{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.text}}
Boards are navigating an era of profound and persistent volatility. Global trade dynamics are in flux, shaped by shifting alliances and unpredictable tariffs. These disruptions have created ripple effects across companies’ strategic plans and supply chains, forcing companies to rethink revenue growth, financial performance, sourcing strategies, cost structures and operations. At the same time, economic signals remain mixed — consumer confidence is weakening and markets are increasingly reactive, yet external pressures are only part of the picture. Ransomware attacks, environmental disasters, unplanned CEO departures and other internal shocks can trigger crises just as suddenly and severely. In this environment, crisis is no longer a rare event but a recurring challenge.
To prepare for a crisis, companies are increasingly recognizing the need for an integrative resiliency program — one that integrates key capabilities like crisis management, business continuity, disaster recovery and incident response planning. Because a disruption could reach the level of crisis when resilience plans are overwhelmed and the tolerable level of impact is breached, these plans need to be working in an integrated and coordinated fashion with the crisis management plan to enable the organization to manage unforeseen disruptions, continue to deliver its strategic aims and return to a viable operating state despite the uncertainty.
The way business leaders prepare for and respond to disruptive events may determine how well the company will recover and whether it will emerge stronger. You may be thinking that your company has been through a crisis and so it knows how to deal with one. But performing a post crisis review and focusing on continuous improvement is likely to position the company to come out ahead in the next crisis. Below, we cover the key areas that should be addressed when considering your company’s preparedness.
Before a crisis How effective is your company’s response plan?
The best crisis plans are living documents. They are constantly updated and enhanced. It’s up to the board to push management on whether the company’s crisis response plan is up to date and ready to be deployed. This means confirming that the plan has all the key elements and the right decision points. The plan should be crisis agnostic with the ability to flex to address various types of crises. It should also reflect lessons learned from what worked and didn’t work in the company’s own crisis experiences. The plan may also reflect insights learned from other companies whose crises have played out in the media. It should outline the designated crisis leader and the right crossfunctional crisis team members, and it should clearly define roles and responsibilities. It should also go beyond these topics to include outside expertise needed and the communication strategy and plan. Overall, the board should have confidence that the company can react quickly and effectively when a crisis event occurs.
The board will want to evaluate whether the plan accounts for all critical elements. It should also assess whether the plan has enough detail, so the crisis team knows what to do when confronted with a problem. But it’s important to balance that detail with practicality. It may seem obvious but it’s worth stating. Every crisis is different, and there is no one-size-fits-all crisis plan.
Elements of effective crisis management plans
- Engages a cross-functional team for planning and execution
- Identifies crisis management leader(s)
- Delineates roles and responsibilities, including the CEO’s and board’s roles
- Defines the crisis escalation process
- Outlines expected crisis management activities
- Defines disaster recovery priorities
- Identifies outside advisors to retain as needed
- Provides guidance on crisis communication strategies, including use of social media
- Requires regular testing of the plan
- Implements a post-crisis performance assessment
The board should also ask whether the crisis plan is aligned, coordinated and tested with the disaster recovery plan and business continuity plan. There may be other plans too, like an incident response plan if there is a cyber breach. These plans are often developed individually at a company, but a centralized approach that includes and tests all plans together is critical for a company’s resiliency. True operational resilience allows an organization the ability to maintain critical operations during disruption and requires the integrated activation of these various types of response plans and escalation up to the crisis management plan.
Business continuity plan: Commonly includes identifying mission-critical systems, strategic decisions, and policies and procedures on maintaining business functions during a crisis (e.g., manual processes to continue operating) as well as related roles and responsibilities.
Disaster recovery plan: Includes policies and procedures for backing up data, restoration procedures for disaster recovery sites and systems, and related roles and responsibilities.
Incident response plan: Includes actions to take in response to specific incidents, such as cyberattacks or data breaches, including detection, containment and recovery processes, as well as related roles and responsibilities.
Timely board escalation
When a crisis occurs, the board needs to be informed at the right time. Some types of crises should trigger almost immediate notifications to the board, while in other cases, it may be appropriate to wait until the next board meeting. Recent crises that the company has navigated can provide an opportunity for the board to reflect and assess when it was notified and whether that timeline was appropriate. If not, the board (working with management) can further define the board escalation process in the crisis plan.
Examples of triggers that would require management to escalate an issue to the board
- An event associated with the company results in critical personal injuries
- Severe damage to company-owned property
- Projected significant financial impact from an unexpected event
- Critical systems are offline for a specified period of time
- An event associated with the company draws significant negative social media attention
Get feedback on testing
The board can ask management about the different scenarios that it used to simulate a crisis and test the plan. Of directors that say their boards have conducted tabletop exercises in the last 12 months, the majority (81%) of them have been focused on responding to a cybersecurity breach. However, other critical crisis scenarios — such as mitigating the impacts of supply chain disruptions, addressing natural disasters and navigating geopolitical crises — have been less frequently tested. It’s essential to evaluate scenarios that differ from crises the company has already encountered. Continual testing of the plan helps the crisis team understand how well the company would respond in real time and whether roles and activities align with the plan’s intentions. Testing can help identify areas of confusion and reveal gaps in the crisis response plan.
During a crisis How does the board help management successfully navigate?
