Preparing for a crisis

Gavin Wilson M.Sc underlines the importance of having pre-defined emergency and business continuity plans in the event of a crisis

Explanations of crisis can often differ, although the meaning usually remains the same. A good definition that seems to have been quoted many times is suggested by Rosenthal et al (1989) as “A serious threat to the basic structures or fundamental values and norms of an organisation, which – under time pressure and highly uncertain circumstances – necessitates making vital decisions”. In this context the management of any crisis must necessitate the ability to make quick decisions that are essential in mitigating the impacts of the event. A phase often quoted within the crisis management arena is: “Making a bad decision during a crisis is better than making no decision at all”. This is certainly true, but the consequences of bad decisions are also far reaching and certainly not desirable. Decisions need to be made and actions need to be acted upon. During a crisis the time to debate, test and exercise a decision to make sure that the right courses of action are effectuated is more often than not available. Time is after all a luxury in most circumstances, let alone during a crisis.
Failing to plan for crisis is a fundamental failing of any organisation in today’s world. Although globalisation offers a multitude of opportunities and benefits, it also presents a myriad of risks that need to be carefully considered and planned for. Fortunately, most organisations that operate widely know this and have at least considered the basics in emergency and crisis preparedness. However, a question to ask is: are our traditional methods of managing crisis still relevant in the present day where these events seem to be more so frequent, aggressive and agile? Certainly, this seems to be true of the COVID-19 pandemic.
The speed of which COVID-19 has spread across the globe is unlikely to surprise many with the film industry dramatising mass infectious diseases on both the large and small screens for many years. Fortunately, at the time of writing our populace has not turned into zombies, although the scale of self-isolation witnessed across many regions that spans several weeks may give that impression when people eventually emerge from their dwellings.
While a widespread infection of any new disease is foreseeable, with records dating as far back as 200AD, occurrences do not seem to have been frequent until now. With ever increasing population growths and expanding urbanisation across communities that were previously separated by distance, the opportunity for disease to spread among inhabitants is apparent. Add to this the rise in global connections through air and sea travel that brings people together from across the globe, and the opportunity for new diseases to cause an epidemic and pandemic is evident.
In the past 20 years alone, we have seen the emergence of SARS, MERS, Swine Flu and COVID-19 affecting multiple countries, with Swine Flu (H1N1) causing the first pandemic of the 21st Century during 2009. Before that the 20th century witnessed three pandemics with the Spanish Flu being the most notable of that century emerging in 1918 that led to between 40-50 million deaths. A key denominator of that pandemic is thought to have been from infected soldiers returning from World War I back to their native countries. Indeed, history demonstrates the spread of disease is accelerated through the infected carriers travelling between populations. In regard to COVID-19, and at the time of writing, it’s projected that the reproduction rate R0 is 2-2.5 from one infected person that would rapidly multiply; usually due to the carrier not knowing that they’re infected leading them to unknowingly infect others.
Within a four-month period, the rate of COVID-19 global infections had spread to every continent but for Antarctica, with over a million confirmed infections and over 50,000 deaths reported; the figures of which are widely debated at the time with the overall amount of infections likely to be many more. The speed of which this widespread pandemic has spread among global populations, while alarming, is not necessarily unforeseen. After all, the Swine Flu pandemic lasted 18 months, is said to have infected over 1.5-million people and is estimated to have caused between 150,00- 575,000 deaths. Lessons have been learnt from previous disease outbreaks, especially in those countries most affected, with governing authorities responses seeming quick and to some extent affective in controlling and containing contaminated communities and regions. This is more so true of South Korea, which at the time of writing, has been widely praised in its ability to tackle high infection rates within communities by introducing strict measures early on, implementing effective responses, containment and communication measures, that seemingly led to a quick decline in recorded infection rates. Reports suggest that these measures were taken from lessons learned from the MERS outbreak during 2015 that widely affected that country, however, innovative adaptions to the COVID-19 situation were identified.
So, what did South Korea do to tackle this new crisis? It implemented a multi-level approach by adopting technology and innovating its usefulness in collecting, analysing and communicating data, ensuring open and transparent communications, developing public and private partnerships to enable a joint approach to tackling the problem where it arose, and mass testing the population whether they displayed symptoms or not that not only helped to identify and isolate those that were infected, but also impressed the seriousness of the situation on the nation. These measures resulted in half the number of new cases being reported within a week, half again over the next four days, and then again within a single day.
