successfully managing emergency operations in a distributed environment

Emergency Notifi cation • Incident Management

Successfully Managing

Emergency Operations in a

Distributed Organization

Deriving value from the distributed nature of the organization while reducing the apparent threats

Karen Dye Oakley and Malcolm Hafner

Successfully Managing Emergency Operations in a Distributed Organization

www.missionmode.com

About the Authors

Karen Dye Oakley is the former Director of Global Crisis Manage-ment at Sun Microsystems. She is a well-respected authority and presenter on business continuity and crisis management. Karen is a CBCP and MBCI, as well as a Busi-ness Continuity Maturity Model® (BCMM) assessor. She has taken a global organization from a BCMM maturity of 2.8 to 4.5 (out of a pos-sible 6). As an independent consul-tant, Karen continues to improve the resilience of organizations she works with.

Malcolm Hafner is the President and CEO of MissionMode Solutions.

Table of Contents

1. Introduction

2. Sell the Program

3. Organize Yourself

4. Program Flexibility

5. Think Globally, Act Locally

6. Make a Crisis Mundane

7. Plans are Useless, but Planning is Indispensible

Introduction

Most organizations are diverse—by location, function, culture, dis-ciplines, expertise, time zone, market and product. During normal business operations these groups work together well because the in-terfaces are well defi ned and have workfl ow in place to transfer work product. Yet, when an emergency strikes, the speed of the event and the chaos it causes to normal, well-defi ned operations take their toll.

Most organizations treat a crisis as a series of tactical issues aff ect-ing operational silos rather than reviewing the needs of the crisis response at the organizational and strategic level. Trying to fi t a crisis response into existing organizational boundaries and operations is like the old adage of banging a square peg into a round hole.

Unfortunately, many professionals in the business continuity crisis management industry have a silo mentality. They incorrectly look at crisis management as a tactical rather than strategic endeavor. This is true not only for the response, but the whole crisis management process.

Unless there is a strategic view of crisis management across the whole organization, failures will occur when crises happen.

Regulatory, compliance or performance reasons are making organiza-tions more procedural, operating within silos. This is a continuing trend that can aff ect the core resiliency of the enterprise. It’s only likely to get worse.

Yet organizations need to become more resilient. Stakeholders de-mand it. People naturally operate more in their silos yet eff ective crisis management relies on the open and speedy exchange of knowl-edge, information and decisions.

The prevailing att itude often is “This is my role and I won’t go out-side it”. To integrate the members of your team, you need to break down the silos.

Take the above problems and multiply them by ten to understand the scale of the problem for distributed organizations. They are diverse by their very nature. The trick for distributed organizations is to re-duce the downside of being distributed and increase the benefi t.

Being distributed and diverse should make the organization more resilient. There are fewer single points of failure.

However, complexities tend to take control; often it’s a lack of strate-gic thought beforehand, and communications during a crisis, which hold organizations back. Today, more than ever, resiliency is a basic requirement.

A strategic view of crisis management is a key component of a resil-ient organization. To become a resilient organization, several keys steps are required. These steps form the basis of this paper.© Copyright 2010-2012, MissionMode Solutions


www.missionmode.com

Employees... need to know what’s in it for them and their customers.

Having a high-level champion is key.

You need to speak their language, put everything in context of what’s in it for them, and make them aware of the consequences of not getting with the program.

Sell the Program

The fact that crises are happening more often in today’s chaotic world is a double-edged sword. On the one hand the business is more under threat. On the other hand people recognize that bad stuff happens; there’s an openness to change. However, it is still true that everyone needs to see the benefi t.

Employees, for instance, need to know what’s in it for them and their customers. This should be communicated to suit the culture of the organization. It has been expressed as succinctly as: “If you want the company to survive so that it can employ you tomorrow, you need to get on the program today!”, through to more subtle callings on people’s benevolent nature.

