Crisis management plans – what you need to include in your plan

By Adrian Ryan - CoFactor Managing Partner; and communication and reputation management specialist

--

A crisis management plan (CMP) outlines a well-documented set of responses to potential crisis situations that allows an affected organisation to act quickly, should a serious incident occur.

CMPs are used by an organisation’s designated crisis management team, or others such as business continuity teams or emergency management teams. They are designed to avoid or minimise damage, and to provide direction on staffing, resources and communications.

Increased cybersecurity attacks, natural disasters and technology outages alone, ought signal to organisations that they should have a ‘when, not if’ mentality to their crisis management planning. The coronavirus pandemic and the need for carefully planned and executed employee, customer and wider stakeholder communication only reinforces the need.

At the heart of an effective response to a crisis is an effective CMP. Businesses are most resilient when they’ve already considered what to do if the worst happens and if all stakeholders understand the roles they need to play. 

We’ve previously defined crisis management and the key steps to ensure your organisation is crisis-ready for a potential crisis. Yet, prominent third party research and our experience highlights that many organisations do not have a CMP in place. Or they have one that isn’t practical, relevant and current.

So, let’s focus on CMPs and how to ensure your organisation has an effective plan in place prior to a crisis.

Key Elements of an Effective Crisis Management Plan

1. Purpose and scope:
   Outline the purpose and scope of the plan.
   
   
2. Activation guidelines: Explain what criteria will be used to determine when the plan should be activated. Also capture who the CMP can be activated by.
   
   
3. Identify crisis management team members: Identify ‘who’s on the team’ and their role and responsibilities. Importantly, specify who will be the spokesperson(s) in the event of a particular crisis.
   
   
4. Stakeholder notification: Include guidelines for who is to be contacted in the event of a crisis and in what sequence, and how that notification will be made. 
   
   
5. Crisis response strategy: Develop a framework to manage the crisis. This includes a process for conducting an assessment of the event, its potential severity and how it will impact key stakeholders, including employees.  When an event occurs, this response process will be invaluable to members of the crisis response team to determine the initial steps for the incident management.
   
   
6. Detailed action plans to respond to potential threats and likely crisis situations: Your action plans provide a step-by-step checklist to guide your crisis response team for each of your organisation’s most likely crisis scenarios. We recommend preparing action plans for 5 to 10 of your organisation’s most likely crisis situations. Identify the specific actions that each department or team member would need to undertake within the first 24-48 hours of the crisis occurring.  For example, the response steps will be different for a significant data breach than for a product recall. Designate a clear ‘owner’ for each task and action.
   
   
7. Pre-approved crisis communication strategy and messaging: Timely, consistent and effective communication with your key stakeholders is critical to successful crisis management. Aim to pre-define your crisis communications strategy, and to draft communications and have them pre-approved - to the extent possible. The list of pre-approved communications should include a:

• Crisis communication strategy (e.g. proactive vs reactive means of communication)
• Talking points and key messages
• Holding statements / first response statements

8. Evacuation plan: Provide evacuation procedures and detail the staff who will perform the evacuation.
   
   
9. Integration with other emergency plans: Provide linkages with other risk management plans, such as business continuity plans and evacuation plans.
   
   
10. Plan maintenance or governance: Establish a program to update your organisation’s response plan, at least annually, or more frequently if needed.  
    
    
11. Appendices: Appendices are the final elements of a CMP. In this section you want to include all additional resources and material that may be needed by any member of your crisis response team in the heat of the moment. These may include:

• Hazard-specific appendices for different event scenarios
• Forms and checklists 
• Role cards for each crisis management team member 
• Organisation charts
• Floor plans for emergency operation centres; and 
• Contact lists 

Additional Tips for Corporate Crisis Management Plan

In addition to that list of key elements of effective crisis communication plans, some additional tips include:

• Access to the plan: Document who will have copies of the CMP and who will have access to the plan electronically. 
• Glossary: Include a glossary of terms and acronyms employees may not already know related to crisis management planning and recovery efforts. 
• Deactivation: Identify when your crisis response and team can be deactivated. Capture the key deactivation considerations and tasks such as notifying those concerned, ensuring all crisis information is captured and collated, and undertake a post-incident review. 
• Testing the plan: The plan also needs to be periodically tested. This can range from desktop or boardroom exercises to full, active simulations involving scenarios and activation of the crisis team and other third party organisations. 
  

These elements will provide your organisation with a solid foundation for an effective CMP. There’s a lot to cover in a comprehensive CMP, and each piece is significant in its own way. 

Remember, a CMP will only work if it fits within your organisation’s approach. Don’t leave crisis management on the back burner for your organisation, waiting for the inevitable.