Crisis planning's most important implement: the drill.

Your organization takes a hard look at the world in which it operates, sees the very real risks to its reputation and operations, and determines that it had better develop a crisis plan.

A "crisis team" is formed. It reviews well-known crisis responses, such as the Exxon Valdez, Tylenol, and, more recently, Hudson Foods. It decides which ones were done well and which were done badly. It vows to emulate the leaders and do everything to avoid the mistakes of the bad guys.

The team writes a contingency plan for dealing with some of the situations that most worry management. The plan is circulated, other executives and attorneys offer their input, and the plan is put into final form.

The plan goes into a binder which is distinctively marked CRISIS MANAGEMENT PLAN, and gets distributed to all members of the crisis team, who make a place for it on their office bookshelves. A grateful CEO sends letters of thanks, and the hard-working members of the team can get back to their real jobs.

Your organization has just dedicated hundreds of thousands of dollars in employee time, outside consultants and attorneys, and reproduction expenses to produce a crisis plan.

And, despite all this, you are probably no better able to handle a crisis than you were before.

Readiness = Plans + Preparation + Practice

By itself, a crisis plan won't help your organization out of a crisis. The only way to do that is by building a responsive organization, guided by the right values, whose skills are honed. And the only way to do that is by putting the organization to the test - through exercises, simulations and drills.

Never before has there been a time when business, government, and not-for-profit organizations' decision makers have been more closely held to a bottom-line standard for their actions. Programs and people are expected to add value or equity, or they must be considered at risk.

It is hard to imagine a more career-shortening situation than failure to foresee a predictable crisis or mishandling one in a way that costs the organization large sums of money, damages its reputation, or which may harm or kill people. Given the mind-bending nature of a crisis - the heavy emotionalism, the media coverage, the organizational short-circuiting - it is difficult to understand how so many senior managers believe they can "wing it" if a crisis hits.

Crises are predictable. Virtually all of the crises that may affect your organization have likely plagued someone else. A substantial body of knowledge is available about these situations. Crisis teams can write effective plans, deploy appropriate resources and prevent crises from turning into disasters. However, the only way to truly test these capabilities is by putting them to the test.

No one knows this better than the oil industry.

The Other Kind of Oil Drilling

In many industries whose operations are characterized by great risk - oil refining and transportation, nuclear power, airlines - drills are an accepted part of life. Leading oil companies, such as Chevron, Exxon, Mobil, BP, Shell, Occidental and others, take extraordinary steps to ensure that their simulations and drills have the look and feel of a real-world disaster.

Much of this focus on drills can be directly traced to legislation passed by the U.S. Congress - and copied by many other governments, states and provinces - in the wake of the Exxon Valdez disaster. Principal among these is the Oil Pollution Act of 1990 (or "OPA 90" for short). OPA 90 specified the need for physical safeguards, such as double-hulled tankers, and mandated major oil shippers to conduct emergency response exercises at least twice a year.

"OPA 90 was a major contributing factor in enhancing the industry's ability to respond to crises," says Tom McCloskey, a Seattle-based consultant who works with major oil companies on drills and training to sharpen emergency response capabilities. "It's established a framework, legal and regulatory, that requires a variety of regular exercises that collectively have resulted in companies being better prepared."

Most important, says McCloskey, it's gotten companies into the habit of rehearsing their responses to nightmare scenarios, such as major oil spills.

"I don't think you can respond well to emergency or crisis situations unless you practice. There are a lot of things you have to have in order to perform well: management commitment, a strong organization, people who understand their roles in an emergency. To get there, people need to be trained, and they need to be exercised."

This practice is especially important when the incident crosses international boundaries or other jurisdictional lines.

Michelene Brodeur, a communication officer with the Canadian Coast Guard in Vancouver, B.C., has observed and participated in a number of joint spill-response exercises involving both the Canadian and U.S. Coast Guards.

Brodeur says that exercises that involve multiple agencies and companies, are "quite useful" for testing intangible items - such as human emotion and bureaucratic behavior.

"They're important for testing the procedures of a plan, and in the case of joint response, it helps to outline who does what - how the cooperative effort will work. You get to know if one organization has requirements for approvals that might slow up a response to the media, or who is most skillful at a particular task. It helps to get things going as quickly as possible when the real thing happens," she says.