Having a high-level champion is key. The CEO, COO or CFO are the obvious targets. Each has something critical to lose if the busi-ness suff ers an economic or reputational event. You’ll also get a good understanding of their risk tolerance and can adapt the strategic view of crisis management to fi t.

With a litt le bit of investigation there are always events that have tak-en the company, or others in the market, to the brink. Find those and use them as cases of what might happen. Fortunately compliance, enterprise risk management (ERM) and corporate social responsibility (CSR) are C-level topics.

Understand how they’ll aff ect your organization and you’ll be well on your way to addressing a key concern at the top of the corporate pyra-mid.

Beyond the C-suite are a host of “infl uencers” that guide strategy and direction within the company. Is your company a sales-led company, a marketing-led company or a product-led company?

Find the answer to that question and you’ll know who the infl uenc-ers are. These folk need to be working with you to sell the program. They also have a lot to lose if they’re not resilient—they consider themselves to be the lifeblood of the company.

But how do you reach out to all levels of the business? When you sell your crisis management program to your employees, you need to communicate how they and their departments will benefi t. Other-wise you could get resistance to get involved for a variety of reasons including: “it’s yet another task”, “it will never happen”, “what’s in it for me?”

You need to speak their language, put everything in context of what’s in it for them, and make them aware of the consequences of not get-ting with the program.


www.missionmode.com

The daily operational structure of the organization is unlikely to be suited to crisis management.

Key to creating an effective crisis management team are the roles that need to be filled.

When they get aff ected, they pay att ention. And it needn’t be the once in a lifetime scenario.

More and more organizations are being aff ected by smaller more fre-quent crises; supply chain malfunctions are a good example.

Sometimes people are only convinced when they see your passion. Traveling to the location to convince people is likely to be more suc-cessful. This removes the “lecturing from head offi ce” syndrome that often aff ects the success of centrally defi ned initiatives.

Organize Yourself

There are some basics that need to be clearly understood here. This is why a strategic view is so important.

The daily operational structure of the organization is unlikely to be suited to crisis management. As mentioned before, operating in silos causes problems. The speed at which an organization needs to share information disrupts the normal communication channels and inter-faces. Priorities also change.

In a hi-tech manufacturing company, the product group might nor-mally be king. In a crisis, the customer support team is more likely to be king.

In a fi nancial services organization, traders might normally be king. In a crisis, ensuring liquidity is king. In a government regulator, regulation is king. In a crisis, ensuring survival of the marketplace it regulates is king.

So, to ensure the best results from a crisis response a diff erent struc-ture and process is required. This is likely to cut across existing departmental boundaries and functions.

Never mind. This is good news. As you exercise and familiarize the team you’ll fi nd that they create new relationships and improve the way they work on at a normal operational level.

Key to creating an eff ective crisis management team are the roles that need to be fi lled during a crisis. Defi ne the roles and not the people.

Unfortunately, instead of choosing team members for their ability to fulfi ll specifi c roles at time of disaster, crisis managers often choose individuals who embody certain qualities, such as organizational skills.

Your team is comprised of individuals, and their roles are what they do. Your CEO might be bett er suited to a role which interacts with the media rather than sifts through the detail of a crisis. The CEO might not even be the right person in the crisis team at all!


www.missionmode.com

The crisis management program needs to be flexible to suit the local conditions where the crisis is to be managed from.

A distributed organization is helped here. You may well have many similar functions delivered around the world by diff erent people. Some of these people are well suited to the roles in a crisis and should be used shamelessly for that purpose.

Being able to respond in diff erent time zones also provides a signifi -cant advantage.

Distributed or not, building a matrix of roles and resources is very useful and will provide you with fl exibility to react whatever the circumstances.

The result of this work should be a crisis management organization which has a defi ned set of roles and resources and is fl exible to meet the short and intense challenges that a crisis provides.

Program Flexibility

Having a good plan in place to suit local circumstances is key. As much pre-thinking that can be done should be incorporated into the plan. This is particularly true for the fi rst few hours where time is precious, information is often poor, and consequences of actions can be huge.

