Many organizations  have more than one crisis management team. Just as governments have federal, state/provincial and municipal response organizations, large corporations also require a tiered response capability. One of the common errors seen when analyzing a crisis response (or conducting practical training for one) is a "muddling" of the roles and responsibilities between these various levels. Typically, the superior level crisis management organization takes charge of the activities that should clearly be a local responsibility, while neglecting the key strategic problems that need to be addressed at the higher level.

This "characteristic" of crisis response within large organizations is also not handled well by many exercise designers. All too often, a corporate organization is defined and resources are allocated for a corporate level exercise which simulates physical damage at the corporate level headquarters requiring re-deployment of the corporate team to a backup facility. This is valuable training of course, however it does not present a crisis that requires a corporate level response - it is a facility level crisis that happens to be where the corporate HQ is located.

Consider the example of a corporate crisis management team in a large national company in the fast food services sector dealing with a natural gas explosion at one of its major distribution centres. The corporate role in this situation would be dealing with corporate wide implications of this loss: the ability to fill existing orders, support for injured employees and families, communications strategies to the public etc. But instead, the team debates for thirty minutes (during the initial stage of the event which is most crucial in terms of crisis response) on where specifically to station company security personnel around the perimeter of the casualty property! In most functional organizations, this would be a facility level problem - and solution.

This lack of separation between levels of command and control within organizations is a natural tendency for several reasons. Many within the corporate group will have come up through the ranks of the company from the facility level. So the problems at a facility (or single location) will be much more familiar to them. Under stress, it is common for responders to concentrate on what they know best. Instead of dealing with unfamiliar issues, there is a tendency to revert back to what they are most comfortable with; notwithstanding the stated roles and responsibilities at the superior level.

Secondly, the role at the superior level is inherently more difficult. At the scene of the disaster, the challenges can be dangerous (saving lives, evacuations etc) but they are usually specific and clear; normally executing emergency operating procedures (which should be pre-defined in most cases) and dealing with immediate problems. The strategic challenges at a superior level are more difficult to define. It will most often mean a longer look ahead and a responsibility to predict what the future effects will be and how to handle them.

In the immediate term, the superior team has to figure out how to provide appropriate support to the subordinate team but at the same time stay out of the way so the other level organizations can fulfill their responsibilities. In all but well trained and experienced teams, the tendency will be to unnecessarily get into the weeds and consequently cause an adverse effect on the organization's overall response effort. The superior level has to concentrate on seeing "the whole forest" and not let their view be obstructed by "individual trees".

The best way to ensure this does not become a damaging flaw in an organization's crisis response is:

• to define and publish clear and concise roles for each level of response,
• to train to this standard, and
• to rigidly enforce these standards during an exercise or a real event.

The superior level role will be one of support and leadership. In the support role, the superior team will normally be responsible for mobilizing whatever resource is required and getting it to the scene of the event, so that the subordinate crisis response team can do its job and directly respond. The superior team will also have authority to allocate resources required to deal with the event which exceed the expenditure limits of the local level. Most superior teams understand these types of responsibilities. Where they run into problems is in staying focused on the overall organizational issues that need to be addressed during crisis.

The Crisis Management Team Leader at each level must be aware of this phenomenon and keep his team focused on the problems that need to be sorted out by that particular level of command. In addition to observing the clear roles defined in the crisis management plan, the Team Leader should also compare the ongoing activity to that conducted by the normal line operation of the organization at that level.

Remember, a crisis management team is simply a group of key decision makers who are brought together to be served the best information available so they can develop good situational awareness and provide effective decision-making. The requirement is for rapid decision making in situations that require immediate action and deployment of resources. But the level of decision-making should be much the same as in normal business operations. If it is not a corporate responsibility to check if a facility shut off its ventilation system in the day to day organization, it should not be a corporate responsibility to order this in the event of a fire or hazmat spill - that would remain a local issue. The corporate issues would be more appropriately focused on public relations, measures to protect employees etc - policy issues that would be a corporate responsibility day-to-day. While not always a perfect fit, it is a good check to ensure the teams focus is at the appropriate level.

The other "trick" the Team Leader has at his or her disposal, is ruthless control of the communication lines. In an ICS  based organization, these lines are very clearly defined and senior personnel within the team cannot simply call whoever they wish at a lower level to demand information. A clear reporting structure must be implemented and the various types of communication and connections between levels must be followed. In doing so, it will be easier for the Team Leader to keep all his Team Members focused on their responsibilities. The alternative; bypassing the reporting chain; adversely affects the information management system you are trying so hard to maintain and degrades the lower levels ability to manage because they are tied up making unnecessary reports to a senior level.

