be used to facilitate the fast and accurate creation of crisis communications materials as well as be used to brief spokespeople prior to media engagements.

X Crisis Communications Center Information – Details on the specific resources that the crisis communications team can access during a crisis situation.  This would include the rooms available for their use, computers, supplies, transportation, and administrative support.  It may also include access to corporate social media accounts and websites.

XI Post-Crisis Report Format – A template report to be prepared immediately after the crisis situation has been resolved.  This template includes sections for actions taken, results and key learnings and a section on recommendations for improvement to be shared with senior management.

The crisis plan is perhaps the second most important thing a company can do to prepare for the inevitable crisis that will befall it.  This document, often a large binder of material, has taken on almost talismanic power among corporate communications staffs in major organizations around the world.  It is as if simply possessing the plan can somehow ward off a crisis.

These documents are often prepared at considerable effort and expense, after which they are distributed to key staff (the members of the crisis management team) in facilities around the world.  Sadly, after this is done, they tend to sit on a shelf gathering dust and growing increasingly irrelevant unless an organization implements mandatory crisis training on a regular basis.

The above notwithstanding, the crisis plan is important and can be critical in the effective handling of a real crisis, but it is not the most important thing a company can do.  The key is not the plan, it is the planning.  A plan, no matter how well thought out, is a reflection of a particular environment and specific circumstances.  These will inevitably change.  The planning effort involves the acquisition of skills and the ongoing assessment of situational risks that will continue to serve the organization well into the future.

“In preparing for battle I have always found that plans are useless, but planning is indispensable.”  Dwight D. Eisenhower

Thus, elements of the planning process should be an ongoing exercise in the background of day-by-day operations, while the ‘plan’ itself provides a highly flexible framework for crisis management.

The ongoing elements of crisis planning should include periodic SWOT analyses at the operational and corporate level, annual reviews of crisis scenarios and refreshed risk assessments, continual monitoring of media and other information sources to determine if there are new issues that need to be incorporated into the strategic crisis model.

The product of these efforts can then be incorporated into the crisis plan and/or a revised set of crisis scenarios.

This is clearly a big ask for organizations at a time when resources are limited.  It is also nowhere near as satisfying as creating a crisis plan document, which has heft and can be shown off to senior management and most importantly represents a project that has a defined end-point.  But, like a new car this type of crisis plan starts to lose its value as soon as it is distributed to its end users.  On the other hand, with the combination of a flexible plan with an ongoing planning regime the organization can reap important benefits.

The answer to the obvious question of what are the benefits of taking an ongoing approach to crisis planning is more complex than it might seem at first glance.  By actively engaging in crisis planning an organization instills a sense of importance in risk assessment.  This in turn informs the organization of the importance of compliance with its own code of conduct as well as with all regulatory requirements.  This is because compliance is the first line of defense in crisis preparation and one of the most important messages in the crisis communications repertoire.

Beyond crisis planning’s creation of a compliance culture, the staff involved become highly attuned to the organization’s environment and while they are scanning this environment for risks they can also find opportunities.

Ongoing planning also creates a core cadre for the crisis management team who are intimately familiar with the crisis plan and crisis communications methodology and thus will be far more confident and competent in there actual use than would be the case if they were only exposed to them during an annual training exercise or simply when they were on-boarded into the organization.

Thus, crisis planning generates the skills, knowledge and confidence to effectively handle the crisis communications role.  The crisis plan provides the communications tools and framework to guide the execution of the crisis communications exercise.  Together they create a system that can see an organization through a range of dangerous situations with a minimum of damage or disruption.