To work, the crisis management program needs to be fl exible to suit the local conditions where the crisis is to be managed from. Processes that will work in North America might not be eff ective in other loca-tions.

The operational heads of each territory need to have sway over how the plans are locally implemented. It may well be that in a smaller territory some roles need to be fi lled by the same person.


www.missionmode.com

When developing the plans, think about the culture and location of those affected.

Having open and flexible channels of communication will allow your crisis team to be similarly flexible.

Think also about redundancy of people, roles and operations around your sites. These resources could be made available for the division suff ering the crisis.

At the end of the day it is the operational division that is responsible for its resilience. From a strategic viewpoint, the saying “Think glob-ally, act locally” is very true.

The crisis plans are critical. Producing fl exible impact-based plans rather than a multitude of cause based plans helps.

If the impact of an incident is that your site is not operational, it doesn’t matt er whether it was caused by a fi re, fl ood, earthquake or terrorism, you don’t have a site and that’s the issue that needs addressing.

When developing the plans, think about the culture and location of those aff ected.

For instance, in the operations division of an aviation company pro-cesses are highly proceduralized and people work best in this way (that is an aptitude for which they are recruited).

However, in the corporate communications group of the same compa-ny having a plan that is very process driven would be inappropriate and counterproductive.

Also, there are perfectly adequate plans that fi t on one sheet of paper and are not much more than a meeting agenda. This works well if the crisis teams are well practiced and the company has a culture of rapid response.

In order to be fl exible, it is important to be able to communicate freely to those that need to know what’s happening. Being dynamic dur-ing a crisis can make you take control of the crisis rather than forever behind it.

Having open and fl exible channels of communication will allow your crisis team to be similarly fl exible. In a distributed organization there is a need to adopt technology suited to urgent communications.

Escalation should be fl exible and communication between teams is of paramount importance.

Finally, having the fl exibility for the crisis team to make decisions outside the scope of the plan is crucial. There are cases where slavish adherence to a plan has caused more harm than good.

You selected the people for the roles with care, now you need to trust them to make the right decisions.


www.missionmode.com

Being able to anticipate require-ments across the globe is a huge advantage in a crisis response.

You need to define a list of critical sites that are crucial to the short-term value of the organization.

Think Globally, Act Locally

When a disaster strikes, all company employees and ancillary staff need to know their roles, no matt er where they’re located. It is essen-tial to inform those employees who will have no role to play, and are therefore not part of the team.

In one sense, everyone has a role to play, even if it is just pointing media requests to the correct person.

As mentioned before, each location must have the ability to act in-dependently for things that solely aff ect it. However, these actions must be put in a global context. Crisis teams trying to manage issues locally that should have been escalated have exacerbated the impact of many crises.

There are many reasons for this, including over-optimism and a cul-ture of fear. Only when it is patently clear that the crisis is out of con-trol is the problem escalated. Keeping management and peers around the globe informed of what is happening is good way of managing escalation.

They are often the best judges of when to escalate since they tend to be more objective than those close to the crisis. Having clear escala-tion criteria helps, as does distributed communications.

Allied to this is the fact that those elsewhere in the organization can provide additional resources unknown to the crisis team.

Being able to anticipate requirements across the globe is a huge ad-vantage in a crisis response. Having a communication platform to be able to do this makes the job much easier and in reach of most organi-zations. Do this well and you’re taking advantage of the distributed nature of the organization.

First, though, you need to put some priority on diff erent locations and assets. You need to defi ne a list of critical sites that are crucial to the short-term value of the organization. These are the ones that you’ll fi nd it hard to recover from an incident.

Once defi ned, you can assess their state of readiness by employing something like the Business Continuity Maturity Model (BCMM®) to defi ne strengths and weaknesses. You can use this measurement to defi ne the priority and actions necessary for the crisis management deployment.

Make a Crisis Mundane

A crisis by defi nition is unusual. What would be a crisis to one organi-zation might be daily operations for another organization. It depends on the market, the culture and the location where the organization operates.


www.missionmode.com

An oil company operating off shore is likely to have more incidents than an onshore company. However, operating off shore equips orga-nizations more eff ectively because issues happen more frequently.