Roles and responsibilities at different levels of command and control within large crisis management organizations can get "muddled". While this is almost never from the bottom up, it is common for a superior level crisis management team to micro manage the lower level, thus neglecting its own roles and responsibilities. Proper training, a disciplined response and an alert Team Leader providing direct control should be enough to ensure that this "characteristic" does not become a crippling problem.

As the foundation of Business Continuity Management at your organization, a solid program initiation can help you to avoid many structural issues later on.  While you may be eager to demonstrate progress, investing sufficient time and energy into program planning will help to avoid costly delays and remove obstacles. This article will outline ten tips that can be used to improve your program initiation and management.    

Tip # 1 Assess current state of the business continuity program

You must be able to clearly describe where your business continuity program currently stands. Clarify whether any business continuity plans exist and when they were written. Examine how your organization currently manages corporate risks and how this is evolving. Determine how comfortable upper management is with their risk management maturity level. Outline what has changed in the risk and business environment that warrants a change in the company’s business continuity program. Find out what peer organisations are doing and whether the public, regulators or shareholders would be satisfied with your entity’s current state of business resiliency.  The executive sponsor will need this information in order to grant robust support.

Tip # 2 Establish an executive mandated business continuity program

Successful business continuity planning must have executive level support from the beginning.  Without this any program is doomed to failure. The business continuity program must have a designated executive sponsor who will sign-off as each milestone is reached. Ideally the program should be visible to the board of directors or to the deputy minister through annual or quarterly reports. The project sponsors name must carry enough political weight to open up key doors throughout the organization.     

Tip # 3 Develop a strong policy and governance structure

The policy must contain every aspect of the program including a:

1. Risk and threat assessment
2. Business Impact Analysis
3. Comprehensive set of plans (including emergency response, recovery, restoration and crisis communications)
4. Training and awareness program
5. Annual Exercise
6. Audit
7. Maintenance program

The business continuity program scope and objectives must be included in the policy. Policy language should spell-out the classical plan–do–check–act cycle and indicate that business continuity management is a continual process.

Do not forget to perform a risk assessment. Before you start looking for risks to the organization’s critical processes, look for risks to the success of your business continuity management program.    

Tip # 4 Tie program objectives to the organization’s strategic priorities

Understand the strategic goals and operational priorities of your establishment. The business continuity program objectives need to fit into these goals and priorities if you hope to obtain wide spread upper management support.

Tip # 5 Control scope and clarify objectives

Never allow the program to become unmanageable due to a scope that is too broad or objectives that are ambiguous.

Tip # 6 Obtain strong commitments and adequate funding

Again, successful business continuity planning must have executive level support and commitment from key staff. This is a corporate investment and must have a budget that reflects the scope of the program. Include in your budget money for adequate exercise and maintenance programs. Include in your requirements staff time commitment requirements which should include any additional staffing requirement or workload redistribution where business continuity planning responsibilities are added to existing staff.

Tip # 7 Lay out a roadmap for implementation of the program

Frame the implementation. It doesn't need to be a detailed program plan (that can come later) but it has to demonstrate that you have thought things through. Outline the program sequence including what needs to happen first and when projects will begin and end. Show how will they rollout across your organisation and who will be responsible for each rollout. List any ‘quick wins’.

Tip # 8 Set realistic target dates and clear accountability for meeting them

Set realistic target dates based upon consultation with your key partners and obtain their support for meeting them.  Performance measurement is often missed by many business continuity programs as they overlook establishing critical success factors. Demonstrate the value of your program. Indicate how you and your stakeholders will measure success. Determine where you need to be in six months, one year, or even five years in order to achieve your overall goals. Verify how often and in what manner you will report results to your program's stakeholders.

Tip # 9 Establish clear communication channels among project members

Do not allow the program to get off course due to poor communication among members. Try to set up regular team meetings in the same location and at the same time.  If possible, book the meeting room for the next year.  Establish an escalation process if team members are encountering roadblocks, are not meeting target dates or are missing meetings. 

Tip # 10 Ensure your planning team has the necessary technical expertise

The business continuity program manager should obtain comprehensive business continuity management training. They should have the skills needed to share their expertise with the team members.  Project management experience or training can be a very useful but is not absolutely necessary.   Designated members of the planning team should have the technical expertise needed to represent their business unit.

What differentiates the amateur from the business continuity planning professional?  The professional has a clearly formed plan to create and manage the business continuity program.  The amateur does not. Effective use of these ten tips will improve your program initiation and management and help you to avoid many structural issues, costly delays and obstacles and further demonstrate your dedication to professionalism.

Coming soon