Developing and testing crisis management plans to respond effectively to unexpected events

Start by understanding your core functions  

Your crisis management plan should begin with understanding your core operations: What is the business? What is your value offering? What must you do to keep your lights on?

This applies regardless of size or sector. Whether you’re a government agency, a not-for-profit, or a private enterprise, every organisation has functions, processes and services that enable it to deliver value. Understanding how these fit together provides the foundation for effective crisis planning.

By understanding how your organisation operates, you can identify the dependencies, resources and capabilities that support business continuity when disruption occurs.

That is your starting point. 

Define what is critical

Once you understand how your organisation operates, the next step is determining what elements are essential. This is where organisations must separate the must-haves from the nice-to-haves. While all functions are important, not all are critical.  

Distinguishing between critical and non-critical functions can be one of the most challenging aspects of crisis planning. However, it is essential to know what functions are critical during a crisis, when resources are limited and difficult decisions need to be made.

For example, frontline service delivery may take priority over administrative functions. In a crisis, you may need to divert resources to ensure frontline staff can continue delivering essential services while temporarily scaling back less time-sensitive activities.

Pre-emptively identifying these critical functions enables you to prioritise resources effectively and respond decisively during a disruption.

Test your plan: break your business on purpose

Technology outages, natural disasters, and operational disruptions can happen at any time without warning.  

A business impact analysis is a toolset that enables you to identify and record the components of your business that are critical to organisational survival and how long your business can operate without them. The amount of time your business can survive without delivering critical functions is referred to as a ‘maximum allowable outage’.

Once you’ve got your core functions worked out, you can test your crisis management plan. The most common form of testing begins with scenario testing.  

Your scenario has a goal to ‘break the business’ (but not for real). In other words, it works out whether the plans you have in place will enable your business to run effectively in a crisis situation.

Not every disruption is a crisis. Many events begin as interruptions before escalating. What makes it a crisis depends on your core functions and the extent to which they’re affected.  

That is why it’s important to work out your ‘maximum allowable outages’, to identify your core functions’ thresholds.  

Some crises escalate rapidly, while some can be more of a slow burn, building over time. They can start off as an interruption to your business that escalates into a crisis. Having these clearly defined thresholds and response triggers is critical.

These tests are often done as desktop exercises before progressing to more complex simulations and walk through testing in real time. This type of testing also helps people understand their roles during a crisis. 

Plan beyond the immediate response  

A crisis management plan isn’t one single document. Good crisis management extends well past the initial response, including elements of communication, recovery and transition. Clear roles, decision-making processes and communication channels that help to maintain trust and keep stakeholders informed.

But returning to business as usual can take time. In many cases, businesses may not return to the same state they were in before the crisis. It could be operating ‘business as usual’ but from a new location. Recovery may involve rebuilding systems, redefining processes or adapting your operating model to suit new ways of working.

Your strategy for what happens after the crisis matters, so make sure your planning includes time to consider these elements. 

The value of planning and testing before a disaster strikes

The number of businesses that fail to recover from a disaster is significant. A National Australia Bank SME Bushfire Impact Survey (2020) found around two-thirds of SMEs were directly or indirectly impacted by the Black Summer bushfires, with 17% forced to close temporarily, and over 7% reporting significant long-term impacts.

There is consistent research across government, industry and insurers showing that businesses with tested plans recover faster and are far more likely to survive major disruptions. But according to the Australian Small Business and Family Enterprise Ombudsman (ASBFEO), only one in four small businesses has a disaster plan. ASBFEO also reported that recovery from disasters can take a heavy toll, with many businesses closing permanently due to long recovery times and financial strain.

Not only can plans help businesses recover and survive, but effective crisis management can also create a competitive advantage. It is possible that your business survives a crisis and continues to serve where your competitors can’t.

During the 2005 Buncefield oil storage facility fire in the UK, a neighbouring IT services company, Northgate Information Solutions, lost its entire premises and infrastructure right before Christmas. This was the peak of its finance and payroll processing period. Executing their crisis and continuity plan, they quickly stood up temporary data centres at different sites. They activated reciprocal arrangements with clients to keep operating, and 60 new contracts were signed within six weeks of the disaster.

Not only did the company survive the incident, but its response also increased market confidence, and its share price rose. Northgate won an award for most effective recovery in 2006. By 2013 Northgate was sold to Capita for $130m.

This is just one example of flipping a major disruption into a competitive advantage.

Engage an expert

There is no one-size-fits-all approach to crisis management. It depends on the size, industry, and the needs of your organisation. What you would use for a small business is going to be very different to the requirements of a larger business and bulti-national organisations.  

Some organisations may require complex, multi-layered plans, while others may benefit from a single, integrated resilience plan. We tailor our approach to each organisation’s unique risk profile, operational structure and regulatory environment.

It is about what works for you.

Developing and testing crisis management plans requires a deep understanding of governance, operations and risk. RSM brings together expertise across these areas to help organisations:

• identify critical business functions
• assess vulnerabilities and dependencies
• develop tailored crisis and continuity plans
• design and deliver realistic testing scenarios
• strengthen communication and recovery strategies. 

Essentially, if you don’t understand what you must do versus the ‘nice to do’, you can get drowned out in the noise.

With the right planning and testing in place, your organisation can cut through that noise, respond with confidence, and emerge stronger from disruption.