crisis audit
Crisis Prevention: Vulnerability and Risk Management
Animals comprehend their vulnerability. Vertebrates have a dorsal and ventral side. Our dorsal sides are our backs — from the Latin dorsum. Our ventral sides are our bellies. Unshielded, our bellies are one of the weakest points on a vertebrate animal.
Dogs showing submission roll onto their backs, displaying their belly to the dominant dog. Armadillos must roll into a ball to protect their vulnerable underside. Every animal species understands its vulnerable side and how to protect it.
What is your vulnerability?
Every business entity has a vulnerable side too. Learning how to protect your business by assessing risks and managing vulnerabilities is a wise investment. If you do not assess risks and discover your vulnerabilities, you stand the potential to be ripped apart by unforeseen consequences.How do you assess risk?
Assessing risk requires a systems approach and perhaps outside experts. There are professionals (such as our firm) who will help assess your risks. Experts from every area: financial, HR, IT, physical plant and electrical are all good to help assess your risk and propose safety measures to prevent loss. CPAs can assess your financial systems and identify weaknesses in your management of assets, both property assets and money. Human Relations consultants can help you by conducting background checks of potential employees. You can call on the fire department to assess your warehouse or office or storefront to protect you from fire threat. IT consultants can examine your ability to back up and secure vital information. You may be a business with sales of $50 million a year or one with sales of $50,000 a year, but each is vulnerable. Physical / premises weaknesses, human / employee weaknesses, financial / information vulnerabilities, and reputation / public relations vulnerabilities are present in every business. Finding yours, making a plan and mitigating risk is crucial in order to be a mature business. Of course, there are many businesses who never undertake risk assessment. And they never have a threat or loss. And there are just as many caught unawares whose companies disappear overnight when the unthinkable happens. Do not hide from the opportunity to plan. In the Carolinas, we live with the seasonal threat of hurricanes. Have you assessed your ability to weather a category five or lesser storm? Have you made sure you have all your IT systems backed up in the cloud? Are all your paper files stored above the one hundred year flood height? Do you have an emergency alert and notification system in place to inform your employees not to report to work in the advent of a storm? How will you notify them to return to work you are able to resume operations? Do you have business interruption insurance? We could go on and list multiple areas to examine. Accept that every component of your business is vulnerable to loss, interruption of business, damage, or absolute breakdown. Now the question becomes, “What does it take for me to get back up and running?” Involve every employee and manager in making an outline of what is essential and critical in order for them to work. Depending on your product or services, you may be able to all work remotely. If you are a manufacturer or hard-goods producer, you will need to outline how to get back into operation. This requires that you have agreements with vendors from outside our geographical area lined up to provide materials, support and services to help you get back up and running. While you may object to going to these lengths now to assess risks and plan for interruption and recovery, planning now will save you money, time and ultimately your business.Crisis Preparation: A checklist of advance planning steps
How can an organization prepare in advance for a crisis?
In all of life we know that advance preparation makes reality far easier. No one would ever contemplate singing the National Anthem in front of thousands without practicing it. Over and over. And getting coaching. Crisis survival and your business or organization’s future depend upon your work in advance of a disaster.Our steps for crisis preparation.
- Audit for most probable crisis situations and vulnerabilities: from accidental business interruptions to product recalls to tragedy or HR issues in the workplace.
- Create a crisis communications plan: Make certain that your plan takes into consideration and lays out strategies and tactics covering the following critical items.
- Who will manage the crisis?
- How will the team respond?
- What will they communicate?
- When will they communicate it?
- Why will they communicate?
- Who will be the communicator?
- When will subject matter experts be used?
- When will outside auditors be used?
- Draft basic responses (and keep on the ‘shelf’) for each of the crisis situations. In every business or industry there are some highly likely situations. Make sure your plan considers and contemplates responses to those most common.
- Daycare example: Staff member abusing a child
- Restaurant: Food poisoning
- Data breach
- Establish a crisis communications team. There is no time in a crisis to figure out who is part of the team. Choose your team and make sure everyone is up to date with contact information for each member. Clarify where you’ll meet: online, in-person, at an ops center.
- Identify members and make sure they are aware they are part of the team
- Compile team contact information and make certain that all team members have this on hand and readily available
- Keep this updated (at least every 3 months)
- Establish a manner of communication; in person / face to face or remote (conference call and shared online document creation)
- Establish a location of gathering and ensuring all communications tools are present (from wifi to laptops, tablets, or if remote team members, creating permission based network accessible documents, ensuring conference calling / networking capacities are up to date and available)
- Outline roles for each member
- Make sure crisis communications team has bios/backgrounders on all company leaders and specifics
- Identify Subject Matter Experts who will assist the crisis communications team
- Drill. Firemen, police and EMTs drill. So should your firm. If you don’t practice, how will you know if your team is ready to manage a situation? How will you know if your carefully planned procedures will work? Don’t take this part for granted. Test it with a drill.
- Proactively provide information via the firm’s website about issues likely to be of concern in a crisis. Evidence makes the difference in the courtroom and in the courtroom of public opinion. If you have compliance requirements, demonstrate before a crisis situation that your firm had done all in it’s power to be in compliance and remain there. Having this information publically visible on your website helps develop trust and transparency. As examples:
- Daycare: Publish credentials and compliance information
- Restaurant: Publish inspection reports and staff who have completed Servsafe courses for example.
- Establish social media accounts on appropriate social media channels and monitor across all social media for firm, CEOs, and brand mentions
- Create Twitter / media lists and follow local / beat media likely to report on your industry
- Get to know (in person if appropriate) media most likely to report on a crisis in your industry. The media are doing their jobs. Not trying to trap you. If they know you and your firm in advance, they will not be strangers to you. Though don’t confuse getting to know them with trying to sway them. There is a huge difference. Understand that they have readers and viewers who want facts. And if they can’t get the facts, they will publish what people are talking about. And we all know that when people don’t have information they talk trash. Don’t let the media publish rumors and trash. Get them the facts when they ask.
- Have Google Alerts (real time) for your brand/leaders. Don’t let a crisis sneak up on you. Believe me, the media are monitoring media for stories and grumbles. If they are listening, you better be.