How the first hours after an incident can determine success or failure

Organisations regularly encounter events such as natural disasters, cyber attacks, data breaches or professional fraud. They test the mettle of the most experienced leadership teams. How then can senior managers best prepare for and manage catastrophic events such as these?

Last year, businesses, universities, hospitals and other organisations all over the world were subject to an attack on an unprecedented scale: the biggest ransomware attack ever witnessed. According to Europol, thousands of computers in 150 countries were infected by WannaCry, a software program that encrypted systems and demanded a ransom of several million euros for the release of employees' personal data.

Events such as these can potentially bring companies crashing down. The reactions of senior leaders and the organisation as a whole in the first few hours can determine the chances of a successful outcome whereby the company’s reputation and share price survive intact.

Organisations have always had periodic crises to deal with. The difference is that today’s social media and the 24-hour news cycle intensify the pressure on any company in the spotlight and mean that lines of communication must be kept open and well managed at all times.

Today’s social media and the 24-hour news cycle intensify the pressure on any company in the spotlight.

What concrete steps can senior leaders take to ensure their company can survive the most catastrophic events and, just possibly, emerge all the stronger?

First, build your crisis management team

Building a crisis team is a good start. The team should be ‘community’ based, representing stakeholders from the business, such as the CEO, heads of departments, the board of directors, human resources, and of course, media advisors.

Their role is to get to grips with the main areas of concern quickly and insightfully, and to ensure all employees are working as a single unit and that no one goes ‘off message’. They are the first responders to any emergency situation, and so should be fully aware of their roles from the start, and be at the ready to implement a crisis action plan.

Create – and test – your business continuity plan

Creating a business continuity plan is vital for any business looking to minimise the losses incurred by a forced cessation in trading or operation. The plan is essentially a response and recovery plan that assigns roles and responsibilities to people in key functions, allowing the company to stay operational in the face of massive disruption.

The plan will include a business impact analysis and risk assessment, two components needed to pinpoint the mission-critical functions and resources needed to maintain operations, as well as details of the internal and external threats, their likelihood of happening, and the possible damage they might cause. In this way, organisations can protect themselves from untold damage by being proactive in thinking the unthinkable.

Dieter van Mulders, Senior Executive Director at PageGroup’s Barcelona-based Shared Services Centre, explains, “A business continuity plan for a multifunctional organisation has three important dimensions to be considered and balanced against each other – or that should be in sync when creating your plan. These are: the criticality of the service; the time of interruption; and the investment you want to make to secure the service.”

A business continuity plan has three important dimensions: the criticality of the service; the time of interruption; and the investment you want to make to secure the service.

Dieter van Mulders, Senior Executive Director, PageGroup Shared Services Centre

He continues, “It can be a challenge to explain to an organisation or to a function that in the case of an emergency their department is not critical. For example, a finance organisation with 20 sub-processes and 110 people might need to cover only 4 sub-processes and can do that with 8 people. Only by bringing this focus to the table in advance can a manageable and successful business continuity plan be built.”

Testing the plan is also key to understanding and evaluating its effectiveness, helping to ensure all employees, both those included in the plan and those outside of core functions, are aware of their roles. Testing the plan helps to keep it as a dynamic ‘live’ document, which will be amended as risks to the business evolve, ensuring it remains relevant and timely.

Alongside this business continuity plan, building a PR plan will help to manage bad news in the immediate aftermath of an event.

Be prepared for a social media backlash 

The instinctive response to a PR disaster might be to close ranks and deny any responsibility. But ‘no comment’ is not an option. Senior leaders need to step up to the plate and take ownership. If they are at least willing to keep an open mind and commit resources to a full investigation, they can limit the damage and turn things around.

This is especially so in age when almost everyone carries a camera in their pocket and the world is full of witnesses. Organisations need to be sensitive to the power of social media, whereby bad news goes viral at the push of a button.

Organisations need to be sensitive to the power of social media, whereby bad news goes viral at the push of a button.

Last year, the United Airline’s stock price plunged after videos of a passenger being violently dragged off an overbooked plane circulated on the internet. It was only after an intense backlash and boycott threats that United belatedly took full responsibility. In the wake of this scandal, United's consumer perception rating dropped to a 10-year low.

Let’s not forget either that social media is not just a conduit for spreading the story about your company. It can become the story itself, if not treated with care.

In one recent ‘social media fail’, Virgin Trains in the UK came under fire for a patronising response on its Twitter account to a complaint from a female traveller. Similarly, last year Adidas tweeted “Congrats, you survived the Boston Marathon!”, which was widely perceived as insensitive in the light of the 2013 terrorist attack. Definitely not the impression that Adidas wanted to create!

So, once again, there needs to be a plan in place to proactively mitigate the risks that arise when employees take to social media and to manage any unexpected situations arising.

Key takeaways

• The reaction of senior leaders in the first few hours of a crisis can make or break corporate reputation
• It’s essential to form a crisis team in advance that can quickly spring into action when an incident occurs
• Organisations should be prepared to be accountable when it is clear the fault lies at their door
• Leaders should be sensitive to the intense pressure brought about by social media
• Planning should take into account negative publicity generated by employees using corporate social media channels

We hope you enjoyed reading this article, which is part of our ‘Executive Trends’ series where we explore the biggest challenges facing senior business leaders and executives today. The series is already in its 3rd edition, and you can access all previous articles by clicking here.