The illusion of crisis readiness

A DDoS attack paralyses two of our most important programmes! Do we have alternative tools? How do we inform everyone involved about what has happened and which tools we are switching to? From one moment to the next, we can no longer rely on our processes, and, in the midst of all the stress, we have to define new ones.

All too often, the introduction of a crisis management system is equated with genuine crisis readiness. Once processes have been documented and templates created, the matter is often regarded as settled, and people move on to the next task. Yet at that point, all we have done is lay the foundation.

Whether processes are actually understood as intended, whether we are prepared for the failure of key tools, and whether responsibilities are clear only becomes apparent in practice. And that is precisely where the real work begins.

From process to routine

A process that nobody knows about is hardly worth any more than a process that doesn’t even exist.

All too often, I have spoken to staff who have only a vague understanding of their employer’s crisis processes or are completely unaware of them – yet they are the ones who ultimately have to put them into practice. And a crisis leaves no time to comb through documentation or look up who is responsible for what. That is why it is not enough to define and document procedures. They have to be internalised and practised regularly.
This applies to both the members of the crisis management team and to all other staff. The ability to take action doesn’t come from skimming through processes, but from applying them. Only by repeatedly running through procedures again and again can one develop the routine and competence to follow them correctly even under pressure and, where necessary, adapt them sensibly to the situation. 

Spotting weaknesses before the crisis does

The robustness of crisis processes is often only apparent when a crisis actually strikes. It can easily happen, for instance, that emergency contacts are stored solely on the intranet. But what if the intranet is knocked out in an attack or, as described above, the main communication channel is down? Have we defined a fallback option, and does everyone have access to it?

What appears to be perfectly thought through on paper rarely stands up in practice. The value of a crisis exercise therefore lies not in proving what we are capable of, but rather in identifying at an early stage where gaps still exist.

After all, every weak spot we identify in a simulation is one weak spot fewer to contend with in the next crisis.

Crises are overcome by people

Besides processes and tools, two key aspects are often overlooked but strongly influence the outcome of a crisis: trust and team cohesion. And these two don’t emerge during a crisis. They emerge before it.

This is one of the key lessons I have learnt from crisis exercises to date. I have often seen interpersonal tensions surfacing only in simulations. And it should not be underestimated how quickly such disagreements can escalate under pressure. Department heads refuse to collaborate, risks are not communicated openly for fear of being blamed, or crisis team decisions are deftly ignored because they don’t match people’s own views. These are all situations I have witnessed first-hand.

Crisis exercises offer us the opportunity to address these disagreements at an early stage, build trust and prevent escalation in the event of a crisis. Whether in discussions during the simulation, over a coffee break or afterwards over an after-work beer – in a more relaxed setting, many frictions and uncertainties can be resolved.

Crisis exercises allow the members of the crisis management team to develop as a team. They get to know their colleagues’ working styles and what their individual strengths are in stressful situations. This enables the team to communicate and respond more efficiently under pressure and to make united decisions as a team.

Learning rather than judging

This naturally raises the question: what makes a good crisis exercise?

Depending on the maturity of the crisis management system, a more or less guided exercise is recommended. Particularly when crisis processes are still being developed and the crisis management team has only just been formed, it can help to be able to ask questions during the simulation and address uncertainties right there in the exercise.

Over time, however, it is important to make the scenarios as realistic as possible in order to maximise the learning effect. Here, we should also practise the steps that may seem obvious on paper. For example, contacting the crisis management team and the departments involved, or classifying an incident as a crisis. 

What matters most in all crisis exercises is that they serve to continuously improve crisis resilience. They provide an environment to make mistakes and learn from them. They are not, however, intended to test or shame participants.

Successful exercises go wrong

Fortunately, the crisis described at the start was just an exercise. We had an alternative communication channel available, and the majority of participants were in the same building. This meant we were able to announce the temporary switch in person. In a real emergency, though, that is rarely realistic.

In a real crisis, the parties involved would probably not all be so easy to reach. What is more, in this simulation, it was indeed the case that we did not have a backup ready for the case management tool and had to sit tight until the problem was resolved. This is just one example of the many valuable insights we gained from this exercise and were able to feed into our existing processes.

And that is precisely why regular crisis exercises are so important. With every simulation, we move everyone involved, and our processes, a step closer to crisis readiness.