Failure to prepare is to prepare for failure. Nowhere is this more critical than in a crisis situation where a flawed response can have serious long-term consequences. But in a business environment where resources are stretched across multiple business objectives, crisis management preparation is often overlooked. Research by Gulland Padfield has highlighted that Institutions are ill-prepared to handle a crisis, even though a crisis is more likely than ever. This lack of preparation stems from misconceptions about the origins and nature of crises.
Most crises result from organisational failure. We tend to think of crises as very dramatic events with pictures of flaming oil rigs or market sell-offs beamed continuously onto our various screens. But the origins of crises are themselves usually mundane and are not based on any single breakdown. Most large failures, such as the Gulf of Mexico oil spill or crises such as the Global Financial Crisis, have multiple causes and these causes are deeply embedded in organizations. They have their roots in decisions that have been made over time; decisions about safety procedures, decisions about organisational structure, decisions about risk management, decisions about management priorities. For firms in the financial sector, recent crises have come from trust, governance and performance failures, not business disruption issues.
As activity migrates to digital platforms, Financial Services firms have become increasingly vulnerable. Cyber-attacks are continuous and evolving. Many Private Banks and Wealth Firms only test specific areas of crisis management using Business Continuity Plans or Disaster Recovery plans; but these are simply a set of responses to pre-defined risks and threats, whereas a crisis is an abnormal, unstable and complex situation. With the rise of social media, the real time news cycle and mobile technology, today’s crises play out at incredible speeds and they cannot be managed using a business disruption framework. Research from 2013* showed 28% of all crises had spread to international media within 1 hour and 69% had spread within 24 hours. This is now undoubtedly even quicker and demands the development of a crisis management capability that will prepare an organisation to deal with complex situations where:
- decisions are often least-worst choices
- activity takes place in an environment of intense pressure and scrutiny
- there may be little information, some or all of which may be ambiguous, unreliable, unverifiable or wrong
- organisational risk is at its highest
Companies that respond well during a crisis can see their shares rise. Once the initial economic impact has been calculated, shareholders look to the management response to determine if the right people are in place to lead the organisation. In effect, a crisis offers an opportunity for management to demonstrate their talent in dealing with difficult circumstances.
As well as developing crisis management capabilities, organisations need to ensure their procedures are comprehensively tested. The best way to do this is using an ‘as-live’ scenario approach that can diagnose and identify strengths and weaknesses in an institution’s policies and operational flexibility. This cross-functional approach allows for testing of the responses of the whole crisis team as well as external partners. There is no perfect response to a crisis, but evidence of effective planning will help avoid the risk materialising, and mitigate any consequent regulatory action and reputational fallout.
* https://www.freshfields.com/globalassets/campaign-landing/cyber-security/containing-a-crisis.pdf