Also, it doesn’t take much insight to see why the UK has a mature business continuity industry—it has had terrorism related events since the 1970’s. So one would hope that UK companies would be bett er-prepared than others that have not had these events.

Just because a crisis is unusual doesn’t mean that an organization should be unprepared. Many organizations prepare with exercises. This should be an important part of the crisis management implemen-tation.

Remember, you test the plan and exercise the people. People don’t fail during exercises, plans do.

Make sure your exercises are reasonable tests and test reasonable things. There is no point in testing something that doesn’t stretch the organization in some way.

An obvious thing to test is the fl ow of information and communica-tions through the crisis management structure rather than the organi-zational silos. Or, test “follow the Sun” crisis responses so you know how the plans work when tasks are handed over from time zone to time zone.

Another way of working successfully is to use your crisis manage-ment system’s automated tools for daily operations. This makes the tools familiar to those that need to use them during a crisis.

For example, corporate security could use the tool as a daily incident log. This has the added benefi t of keeping an audit log where a real crisis or incident would fi rst be reported. Information already cap-tured can be used in the fi rst few minutes of the crisis.

One benefi t of the various pandemic concerns has been the ability of organizations to rehearse in slow time how they would react to a crisis. Use this to fi nd out what would work and what would break if a crisis hit which needs a reaction a hundred times faster than a pan-demic. How would you cope? What would you do things diff erently?

Plans are Useless, But Planning is Indispensible

The history of business continuity and crisis management is litt ered with examples of organizations being content with producing plans. As Dwight D. Eisenhower said, “In preparing for batt le, plans are use-less but planning is indispensable.”

What’s important is the discipline of planning, and thinking about the possibilities. Then, exercising them to assure yourself.

Remember, you test the plan and exercise the people.

Another way of working successful-ly is to use your crisis management system’s automated tools for daily operations.


www.missionmode.com

But when the batt le commences, plans don’t last long, but the prepa-ration and discipline do. In the corporate context the discipline of planning and exercising is crucial to make the crisis team able to handle just about any situation.

The distributed organization can pose additional problems. However, with preparation and automated tools to manage communication across the organization, it can take advantage of in-built redundancy of operations and geographic spread.

Do this well, and your organization will be internally resilient.

Beyond the boundaries of your organization is the extended enter-prise. Reaching out into customers, suppliers and partners to collabo-rate during a crisis should be the next phase. This can add another dimension to complexity, maturity and resilience.

101512

MissionMode’s web-based emergency notifi cation and incident manage-ment solutions simplify your response to any type of incident, from routine operational issues to major disasters. They reduce the time and cost of returning to normal business operations.

Incident Management Simplifi edThe Situation Center™ provides the tools to remedy the incident better and faster. This simple-to-use virtual command center enables your team to share information, monitor tasks, track people’s status, send alerts, access any type of fi le, and more. It provides an accurate common operating picture for making informed decisions and ensuring that no detail is overlooked.

Smarter Emergency Notifi cationThe Notifi cation Center™ eliminates the guesswork of what message to send, who to contact and how. Customized automation adapts to constantly changing situations, yet the system is so easy to use that accurate, targeted alerts can be sent in as little as ten seconds.”

Revolutionary Mobile CommunicationsEarShot goes far beyond ordinary notifi cation. It enables rich 2-way communication using forms, photos, text, profi les and GPS location services. EarShot combines a unique mobile app with an online control console and complete emergency notifi cation system.

This white paper is brought to you by

Contact us to learn more or schedule a demonstration

[email protected]

www.missionmode.com

North America

Toll-free: 877.833.7763

Phone: +1 312.445.8811

International

Phone: +44 1494 837198

“With MissionMode, we feel like we are their only customer.”Director of Corporate Crisis Management

Crises are diffi cult. Crisis management software shouldn’t be.