How To Put Your Organization to the Test

For communicators, or other decision-makers, involved in the crisis management process, drills and exercises do not have to be expensive or out of reach. Drills, and supporting training activities, should always be part of the crisis planning process, with lessons derived from each drill serving to improve the crisis plan.

Developing a Crisis Plan

While many academics, management consultants and communication practitioners have written about ways to develop crisis plans, they often overlook two of the fundamental building blocks of crisis planning: values and objectives.

A crisis plan that seeks to protect a company's reputation will not be worth much unless it is predicated on these important foundations. Likewise, drills or other exercises that fail to test these miss an opportunity to gauge what will motivate organizational responders and communicators in a crisis.

Values: When Odwalla, a popular California-based fresh juice company, was identified as the possible source of E. coli bacteria last year, the company based much of its crisis response on the values upon which it was founded. Principal among these, CEO Greg Steltenpohl told an audience recently, was the need to stay close to Odwalla's consumers and remain an important part of their lives. Although Odwalla did not have a formal crisis plan, it relied heavily on these values as it mounted a response that received generally high marks for its effectiveness and compassion.

What values would your company strive to uphold, even in a crisis? If your company has a mission statement, or a credo, look there. Responders need to know that their actions should do more than make a problem go away. Their short-term actions may need to be geared that way. Long-term, what legacy have they created for your company when it was put to the test?

Objectives: Set out a clear set of objectives for your written crisis plan. The most important of these should be simply stated: to improve the organization's ability to respond to a crisis, to come to the aid of affected individuals, to vigorously protect the organization's reputation, and so forth. These also may be highly practical, as dictated by corporate culture: to mitigate legal and regulatory actions, to maintain shareholder value, to remain a good neighbor, etc.

For communicators, three numbers serve as important milestones in a crisis: 60, three and one.

Within 60 minutes of being notified of an incident - especially a natural or environmental disaster - an initial communication must be distributed indicating what is known about the situation and what response steps are underway.

Within three hours, a crisis communication organization should be in place - even if it is bare-bones and awaiting the arrival of additional resources.

And by the end of day one, a short-term communication plan needs to be in place - one that specifies key messages, key facts, identifies spokespersons and indicates the next day's needs. Many communicators in crisis situations find that their actions are motivated by print and electronic medias' next news cycle.

Risks and Scenarios: These are the guts of any crisis plan, and while they are perhaps the most straightforward, they can be the most time-consuming to develop. A crisis plan must serve as the road map for all risks that could conceivably blossom into crises, and provide written contingency plans for each.

These plans would likely include the following categories: financial, legal, legislative/regulatory, environmental, work place (safety, harassment and discrimination, etc.), labor, computer security, product integrity, natural disaster, crime and others unique to your organization. Specific scenarios then are developed to show how such risks could develop into crises.

Action Plans: Follow specific action plans, including details of the response to each of the scenarios just mentioned. Again, the process of arriving at written action plans can be straightforward but maddeningly time consuming. If 137 credible crisis risks were identified, then 137 action plans need to be developed. These need to include specific roles and responsibilities (with alternates for each player), functional team organization charts, resource needs, interactions with outside agencies or third parties, and other steps that serve as the script for all levels of crisis response.

The process of developing specific action plans will more often than not point up deficiencies in existing. policies and procedures. For example, many companies find that their media policies are outdated or inappropriate for crisis response, and revise these as a part of crisis planning. Other critical resource documents would include:

* Related company policies (personnel, security)

* Physical configurations for the company's crisis center

* Call lists - internal and external, with accurate phone numbers

* Security protocols

* Agency notifications

* Wallet cards, posters, etc.

The Crisis Team

While the right mix of responders must come together to effectively handle all aspects of a crisis situation once it breaks, the crisis team has an even more important job - to anticipate problems and keep them from happening. Who in your organization can best do that?

The crisis team should be looked to as the crisis' "board of directors," the smallest possible group that can make decisions, provide leadership and motivation, and bring an appropriate expertise in various operational areas. In most organizations, it is comprised of representatives from operational disciplines, legal, communication, finance, risk management and safety and health.

The crisis team has three main responsibilities: Writing and taking ongoing responsibility for the crisis plan, leading the response to anything that the plan identifies as a "crisis," and overseeing the process of testing and refinement.

