2017 Crisis Management Planning Calendar

Transcription

1 2017 Crisis Management Planning Calendar January Audit your Emergency Response Plan (ERP) to include designated staff and their deputies, facilities, equipment and checklists. February Review your crisis communications plan. Are your designated spokespeople trained and ready? Have you pre-written a few template statements and had them approved by legal? Include your IT staff if they are responsible for your website/ emergency site in the case of an incident. What is your social media response to an incident? March Train new and existing staff with designated functions in your ERP. April Exercise your ERP. Conduct a halfday, pre-notified tabletop exercise to run through roles and gauge understanding. May Review your emergency partners. Review the capabilities you ve contracted them for. Audit their facilities and equipment. Meet with them and define how the partnership will work during an incident. Test call centers and activation procedures. 24 July Review your insurance coverage. Meet with your broker and legal team to understand your liabilities and to discuss how you ll all work together during an incident. August Check that the ERP is compatible with other contingency plans: business continuity, safety, security, environmental and financial. September Hold a full-day, pre-notified inputresponse exercise, testing all aspects of crisis management and crisis communications. Conduct an after action review following the exercise and schedule follow up training immediately after to solve problems while they re top of mind. October Include next year s ERP audit and crisis communications training and exercises in budget calculations. November Hold training sessions to follow-up on lessons identified in the inputresponse exercise. June If you operate internationally, review current family assistance laws to ensure compliance. For airlines, if you fly into the US, review your filing with the US Department of Transportation. ERP December Exercise your ERP with a no-notice activation during off-hours to test systems, facilities, and equipment.

2 Year of Planning January January s Task: Audit your Emergency Response Plan (ERP) to include designated staff and their deputies, facilities, equipment and checklists. Audit the ERP according to plan maintenance requirements. If your ERP does not contain plan maintenance requirements, conduct the following checks and include an ERP maintenance requirements section in the next revision of the plan. Establish next review date and schedule review steps. Send a request to all plan holders for update comments. Require each person responsible for a checklist in the plan to review the checklist and make recommendations for changes as needed. Don t forget to do so in light of any business model or resources changes. Review any comments for plan revisions from the past year s training, exercises and ERP activations. Review any other comments from interested parties for possible addition in the next plan revision. Check all assigned primary and alternate staffing of the Crisis Management Center and Incident Management Center organizations and any other key positions. Update as necessary. Check and update all contact lists containing phone numbers and addresses. Check and update all key outside resource contact details. Check and update all key partner contact details. Check and update all response agency contact details at all company facilities and locations. Check to ensure all equipment lists have been inventoried and inspected for functionality. Review ERP distribution list and change as necessary.

3 Year of Planning February February s Task: Review your Crisis Communications plan. Schedule an audit of your Crisis Communications Plan (including facilities, equipment, report forms, fact sheets, checklists, draft releases and statements). Review any suggestions for changes to the plan arising from recent training sessions and exercises. Task plan holders with submitting new updates and editing checklists as needed. Check that the following Crisis Communications Center (CCC) personnel roles and deputies have been assigned: Crisis Management Center (CMC) Crisis Communications Representative Head of Crisis Communications Center (CCC) CCC Writer CCC Social Media CCC Internal Comms Ensure that staff (particularly spokespeople) have received training, been tested and evaluated. Coordinate with IT on a pre-made emergency site/dark site. Ensure that CCC Social Media and CCC Internal Comms representatives have been trained to update websites, social media and intranet. Ensure that a room has been assigned for the CCC and the relevant equipment and checklists are available. Check and update all contact lists containing phone numbers and addresses. Test your activation procedures out of office hours. Ensure that the emergency and family assistance websites are up to date and the latest brand materials are available in grey scale for use on social media channels in the event of a crisis. Check that template press releases have been prepared and approved by your legal department. Check that approved scripts for personal voic and template out of office messages have been prepared. Check that you have the capability to record and upload a video update from your CEO. Check that you have a list of possible venues for an emergency press conference in your key locations and a detailed outline of the set up and equipment involved. Check that all partners are clear on the crisis response protocol. Ensure that social media guidelines for staff include advice on conduct in a crisis. Check and update all relevant agency contact details. Check and update all key partner press office contact details. Be aware of planned/scheduled ad campaigns or social media posts that may need to be canceled or postponed following the incident.

