Crisis Management Who s In Charge?

Transcription

1 Crisis Management Who s In Charge? Presented by: Cynthia Simeone, CBCP, PMP Satori Consulting Judith Walker, PMP Goldman Sachs Crisis Management What is Crisis Management? Crisis Management involves identifying a crisis, planning a response to the crisis and confronting and resolving the crisis. 1

2 The overall coordination of an organization's response to a crisis, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization's profitability, reputation, or ability to operate. AND making sure people are safe Crisis Management The application of foresight, judgment and leadership: Foresight to plan for a crisis; Judgment to establish sound risk mitigation and recovery solutions; Leadership to enable teams to perform during a crisis. - Cynthia Simeone, Satori Consulting Crisis Activities Buildings Account for people Transportation Recovery sites Technology What s happened? People safety Firm leadership Communications Utilities 2

3 Who s in Charge? The historical view of crisis management ownership Owner Technologists CIO CEO Audit Unit Heads Security Dir. of BC Enterprise Risk Officer Influencers Technology Finance Process Safety Regulators Corporate Integration OCC/FFIEC 50 s & 60 S 1970 s & 80 s 1990 s now Significant Events Mainframe Client/Server Technologies HIPPA/ JCAHO NFPA 1600 G-L-B Act 9/11/2001 SOX SEC/ NYSE NASD Rulings Economic Globalization Delivery Model Focus Disaster Recovery Alternate-Site Data Storage Centralized Disaster Recovery Hot-Site Recovery Decentralized Continuity Centralized Matrixed Other Key Stakeholders/Influencers OHS OEM Cross industry, cross organizational, cross agency interdependencies Environmental/Nontechnical threats impacting the human component of crisis recovery Regional impacts Shareholder expectation competitive advantage Why Should You Care about Managing a Crisis? 3

4 How do Organizations Successfully Manage a Crisis? Provide a framework for groups to work together by identifying Governance Structure Decision Matrix and Clear Escalation Point Definitions Focus on Primary Components: Command and Control Communications People Accountability Recovery Have a Plan How Can you Apply this to Your Company? Recommendation for Organizational Crisis Management Definition 1. Assess Current Organization Governance Model by developing a Responsibility Assignment Matrix Map 2. Define desired chain of command criteria for your organization 3. Perform Command Gap Analysis (current versus desired) 4. Develop Governance Guidelines to meet your organization s command criteria 5. Develop Benchmarking Matrix 6. Implement Revised Governance Model Responsibility Assignment Matrix Map LEGEND R = Responsible A = Accountable S = Supportive C = Consulted I = Informed Responsibility Executive Office Assignment Matrix Scope/Strategy Risk Assessment Continuity Security / Enterprise Risk Finance Communications Audit Unit Technology Steering Facilities Committee BIA Emergency Response/ Operations Risk Evaluation/ And Control Maintenance Exercising, Continuous Improvement 4

5 Define Desired Chain of Command Criteria for Your Organization Develop an information/communication workflow diagram Common Roles Frameworks for Communication Determine organizational drivers and influencers Identify communication interdependencies and intersections Desired Chain of Command Level 1 Crisis Command Center Incident Response Team Level 2 Division A Division B Division C Level 3 Department 1 Department 2 Department 3 Department 4 Department 5 Department 6 Crisis Command Center a.k.a Emergency Management Team The War Room Where Strategic Decisions are Made Central Point for ALL Public Interaction Including - Public Emergency Responders (police, fire, etc.) - Media - Shareholders Manage Response and Recovery 5

6 INCIDENT RESPONSE TEAM (IRT) Senior tactical representatives from each key response division who link-up to: Establish impact/disruption Coordinate response and recovery Account for people Incident Response Team Activities by Division Security What s happened? Facilities Building Technology/ BCP Technology HR Account for people /Ops/ Exec Office Firm leadership People safety Utilities Recovery sites Account for people Transportation Recovery sites Communications (Internally focused) / Corporate Communications (Externally focused) Develop Governance Guidelines Define Roles and Responsibilities Define Levels of Authority Identify Escalation Point Criteria 6

7 Internal activity / requirements H M Tactical IRT Strategic CCC L M H External / Organizational Consequence (financial / reputation health) Achieving the Objectives METHODS AND IMPACT Command and Control Communication People Accountability Tech Recovery 1 Drills/tests Notification tests, micro-drills, table-top exercises and full drills. Must be held regularly to be effective. Forces attention on Crisis management improvement. 2 Incident/nearmiss learning Implement process to consistently capture and action lessons from real incidents and near misses. Our experiences + other companies. 3 New crisis tools Build tools to support technology recovery. This could include tools which help with rapidly gathering impact information or tracking our recovery status 4 Benchmarking Develop a scoring method to benchmark Technology crisis management against the rest of the firm and to show progress over time 5 Training General training covering Crisis Management fundamentals plus Technology specific information TARGETING THE METHODS Incident/nearmiss Drills/Tests New crisis tools Benchmarking Training learning Senior management Critical groups All employees Implement Revised Governance Model How do you tell the CEO that s/he s not in charge in a crisis? Before you begin define and socialize your value proposition Use standard organizational Change Management practices and principles Define Roles and Responsibilities Hold one-on-one meetings with executives Facilitate frequent drills to create a synergistic environment of support and common goals Keep lines of communication open the primary key to success! 7

8 Ready to Practice? Drill Simulation Exercise The theory for how a large crisis would unfold Emergency Response & Evaluation Escalation & Disaster Declaration Divisional Notification Activation of Recovery Crisis Event INCIDENT RESPONSE TEAM (IRT) Security EMERGENCY MANAGEMENT TEAM () C-Suite Divisional s/ Command Centers Division Divisional Units Units HR BCP Corp Comms Technology Facilities Senior Management Technology Divisional Divisional Units Units Scenario Who needs to be involved in this situation? Who should be in charge in this situation? Why? Why not [name another option]. 8

9 Parting Thoughts... CRISIS MANAGEMENT CRISIS LEADERSHIP Reactionary Short-term progress Narrow Focus Tactical -- implement Versus Anticipatory Long term strategy & principles Wide focus Strategic envision The Presenters Cynthia Simeone is a Management Consultant with Satori Consulting. She can be reached for further comment and information at csimeone@satoriconsulting.com Judith Walker is a Vice President in the Continuity Program Office at Goldman Sachs. She can be reached at judith.walker@goldmansachs.com 9