Once a company is in crisis response mode, the stakes are high. Companies — including the board — may be judged not just on the issue itself but on how effectively they respond. And if the response is mishandled, the impact may reach far beyond an operational problem. A mishandled response can quickly escalate beyond an operational issue, which may cause lasting damage to reputation and brand.
But as many boards and management will admit, responding to a crisis is hard. The scope of the crisis can be uncertain. Facts can be murky and inaccurate. News and rumors spread quickly through social and traditional media, adding to the pressure to respond quickly. On top of that, the board and the company may face pressure from stakeholders, the media and the public to take action — even before it has the full picture.
As boards reflect on recent crises, they should discuss with management what went well and what didn’t go well in the company’s response. A critical assessment that targets improvements and pitfalls to avoid when a future crisis occurs is valuable.
Challenging the communications strategy
Having the right communications strategy internally and externally is critical when responding to an event. A company will want to tell its own story about how it is addressing the crisis. Without a communications strategy, a company may lose control of its story. This may result in damage to crisis efforts and company reputation. For these reasons, the board should understand and challenge management’s strategy on what the company should say, who should say it and when they should say it. Stakeholders will want to know how the company is responding, even if the answer is that the company does not know the answers yet. Perception matters, and acknowledging the issue is often more advantageous than staying silent.
Typically, the board should expect to see outside advisors built into the crisis plan and response.
- Law firms can advise on required communications, such as those that must be made to regulators. They can offer perspective on any voluntary disclosures and help the company avoid being exposed to increased liability.
- Crisis communications experts can guide senior management on a communications strategy, including how frequently to make statements despite the absence of additional information.
- Crisis management firms can also provide strategic advice and additional resources to help a company balance responding to a crisis and running the business.
In assessing the company’s response to recent crises, the board should ask management to reflect on whether it had all the right parties and experts involved from the start. Was there anyone that needed to be included in the last crisis that wasn’t part of the plan? If so, these learnings should inform an update of the crisis plan.
Addressing all stakeholders
When communicating under pressure, companies tend to focus on one or two stakeholder groups who have the loudest voices at the expense of other, possibly more critical ones. The board plays a role in helping management consider the diverse needs and interests of all stakeholders in the communications strategy. The board will want to ask the crisis team about feedback from stakeholders, see that the company’s response resonates with them and consider what additional actions can be taken to address concerns.
A crisis is, and always will be, a human event. Only human beings can manage a crisis effectively, and human beings are the most affected by it.
Internal communications are as important as external communications. In a crisis, management may be so externally focused that they overlook communications with their employees. Boards will want to make sure this critical stakeholder group gets attention. Employees are often the company’s strongest advocates. Actively engaging with them during a crisis can help with attraction and retention of talent. Employees will continue to perform their responsibilities, deal with customers and interact in their communities. They need to be informed about the crisis, receive regular updates and know where to go to get more information and ask questions.
After a crisis How do we get better?
Once a crisis has passed, the tendency is to get back quickly to “business as usual.” But unless there’s a thoughtful post-event review and adjustments, if needed, to the crisis response plan, the company risks repeating any mistakes it made in future crises.
Root causes and improved response plans
Directors will want to understand the root causes of the crisis the company has just weathered. This allows the board to weigh in and discuss whether appropriate follow-up actions have been taken. There may need to be an investigation based on the nature of the crisis, and management will often lead such investigations. But if management itself seems to be at the heart of the crisis, or if the event was significant enough, it may make sense for the board to decide whether an independent investigation is needed.
In addition to looking at root causes, there should be a continuous improvement mindset for the crisis response plan. Directors will want to discuss with management what was learned and how the plan will be improved as a result. It also can be valuable for management to get an external, objective assessment of the company’s crisis response from a different perspective from those that participated in it.
Don’t forget a post-event review
Once the crisis is over, the board will want to engage management in a candid and open discussion about how well the company responded. Directors can consider asking management the following questions:
- Right crisis team. Did we have the right executives on the crisis team? Did we have the right internal subject matter experts, and did we leverage the right outside experts?
- Useful plan. Did we have an enterprise-wide crisis response or continuity plan? Did we use it? Was it effective?
- Clear accountability. Was it clear who had decision-making authority? Did management take too long to make decisions? Were there any bottlenecks in the process?
- Effective and timely communications. Were our communications to key stakeholders on point? Were they timely, and was the frequency right? Could we have been bolder?
- Stakeholder focus. Did we consider all of our stakeholders? Did we address their key concerns? Were there a lot of unanswered questions?
- Response to feedback. Were we agile enough to respond to feedback from our stakeholders? From the market? Did we understand what our competitors were doing, and were we able to react or respond quickly?
- Useful technology and data. Did we have the right tools and data to assist in our crisis response? Is there a technology solution that would have aided decision-making by better tracking activities and providing data?
Conclusion
Knowing the company has a sound crisis response plan can give directors greater confidence that management is ready to respond to a future crisis. Since many directors have had to deal with crises in their executive roles, they can use their experience to advise management. The better the plan and the more coordinated the effort to test and execute it, the more likely it will help a company handle a crisis quickly and effectively. Robust crisis preparedness can be viewed as a competitive advantage.
Being prepared for the next crisis
{{filterContent.facetedTitle}}
{{contentList.loadingText}}
{{contentList.loadingText}}
Contact us
Follow us