Many crisis management and business continuity plans provide for an abundance of information, that in the usual sense, would greatly educate and transfer knowledge to the reader, but do these forward-planning preparations really enable an organisation to make the right decisions and enact the right actions quickly enough to avert their own crisis; regardless the external influences against them? In todays modernised world where technology enables many to work almost anywhere, but for those whose employment does not allow them the luxury of flexibility events alike the COVID-19 pandemic can have serious ramifications for the employee and employer alike. Indeed, the real crisis for many organisations may very likely be to prevent job losses, revenue losses and potentially closure. After all, financial and economic damage is usually guaranteed in any global crisis situation that in itself could lead to another crisis such as a recession.
International, national and industry related standards set out relative guidelines to encourage organisations to develop plans, procedures and practices that will enable them to operate accordingly to agreed best practice and, in some cases, to ensure compliance to laws. Most often these standards significantly improve how organisations operate within a defined framework that is frequently audited for both compliance and to also demonstrate how they are adapting and continually improving how they operate. Auditable frameworks that are designed to a pre-set compliance criteria may not enable the right amount of flexibility to encourage an organisation’s agility within a changing and fast-paced environment.  While standards are updated to necessary change, it could be questioned whether the frequency of change is relative to the needs of today’s world that is evidencing far more and far consequential events; such as economic uncertainties, natural disasters, regional conflicts, epidemics, pandemics etc. than ever before. In terms of emergency, crisis and business continuity management the success of these pre-defined plans, procedures and practices that have been developed to a pre-set compliance criteria can only be judged by those who use them. What has been evidenced in any recent crisis situation is the ability for those affected to adapt quickly and to be able to operate fluidly within an unstable environment. The ability to adjust to any given situation and circumstance seems to be key in managing uncertainty that is often a prime cause of a crisis. South Korea’s ability to tackle COVID-19 at a time where infection rates were escalating is perhaps a good example of how the right and vital decisions were made to adapt responses to effectively mitigate an impending crisis.
The relevance of pre-defined emergency, crisis and business continuity plans is evident in an organisation’s preparedness for an event that would likely cause undesirable consequences for them. The key to enabling the success of any crisis pre-planning and preparations is to make them light enough to be enacted, to be adaptable enough to enable change and to action them fast enough to make relevant. Specifically, and perhaps most importantly, is the absolute necessity will inevitably be down to the capability and effectiveness of those persons directly and indirectly involved. The fluidity of change that we constantly evidence in today’s world dictates that any plan can only be used to guide a crisis response, it will not in itself control the required outcomes to mitigate the consequences that is largely due to the agility of any situation, the operating environment and the external influencers that more often than not decide the level of impact imposed on the organisation; but not necessarily the overall consequences.
Developing resilience to a crisis does not need to be an overly encompassing burden to any organisation, it must however first and foremost understand the risks and those risk outcomes that would significantly impact the organisation’s ability to operate. Understanding risk criticality ensures that the right level of focus and decision-making attention is given to those areas that will cause the most harm should they be adversely affected by the situation. Therefore, the significance of constant consultation through risk-based analysis to enable the continual development of crisis preparations is realisable in the enablement of quick decision making that would be essential in mitigating the impacts and overall consequences of an event. Making the right decisions quickly must, of course, be followed with decisive actions that are adaptable to change and that appropriately effectuate the desired outcomes. These are no easy tasks, but by adopting simpler processes into the crisis management preparations the ability to then adapt within an agile environment quickly will inevitably encourage more of the right decisions than the bad ones. Importantly, decisions will at least be made.

Gavin Wilson M.Sc, Head of Risk Advisory Services at Wilson James, has over 20 years’ experience in the security industry, with specific areas of interest in risk, crisis, and business continuity management, threat intelligence and security solutions design.