Crisis Management, Public Relations, and Business Continuity

Crisis management, public relations, and business continuity are tested during a disaster event. Today, we’re analyzing business continuity plans and disaster response to determine a good public relations response vs. a bad one.

For today’s post, I thought we might try something new. Rather than write a formal article, I wanted to share some things with you that have been on my mind lately about business continuity and disaster recovery.

I have been observing other organizations’ disaster response efforts from the outside and trying to work out what’s really going on based on what we see in the media, as well as about what separates a good public relations response to a crisis from a bad one. I’ll touch on these and other topics below.

The Good, the Bad, and the Ugly

• Beauty met the Beast in Washington state last month when an Amtrak train derailed near Olympia, the state capital. The Beast was the incompetence of the people who caused or allowed the train to go through a bend at fifty miles an hour over the speed limit. The Beauty was the work of the various agencies that responded to the disaster, which was outstanding. For a nice read on how the event unfolded from the disaster response agencies’ point of view, check out this article from the Olympian newspaper: “Did the emergency response to Amtrak derailment go as planned?”
• Want an example of how not to manage a disaster? If so, you don’t have to look any farther than Equifax’s response to the data breach last summer that exposed the sensitive personal data of 143 million people. Adam Galinsky, a business professor at Columbia Business School, gives a quick rundown on some of the things Equifax did wrong in its response to the crisis in this clip from CNBC: “They really flunked Crisis Management 101.”
• Another incident that gives a good example of how not to manage a company crisis is the Massey Energy coal mine explosion in West Virginia. This occurred several years ago, but it’s still fresh in my mind because of the high loss of life—29 miners were killed—and also because of the company’s awful crisis management response. For a recap, check out this report from National Public Radio: “Emergency Reports Detail Slow Mine Blast Response.”

Can a Business Continuity Plan Really Help?

Every now and then in this business things happen just the way they are supposed to: a company you’ve worked with takes a punch, and with the aid of the business continuity plan that you wrote with them, the situation is dealt with effectively, the disruption is minimized, and the company quickly gets back on track. That’s a satisfying thing to be part of.

• I can’t get too specific as to details, but here’s one recent example: A U.S.-based company that we work with (with over 500 locations worldwide) was the victim of a data breach. In responding to it, they followed the plan that we wrote with them, activating their crisis management team and working off of the plan for 3 to 4 weeks while they dealt with the ongoing issues caused by the breach. They also adapted the plan to unfolding events, which is exactly what you want to see. The company did a great job in handling a tough situation and expressed satisfaction at how our plan guided their response.
• Here’s another recent story where things went the right way: A client of ours that has its offices in a skyscraper in a major U.S. city was affected by a protest against another company in the same building. Our client implemented the business continuity plan that we wrote with them, quickly getting an incident management team together, implementing their pre-established work-at-home strategy, and notifying everyone at the company about what was going on and what they should do. As a result, the impact of the disruption was kept to a minimum.

Stories like these will give you an idea of why I’ve found this such a satisfying field to work in for almost two decades.

What if the Disaster Doesn’t Fit Your Plan?

Here’s another story, unrelated to any of the incidents described above. Once we were conducting a mock disaster for a client to test their continuity plan, and one of the key participants objected to the scenario we proposed. We asked him what was wrong with it. “Your disaster doesn’t fit my plan,” he replied.

Here’s a word to the wise: The real-life disasters that come at you never fit your plan.

Building on the above, here are a few more words to the wise:

• Your plan will never fit the event perfectly.
• You’ll always have to change on the fly.
• You’ll always find ways to improve.
• The plan is only a framework.

The Struggle is Real

I’ve been in this field for over 25 years, and one thing I’ve learned from going to industry events and talking to people around the country: getting companies to set up BCM programs and implement well-thought-out plans and strategies is an ongoing struggle almost across the board.

A lot of companies that you would assume have their act together in terms of business continuity (based on the fact that they are highly touted, highly respected blue-chip companies) actually are not well-prepared to deal with disaster. A lot goes wrong behind the scenes at these companies, and sometimes there’s real chaos. Probably 10 percent of companies are well-prepared for disruptions. In most cases, the disaster response is not as good as you assume it would be.

For examples of organizations that struggle mightily with business continuity, we need look no further than these industries that typically lag in BCM readiness:

• I’ve worked with a lot of hospitals, and one thing I’ve noticed about them over the years is that, while most are excellent at dealing with disasters that happen around them, they are not so good at responding to disasters that happen to them.
• Educational institutions are typically very good at Incident Management but are lacking in IT Disaster Recovery and Business Recovery Planning.

The Hallmarks of Success

You know the old saying about how the three most important things in real estate are location, location, location? I’m tempted to say that in business continuity, the three most important things are testing, testing, testing. That’s not exactly the case, but it’s close.

A disaster recovery plan is great. A disaster recovery plan that has been tested and found to work is gold.

• Love ’em or hate ’em, there’s no debating that the New England Patriots have an unmatched record of consistent high performance. What’s their secret? I admire the way they constantly strive to improve. It’s an approach that also pays dividends in business continuity. For performance tips from a master, check out this interview Bill Belichick gave to CNBC last year before the season started: “Legendary coach Bill Belichick’s top 5 tips on success and winning.”

The Importance of Public Relations

One of the interesting facts of life in the disaster recovery business is the unevenness of the amount of information about disasters that comes into the public eye. We learn a lot about what happens in disasters involving government agencies. We learn a moderate amount about disasters that occur in the private sector where there’s a major consumer impact, prompting a lot of interest from the media. But the vast majority of disasters occur out of the public eye. They occur and are managed without outsiders ever knowing about them. Often, even those of us involved in writing disaster recovery plans for different companies are not informed when there’s an incident and those plans are put into action.

It may be true that you can’t judge a book by its cover, but I have observed over the years that it is pretty safe to judge an organization’s disaster response efforts by how well it fields media inquiries about the disaster. If the company handles the press part well, it’s usually safe to assume they’re doing a lot of other things right behind the scenes.

What are the hallmarks of a good press operation in a disaster response situation? Here are a few:

• It’s clear who is going to speak for the company.
• Spokespeople are polished and well-trained at speaking in public and to the television cameras.
• The spokespeople know when to refer questions to subject matter experts and are supported by such experts at press appearances.
  
  
• Spokespeople can provide accurate and authoritative information about what is going on and give estimates of when operations will get back to normal.
• Any written communications issued about the disaster are polished and accurate.

Prepare For Any Crisis With BCMMetrics™ Business Continuity Software

BCMMetrics™ can help you get the necessary information to start creating effective contingency plans for your business, without hiring outside help. Our BIA On-Demand (BIA^OD) tool gives you all the right questions to ask to accurately identify your company’s most critical processes and their dependencies. And the Residual Risk (R²) tool helps measure and assess risk factors and the threat landscape for your organization. There’s no software to install; it’s all cloud-based and secure, so you can get started right away.