War Games Part II
Last week, we published a post re-emphasizing a 2014 blog on war gaming/exercising emergency response plans, and I promised that this week I would continue with thoughts on crisis management.
Crisis management, unlike emergency response, is focused on controlling the unfolding crisis after (and even during) the emergency response team’s activity to protect people and then property. The Crisis Management Team (CMT) is a very different group of people and they’re seldom actually at the location of the actual emergency. They’re people with the authority to allocate resources to resolve the crisis and get the organization back to normal operations.
In many ways, crisis management exercises are more difficult than emergency response exercises because the possible crises cover a wider range, including such things as a cyber-breach crisis, a reputational attack or accusations of leadership malfeasance as well as fires, floods and other natural disasters. This wider range of crises means that organizational leaders should seriously consider more frequent announced and unannounced crisis management exercises – exercises to address more of that wider range. A CMT will need to respond very differently to a fire in a facility with both personnel injuries and significant facility damage than they will to a cyber breach. The resources they will need, the options that they will have to consider and the stakeholders with whom they will have to communicate will be different. The similarity to emergency response is the urgency of action – crises, like emergencies, unfold at the speed of one second per second and there are no “time outs” to consider what to do next.
CMTs need to be intimately familiar with their crisis management plans and they need to have them readily available (in hard copy or in soft copy on some “personal device”) for reference if needed (but remember, the CMT isn’t going to have time to wade through a document with which they are unfamiliar – that would be like playing football, seeing a football loose on the ground and thinking, “Oh, a fumble, I should jump on it.” By that time, the guys with the Pavlovian response to a fumble have already fallen on it and earned their fumble recovery bonus).
What the CMT wants to develop is not a Pavlovian response, but rather mental “muscle memory” that helps them skip long, laborious thought processes and respond quickly to complicated situations. Exercises help build that mental muscle memory, and because crises can be so variable, it pays to exercise the CMT regularly and with different scenarios.
Frequent, realistic exercises require an investment in time and effort. Someone has to develop the scenario and conduct the exercise. This effort isn’t trivial and can take even an experienced facilitator fifteen to twenty hours. Why so much time? The scenario has to be realistic – it has to cause the CMT to flip their mental switch from “exercise” to “crisis.” The exercise has to include all the components of an actual crisis, including the pressure from outside media or government regulators. It has to include time pressure, so it has to flow and unfold at a pace that creates time pressure on the CMT. But the results are worth it when the CMT takes effective action to quickly end the crisis or avoids a bad decision that would lead to a second crisis. For example, poor external communication in the case of the BP Deepwater Horizon and the Malaysian Air flight 370 crises generated serious secondary ill effects for those companies.
Planning is critical in preparing for “business as unusual,” but so is performance, and that performance cannot be maximized without conducting frequent, realistic exercises.
It continues to be important for all organizations to conduct their own “war games.”