4 Year of Planning March March s Task: Train new and existing staff with the designated functions in your Emergency Response Plan (ERP). Establish changes in ERP content/procedures since last training. Assess the level of ERP training new and existing staff already have. Consider if introductory training is required for some, in addition to refresher training for others. Consider any new operations (new facilities, operational routes, new equipment, etc.) introduced since last iteration of the ERP and the implications for emergency management. Review any pertinent incidents within the company and any other major global loss-of-life disasters that may have lessons learned. Use relevant incidents as examples. Consider any new legislation and regulations that might affect your operations. Decide what kind of training is appropriate: Presentation Table Top Exercise Input Exercise Basic training Review what software may be required in case of an incident and ensure staff members are suitably trained. If Go-Team training is being considered, ensure the team can operate any needed equipment (satellite phones, etc.). Ensure all functions within the ERP/Crisis Management Team (CMT) have been allocated and that each function has a deputy. For more information on recommended functional areas, see this series on the Kenyon CEO Insights blog. Consider what other functional duties staff members would be asked to perform when the designated person is unavailable. Remind staff of the importance of ensuring personal contact data is kept up to date and what procedures are in place to facilitate this. Explain the importance of data management and the tools provided. Explain any Business Continuity (BC) issues and the difference between the ERP and BC.

5 Year of Planning April Month s Task: Exercise your Emergency Response Plan (ERP). Conduct a half-day, pre-notified tabletop exercise to run through roles and gauge understanding. Review the exercise training objectives for the year. Review after action reports of any real world ERP activations. Prepare your recommended objectives for the tabletop exercise to discuss with leadership and solicit any additional objectives leadership may have. Review company calendars to determine the best time to have the tabletop exercise and schedule it accordingly. Include time for discussions, time outs and after action review. Prepare the announcement and distribute it to participants allowing ample time for them to study their roles, their ERP checklists and the ERP checklists of all other exercise participants. Write a scenario for the exercise that will focus the tabletop on the objectives you and leadership previously determined. In conducting the exercise, allow time for discussions to occur to facilitate learning. If issues are identified, be prepared to call an exercise Time Out to solve the issue. Conduct the tabletop exercise and lead the after action review to determine if the objectives were met. Consider a follow-up meeting to regroup after lessons learned from the exercise have been incorporated into business processes and any action items resulting from the exercise have been completed.

6 Year of Planning May May s Task: Review your emergency partners. Review the capabilities you ve contracted them for. Audit their facilities and equipment. Meet with them and define how the partnership will work during an incident. Test call centers and activation procedures. Establish a point-of-contact for the provider. Make contact with your service provider, ask them to show you how the services work in reality and ask to visit their premises so that you can see their capabilities first-hand. Ask how many full-time staff, contracted staff and deployable Team Members (by location and skill set) are available. Ask for a tour of their facilities, including a warehouse of any specialist response equipment and personal effects storage / processing stations. (It is crucial that any response organization has equipment ready on stand-by for every eventuality. Purchasing specialist equipment at time of incident is too late!) Ask to see their maintenance records of the equipment and have them explain how the equipment is used in reality. Check that there are on site facilities to directly support the response (e.g., a Crisis Management Center) and ask for an explanation on who would work there, their hours and their handover procedures. Question your service provider about how information would flow between the organizations involved. There could potentially be more than one organization doing various things (if that s how you are set up). This can cause confusion and make for a more complex response. If you have an agreement for family assistance services, ask when the last time any staff training was made available and how many people have been deployed in these roles to recent incidents. If you have an arrangement for a call center, test it! Make arrangements to call the center and play the part of a family member. It is important that this is done under exercise conditions to avoid confusion of a real incident. Ensure that the provider is able to issue multiple toll-free numbers and that the process is easy. (This will be important during an incident! Imagine you were a family member calling.) Can the provider support you by arranging travel for the families? Make sure to ask. Ask if your service provider has a mechanism for collecting family information and sharing it with you? Check with the provider if you have subscribed to any communications support. It might be necessary that your corporate communications department needs assistance with handling the media. Ask when the last time these were used and in what cases. Ensure whether the provider can assist with handling media calls. Ask them to explain the process of transferring information to your corporate communications team.

7 Year of Planning June June s Task: If you operate internationally, review current family assistance laws to ensure compliance. New laws, codes of conduct and official recommendation come into force every year. Establish whether your industry has clear guidelines regarding family assistance. Research the family assistance laws in the countries where you do business. Acquaint/reacquaint yourself with these laws and any newly released guidance on an annual basis to ensure your emergency planning is in line with legislation. Ensure you are in compliance with all current family assistance guidelines and laws. Failure to meet your obligations can lead to civil penalties including significant fines and loss of routes. If you operate in or out of the United States, review your filing with the US Department of Transportation. If the industry you re in does not have clear family assistance guidelines or laws, take steps to ensure your company can properly assist affected families should an incident occur. While the government may have responsibilities in some areas, your organization will be the face of the incident. The families will look to you for critical next steps. Areas to plan for include: How will you notify affected family members? What will your role be in search and recovery operations? How will you locate and determine the status of injured victims, who will also need information? Can you offer assistance in the identification of fatalities and the notification of their families? How will you provide crisis intervention, logistical support and services to victims and their family members? Can you set up a location for families to gather and/or means for non-travelling families to receive information on recovery efforts, identification procedures, the investigation and other areas of concern? Can you arrange for a memorial service, if desired by families? How will you provide for the return of personal effects? How will you maintain contact with victims and their families to provide continuous updates both at the crisis location and after families have returned home?

