The famous World War 2 German General Erwin Rommel once remarked: “The British write some of the best doctrine [handbooks] in the world, it is fortunate that their officers do not read it.” This aphorism has a universal truth in it – why do strategic and tactical crisis management teams often fail to refer to their crisis management plans during exercises and crises?
The reasons for this are varied. In some cases, plans are poorly written, are too long, unwieldy and out of date. As such they are off-putting to the reader and fail to achieve buy-in from the outset. In other words, they lack credibility. If they are too generic or are not the product of an analysis of what is critical to the organization, it is likely that they will not contain useful guidance, such as immediate actions to take to ensure staff safety, unambiguous notification and escalation procedures, recovery priorities for critical activities, workarounds, and stakeholder communication instructions. In other cases, plans are not easily accessible, or response team members do not know where they are stored and consequently are not familiar with their contents.
Another reason is that, as humans, we have an action bias: the temptation is to plunge straight into problem solving rather than refer to a boring process document, particularly in the excitement of fast-moving events. This is frequently the case when response teams comprise senior leaders that routinely work together on ‘weighty issues;’ are used to making decisions and are confident that they know what they are doing and believe they don’t need a plan to tell them what to do.
What are the consequences of not consulting the plan?
One of the most common consequences of not following the plan is that crisis meetings lack structure and become a rolling discussion. Often this results in a lack of clarity of intent on what is to be achieved and little or no articulation of the organization’s priorities. What needs to be done is often described in slightly general terms and actions to be achieved are not allocated to named individuals with deadlines for completion. Longer meetings often result in repetition and back-tracking over previously agreed items, or the response team attempts to solve the entire incident in one discussion rather than prioritizing what decisions must be taken now and which can be deferred to subsequent meetings (or delegated entirely).
Often when response teams do not consult the plan, they fail to acknowledge the need to delineate between a business-as-usual response and the need for a crisis management response. When this occurs, the response team may adopt an inappropriate leadership style for the situation and attempt to build and maintain consensus through collegiate consultation at the expense of making timely decisions through a more directive approach. Where there is a charismatic senior leader who is confident in their crisis management experience and impatient to get on with tackling the crisis, it may be the rest of the response team that suffers, as less experienced team members may lack confidence in what is expected of them and be unwilling to offer constructive challenge. When this occurs, there is an increased danger of Group Think where alternate perspectives and competing hypothesis are not presented, and assumptions go challenged.
Another symptom of the failure to consult the plan is that response teams lose sight of their roles and responsibilities and are tempted to delve into the details of the incident (particularly when the response team is comprised of senior subject matter experts). In these cases, there can be a desire to focus on providing the solution to the operational teams (the long screwdriver effect) rather than giving a clear strategic intent with supporting objectives and priorities of what is to be achieved and then allocating & prioritizing resources; approving the strategic communication messaging and coordinating the key stakeholder engagement. When this occurs, the senior response team can also be guilty of retaining the subordinate team leader within their meeting because they are focused on debating the operational details. This deprives the operational response team of their chair, delays the flow of clear direction, and slows the overall response.
Where Records of Decision or an Incident Log are not maintained, requests for information often go un-answered and assumptions are not challenged. This can mean, during long-running incidents, that the basis of previous decisions is forgotten, and individuals are not held to account for actions to be achieved. Maintaining common situational awareness over time becomes an increasing challenge for the response team and time is required during meetings to discuss developments, establish what has been achieved and whether actions have been effective. Cumulatively, this can create a delaying effect on the efficiency and rhythm of crisis management meetings.
Lastly when the plan is not consulted the crisis is often allowed to peter-out and there is no formalized decision to terminate the crisis response and return to business-as-usual management with clear responsibilities allocated for any residual recovery tasks. When this occurs, there can be a lack of clarity and confusion as to who is responsible for what. This results in either unnecessary duplication, lack of clear ownership or tasks falling between organizational boundaries.
What can be done?
Perhaps, self-evidently in the first instance organizations should produce simple, easy to read plans, that are the product of a detailed analysis of what is critical to the organization and can provide a clear handrail and structure to follow in a crisis that provides the basis for adaptive problem solving. Response plans should only contain information that is of use in a crisis, and everything else can be moved to framework documents such as a Crisis or Business Continuity Policy, framework methodologies and analysis documentation. Depending on the leadership preferences, plans can be distilled into a series of chronological slides that can be projected during the response meeting as a guide to structure the sequence of the response.
Once produced, response and contingency plans should be stored in an easy to access location, and response team members trained in how to access them. A Virtual ‘operations room’ on a dedicated MS Teams channel can be used to store plans along with other supporting response documentation such as a record of decision templates, action trackers, maps, and diagrams. Response Team members should be encouraged to have the latest version of the response plan downloaded to their personal device and the Business Continuity Manager or Crisis Coordinator should have plans stored in hard copy or available on a separate system in the event of an IT outage or cyber-attack.
This lack of familiarity with the plan can be overcome where the response team has an empowered and confident Crisis Coordinator to guide and facilitate them through the key stages of the process, however there is no substitute for regular training and exercising of the response team members. Simple scenario exercises can be used to refine the plan and familiarise response teams with key risks, explore low probability high impact events or to set up complex problems that require collaborative cross-discipline discussion and debate to resolve them. Exercises with multiple response teams can practice the flow of information and coordination between them and simulation exercises can be used to add realism and tempo to the experience and replicate the challenge of building and maintaining situational awareness through the dynamic introduction of a-symmetric information.