Contingency Planning Methodology
V. Crisis Management Planning Process
A. Assess Crisis Management Team plans to see if they can be adapted to accommodate risks.
Similar to a Corporate Disaster Management organization, these are facility or regional based teams that are organized, trained, at the ready to respond to or oversee any related adverse happening or emergency. This is really intended to cover an area of vulnerability that was not anticipated or could not reasonably be identified. In other words this is a contingency plan to be prepared for the unexpected. In part, existing facility emergency response plans and personnel will cover much of what is needed.
However there will likely be special or additional resources needed for standby and emergency response to types of failures. These would include controls, computers, electrical supply, etc. The need, number, and location of these Response Organizations will, in most cases, need to be determined by the Business Leader, facility or Contingency Planning Task Force. To provide sufficient coverage particularly for regions, we may have to rely upon outside resources, such as IT specialists. There will likely be a high demand for these resources so we should make this determination quickly.
One such team being created by the Contingency Planning Task force is the:
Corporate Crisis Management Team
This is an Executive level Crisis Management Team that will be on standby. The Team will generally follow the standard Incident Command Format with members named and trained. This Crisis Management Team will be called into action as decided by Regional or Division based organizations, or as determined appropriate by Contingency Planning Task Force Members involved in the incident. This is a judgement call with regard to if the particular issue is a potential "crisis" situation. The Task Force will have responsibility for forming the Crisis Management Team.
Earlier in the Preparation section of this workbook you were asked to determine if your business unit has any existing Emergency Response Teams. Now is the time to review whether any of those teams can be integrated into your contingency planning efforts.
Deliverables: None:
B. Propose, prioritize, and obtain approval for each new Crisis Management Team.
The Business Leader is ultimately responsible for the business unit including insuring that it can respond to unexpected circumstances. This means that they will be responsible for approving all Crisis Management Teams and the tasks involved in building any new teams. Meet with the Business Leader to review your proposal for new Crisis Management Teams and any changes to existing response teams. Document BOTH the Crisis Management Teams to be created as well as those that you will not pursue any farther. Clearly document the rational behind not pursuing a proposed Crisis Management team.
How to record:
MS Word:
Document your teams in a Word document or project management tool as required. Be sure to
include enough information about the teams to identify:
- Who's involved,
- Who will manage/direct the team,
- How will the team be called into action,
- How will the team communicate with each other and the necessary Business Leaders, and
- The teams responsibilities and authorities.
Deliverables:
A proposal that lists the accepted and rejected Crisis Management Teams for all
business functions.
C. Build, organize and document new Crisis Management Teams.
Basically, a Crisis Management team is addressing most things that a contingency plan addresses. This means that you need to reconsider almost everything in light of reacting to unexpected problems during a crisis versus having time to plan for problems. Pay special attention to the Management and Communication procedures because they must be clearly defined and able to work on an immediate basis under unanticipated circumstances, i.e. chaos.
The list of questions below helps define the needs and operations for each proposed Crisis Management team. Keep in mind that your contingency plans contain many of the answers to these questions.
1. How will management deal with the consequences of an unanticipated failure including:
- Plant operations halted?
- Environmental or safety system having been compromised?
- Erroneous transactions sent to a customer, supplier, or the government agency?
- Claims of having corrupted a third party's data via an electronic interface?
2. When is a problem bad enough to pull an operation or process off-line?
- If a screen displays erroneous results, should the operation be considered at risk?
- How can one quickly determine the difference between a superficial problem and a more
serious problem?
- When should an electronic interface be shut down?
3. How will remote problems be handled for distributed processes, systems and end-users that are located at various facilities and subsidiaries?
4. How will we handle incoming calls about problems with IT supported applications from a large number of end-users, all of which expect immediate responses?
5. How will system software and hardware failures, unexpected licenses expirations, and other unforeseen operational problems be handled?
6. How will telecommunications and network failures in the IT environment, across business units, and at remotes sites be handled?
7. How will calls from non-IT sites that are experiencing system failures in applications that were never included in the inventory be handled?
8. How will routine calls to help end-users with desktop systems that were either not compliant or are interpreting dates differently than expected be handled?
9. How will embedded system problems at plants, in facility systems, at corporate and at other remote sites be handled?
10. How will incoming calls from customers that are directly impacted by application system failures be handled?
11. How will calls from government regulators that discover irregularities in information that they have received be handled?
12. How will delays in receiving government provided services be handled?
13. How will business partner failures be handled?
14. How will major problems with the local or national economy be handled?
15. How will delays in obtaining employee payroll, health care services or insurance be handled?
16. How will local catastrophes (nuclear plant problems, etc.) be handled?
How to record:
MS Word:
For each Crisis Management Team mentioned in your proposal, expand the
documentation to cover the necessary items shown above.
Forms: Not used.
Database: Reference only.
Update your contingency planning project plan(s) to include a task to build and document each approved Management Team. Be sure to assign who will be responsible for each task (Crisis Management Team).
Deliverables:
A list of accepted and rejected Crisis Management Teams for all business
functions. An updated contingency planning project plan that includes the tasks required
to build, document, and manage your approved Crisis Management Teams.
D. Communicate existing and new escalation procedures to proper business unit leaders, managers and teams.
This task emphasizes the need to announce how the Crisis Management Teams will operate when responding to unexpected events. Not knowing who can make critical decisions and how to get in contact with proper authorities can cause a Crisis Management team to become far less effective. Make sure your communication channels and decision-making procedures are clearly defined and communicated to all the proper Business Leaders, manager and team members.
Deliverables:
A memo or other publication outlining the communication channels and decision-making
procedures being received by the proper Business Leaders, manager and team members.