8 Year of Planning July July s Task: Review your insurance coverage. Meet with your broker and legal team to understand your liabilities and to discuss how you will work together during an incident. Review what liabilities you are insured for. Check liabilities against risk register to identify uninsured risks. Be deliberate and hold your team accountable for actually pulling out your insurance policies for review and meeting with your insurance company or broker to review. Discuss whether your insured amounts are accurate and up-to-date in reference to your current operations. Ascertain whether the legal costs you will incur following an accident for representation at official inquiries, inquests, accident investigations and criminal proceedings are insured. If they are insured, find out to what extent they are covered. Is this adequate or do other provisions need to be made? Discuss the relationship between you and your insurers through your respective lawyers. Insurers will control passenger/guest and third party liabilities, but to what extent will your organization have input into discussions? Does your insurer s control extend to public statements and the defense of its reputation as opposed to liability? Meet regularly with these partners so that you can fully understand each group s primary goals and how everyone can best work together in a crisis.

9 Year of Planning August August s Task: Check that your Emergency Response Plan (ERP) is compatible with other contingency plans. To ensure efficient decision-making and coordination, establish the necessary connections between your various departments. Review your ERP in conjunction with your other contingency plans. Other plans may include: Business Continuity Safety Security Environmental Financial Communications Legal Government Affairs Ascertain whether your ERP is consistent with these other plans. Define the roles of each department and individual that will be involved and explain how they work will together. Make sure the same duties and responsibilities are assigned to the same individuals/ organizational roles throughout all of your plans. Include other departments in your ERP exercises both with notice and without notice. Have internal or external lawyers ready, as they will be needed for consultation in relation to various aspects of implementation of the plans. Confirm that relevant parties are aware of the risks and measures to deal with the possibility of criminalization.

10 Year of Planning September September s Task: Hold a full-day, pre-notified input-response exercise, testing all aspects of crisis management and crisis communications. Conduct an after action review following the exercise and schedule follow up training immediately after to solve problems while they re top of mind. Establish the overall objectives and detailed aims of the full-day input-response crisis management simulation exercise. Earmark teams in the emergency response organization (including those in the Crisis Management Center and Crisis Communications Center) and relevant external agencies who will participate in the exercise. Select the Exercise Control (ExCon) staff, assign them the roles they will play and designate an ExCon Coordinator. Choose the initial exercise scenario and evolve it with a devil s advocate mindset. Divide the exercise into appropriate phases in accordance with the time available. Consider inserting a midway exercise time jump (of 48 to 60 hours) so that not only the initial golden hour period is played, but also follow-up initiatives and facilities. For example, the Incident Management Center and Family Assistance Center can be implemented/established. Write an Exercise Directive and ensure exercise participants receive it 7-10 days before exercise day. Ensure that a detailed program (with timings) for the exercise day is incorporated into the Exercise Directive. Write an Exercise Telephone Directory. Write the exercise film manuscript Main Input List (MIL) which contains all the detailed inputs and precise timings played by ExCon to exercise players. These can include official information, news headlines, and even social media posts that will prompt your team to make decisions. Distribute the Main Input List, any Paper Inputs and Exercise Telephone Directory only to the ExCon staff 48 hours before the ExCon briefing Hold an ExCon briefing 24 hours before exercise day. Distribute the Exercise Telephone Directory to all exercise players immediately before the start of the exercise. Incorporate a press conference in the exercise program (often done at the end). Carry out debriefings and subsequently collect written feedback from the exercising teams. Write and publish a post exercise report (PXR), which includes any detailed recommendations for improvement. Plan and carry out follow-up crisis management training as appropriate.

