- Security TWENTY
- Women in Security
Most organisations have either entirely centralised their crisis management processes or have adopted a hybrid approach where regions or sites are allowed some degree of autonomy to manage their own events. A purely regional approach in a global organisation is much less likely to be successful, the findings suggested.
Crisis management is no longer purely about best-in-class processes, according to the report – people are integral to good crisis management. The two leading working practices which practitioners indicate will change post-pandemic are 1) a more collaborative approach to a crisis and 2) that staff health and well-being will be considered as an integral part of the response. Without healthy staff, fully engaged in the response and with good channels of communications, results in a less effective response.
Good crisis management needs strong leadership. Senior management lead crisis management in most organisations in the survey. That helps to ensure every worker is aware of the importance of crisis management and also appreciative of their own role in a crisis. This is not true in every sector: senior academics are frequently in charge of crisis management in the further education sector, for example, which can lead to slower response times.
Crisis planning is becoming more agile and adaptive. Many reported that they found that lengthy pandemic plans were not fit for purpose over the past 18 months: less than half reported their crisis plan was effective during the pandemic. However, three-quarters of those who had an ineffective plan reported they were able to quickly adapt and either wrote a new plan at the start of the pandemic or modified plans to make them more relevant to covid-19. Having pre-planned suggested responses to some of the likely ‘symptom’ scenarios for a ‘respiratory virus’ allowed a swift adaptation of the wider plan to a covid-specific one.
Business continuity is starting to take a more strategic role in crises. A purely centralised crisis management approach to a global crisis (such as covid) is likely to fail in a global company. A centralised team can apply consistency in their approach, it can centralise support and help with coordinating certain processes such as the post-incident review (PIR) (sometimes referred to in crisis management as the After-Action Review — AAR). It can also centralise otherwise expensive processes, such as global security operation centres, specialist software tools and consultancy.
It’s not all about covid. The report suggests that there’s a disconnect in planning between events which are beyond control (such as earthquakes or extreme weather) and those where there is deemed to be a degree of control (such as IT or telecom outages). For example, management intrinsically trust their IT department to manage IT, telecoms and cybersecurity issues and their focus diverts to disasters which are beyond control such as earthquakes or extreme weather. This routinely leads to IT and telecom outages causing the most disruption.
As for comms, while some are still using ‘call trees’, free messaging apps (such as WhatsApp and Messenger) still have their place within crisis management teams’ technology toolkit. Although some interviewees admitted they still had some reservations around security using free tools, the universal adoption and ease of use – particularly with management – meant it still had its place for fast information communication or less formalised “chat” during a crisis.
BCI chair Christopher Home said that compared to some other disciplines crisis management is still a relatively new formalised practice; and it continues to evolve at a rapid pace.
“Although major incidents have helped to shape crisis management processes over the past four decades, there has been no incident which has had the global depth and longevity of the COVID-19 pandemic. For many organisations, this has helped to reshape crisis management strategies – generally for the better – and we are already seeing learnings made during the pandemic translated into crisis management plans.
“At the BCI, we frequently discuss the importance of high levels of collaboration and a non-siloed approach as crucial to creating a culture of resilience in an organisation. Such practices hold true throughout the crisis management process and the report shows that siloed working has been reduced during the pandemic with organisations believing this approach will continue post-pandemic.
“The report also demonstrates how the organisations which have had the most success with their response have a centralised process but allow some autonomy amongst regional operations to allow them to adopt and shape practices based on their own cultural differences and local laws and regulations. A centralised structure can also help to provide the crisis management team with expert knowledge with the presence of subject matter experts – which can also be used by the regions where appropriate.
“Once again, however, we note that the role of leadership within an organisation is paramount during a crisis. Leadership can help to engage the whole organisation in the importance of good crisis management, as well as leading the crisis management team through the response. Nevertheless, the report does explain that there cannot be a “one size fits all” approach to crisis management and there are some very defined instances identified …. where management’s involvement has been to the detriment of the response. We continue to be impressed by the level of agility and adaptability that organisations have had to exhibit in order to survive – and thrive – post-pandemic. While following a tried and tested approach with a recognised framework remains at the core of crisis management practice, the ability to adopt and adapt plans to make them quickly appropriate to the incident in question have been showcased in the research carried out for this report. Adopting a more agile approach also resonates well with senior management which, in turn, will improve the effectiveness of crisis management.”
The BCI is running its annual conference remotely as BCI World Virtual on November 3 and 4. Visit the events part of the BCI website.