11 Year of Planning October October s Task: Include next year s crisis management and crisis communications audit and training and exercises in budget calculations. The annual audit of your Emergency Response Plan (ERP) includes a review of checklists, staff, equipment and suppliers. Account for supplies that need to be replenished early in the year. Following your internal audit, you may decide you that you need an outside expert to review or even rewrite your ERP. Consider this now before next year s budget is set. Don t forget to include the same considerations for your crisis communications plan does it need an audit? Does it need a rewrite? As you run quarterly or biannual tabletop exercises to familiarize your teams with your plan, a facilitator/trainer can be invaluable. Consider if you will use any external consultation during your tabletop and simulation exercises, and how many times per year you may require their support. Along with regularly scheduled exercises, keeping staff trained for the functional roles they ll fill in a crisis is a year-round consideration. Refresher training for existing staff and initial training for new staff are critical to building confidence in crisis management plans and effectiveness in emergency response. Check if your insurance offers a bursary to help cover training programs. Once you ve identified executive and technical spokespeople, plan initial and refresher training for on-camera interviews, how to handle aggressive questions, and other critical crisis communications techniques and skills. At least once per year, and preferably at least three months after an effective tabletop exercise, hold a no-notice input response exercise (also known as a simulation exercise) with your internal staff and community/industry partners. Consider the following potential costs: The services of a professional facilitator who can write you a scenario, guide you through it, ensure that you conduct a realistic exercise, and offer an objective after action review to ensure maximum learning from the experience. Are there costs to accessing and operating facilities during non-business hours? Will staff require overtime pay to participate? Will you bring in meals/refreshments as your teams participate in the exercise?

12 Year of Planning November November s Task: Hold training sessions to follow-up on lessons identified (lessons learned) in the input-response exercise. Pre-Exercise Activities Solicit executive support and involvement for the exercise and post-exercise activities. A climate of transparency and candor from the top down creates an optimal learning environment. Decide your own departmental goals for your exercise. Solicit goals from other departments that will be involved. Hold at least one planning meeting to align goals and responsibilities. Clearly map out your strategy for reaching your goals. Identify the people or persons responsible for monitoring the exercise. They should be aware of both the strategy and the goals. Their role will be to observe and take note, not direct. Multiple internal (from multiple departments) and external (from a partner organization involved in your exercise scenario) observers can provide multiple viewpoints. But don t go overboard two or three observers from different areas are more than enough. Identify timelines for post-exercise activities such as the debriefing schedule, written observation due dates, and final post-exercise report deadline and the people responsible for each activity. In-Exercise Activities Run your exercise as planned. Each participant should also take notes on what they do and observe in their own areas. This note-taking is secondary to whatever roles each person is fulfilling in the exercise, but participants should be aware they will be asked for their observations following the exercise. Post-Exercise Activities Start with a hot wash-up debriefing an immediate discussion with all involved parties to capture what worked and what could have gone better. This is also the best time to communicate who is responsible for follow-up duties and due dates for written observations. Following the initial hot wash-up, you may need additional structured debriefings. Based on the size and makeup of your group, you may choose to do this all with all participants at once, or let each department hold their own. Solicit written feedback from each exercise team / department with a clearly defined due date. Incorporate feedback into a detailed Post-Exercise Report (PXR) with appropriate recommendations for future exercises and any necessary training. Hold a briefing to discuss the PXR with departmental and executive leadership. Schedule dates for follow-up training based on lessons learned from the exercise and to train new staff that has joined your team since the exercise was conducted. With consideration for the planned training, schedule the next exercise so you have a clear timeline for when improvements should be implemented and training should be completed. Prior to your next exercise, hold a Before Action Review (BAR) to review the PXR from the last exercise and to set the strategy and goals for the upcoming exercise.

13 Year of Planning December December s Task: Exercise your Emergency Response Plan (ERP) with a no notice activation during off-hours to test systems, facilities and equipment. Review post exercise reports (PXR) from previously held ERP exercises and after action reports of any real world ERP activations. Plan the exercise around less obvious but inevitable scenarios: Conduct the exercise off regular working hours. Wake up your emergency response teams, catch them off guard and see how they respond. Set the scenario of your exercise days into the incident. Exercises tend to include the first days of the incident. Plan to test for the later days of an incident: day seven or day 14, for example. How will you rotate staff? How will you ensure regular business continuity? In your exercise, don t forget about past lessons learned. Purposefully include and test areas that were previously identified as needing improvement. Ensure you reserve time after the exercise to go over the results with your team: Make note of and discuss which aspects of your ERP performed well and which needed work. Highlight and elaborate on how your team handled their responsibilities throughout the exercise. Clarify and re-clarify until each participant has complete understanding of his or her role and responsibilities in the event of an incident. A note from Kenyon: Great job on a full year of crisis management planning. Preparing your team is important, and focusing on one area each month turns a big job into a manageable responsibility. By downloading these checklists each month and putting them to use, you ve taken an important step toward actively improving your crisis management planning and organization.