Testing

Crisis tests come in many forms, ranging from role-playing exercises through full-scale disaster and accident simulations. Which is appropriate for your organization? Several factors will determine the answer.

Resources. Simulations require dedication of personnel time, consultant time and other costs. Look to that method which your crisis team feels it can execute comfortably and derive the greatest benefit. Start small, with shorter role-playing or table-top exercises, then graduate to more full-blown simulations.

Direction. How much direction will the most appropriate test require? Role-playing exercises and table-tops require a moderator to keep the simulation moving and to ensure the proper flow of issues. Full-scale simulations or drills will require a team of directors to oversee the flow of issues for different response groups within the organization.

Realism. No simulation will be worth much unless it feels very much like the real thing. More than anything else, responders should feel the pressure of a real crisis, with impossible deadlines, incomplete information and personality conflicts. Almost any simulation, large or small, needs a heavy dose of the "outside world," namely media and political attention. Larger drills should feature a cast of role-players who do nothing but simulate reporters, activists, angry neighbors, consumers and others whose behavior cannot be predicted or controlled.

Operations. Which functions within your organization need to be tested the most? If you are in the consumer products business, you will likely test your ability to respond to a product integrity issue, such as tampering, a recall, or rumors about your product. This will require a mix of responders from manufacturing, safety, legal, financial, communication and regulatory disciplines, as well as outside players, such as distributors, stores, etc.

In this case, a full-scale drill, which combines operational and communication responses, would be in order, and such a drill could be expected to last anywhere from a half-day to several days.

A smaller, or more focused table-top exercise might be in order for testing response capability for a single department or discipline, such as a corporate communication department preparing for a merger, strike or lawsuit. A two-to-four hour exercise, run by a moderator, is often sufficient.

In any case, the following issues need to be resolved before commencing any drill or simulation:

Objective of the Exercise. In short, what does the organization seek to get out of the exercise? Which capabilities need greatest improvement? Are there new people in the organization who need to get a feel for the way it handles crises?

Issues or Aspects of the Crisis Plan To Be Tested. Because the crisis plan is an organic document, there are always elements that are being modified or added. For example, one company may wish to test how it communicates the ways it will pay claims following a major incident. In this case, a number of scenarios specific to the claims process will be developed to test both communication and financial functions.

People, Roles and Teams to Test. New people, or those in new crisis-related roles, will always need to be tested, but there are other reasons to focus on individuals or teams as well. Shortcomings may have been found in the company's most recent response to a real crisis, or the organization's communication team operates under vastly different rules than the regulatory agency's communication team with which it will have to work.

Resource Allocation. Like any business or agency initiative, a budget should be established for exercises that correlates to the benefits the organization will derive. The budget should be realistic in terms of staff time, experts, equipment, transportation and other out-of-pocket costs. It is not uncommon for multinational oil companies to spend U.S. $1 million or more for drills involving full deployment of equipment and transportation of dozens of employees and contractors to a simulated spill site. In the larger scheme of things, this expense is reasonable, considering the enormous economic and environmental costs of oil spills.

What is it worth to your hospital to test new nursery security procedures? How quickly can you recall thousands of candy bars bearing your company's 100-year-old name? How much would it cost to completely rebuild a database destroyed by hackers?

Finally, consider the advantages of pre-drill training and review. Bringing your crisis response team together is an excellent opportunity to conduct quick refresher courses on policies or techniques, such as media training, personnel policies or others.

Refinements

Drills need to be evaluated immediately upon conclusion to see if they achieved their objectives, put all parts of the organization to the test and felt real. Through verbal polling of participants in post-drill "focus groups," followed by written evaluations by drill directors, and concluding with a full written report by the crisis team, the crisis test can be judged to have been effective, and, if it missed the mark, why it did.

More important, the drill evaluation should provide a set of refinements both for the next exercise and to the overall crisis plan.

Conclusion

Veterans of numerous crises often liken their experiences to the relentlessness of battle. Even in those crises that do not exact casualties, the sense of terror or doom can be overwhelming. It can rob even the most creative strategist of the ability to plan or think objectively. Allies fight among themselves. And, before long, all anyone wants is for the crisis to just go away.

For Napoleon, dealing with the stress of such crises was simple: "On s'engage et puis on voit!" ("One jumps in, then figures out what to do next!"). Many of us will have to "jump in" to a crisis at some point in our careers, but few of us possess the wits or gall of the Little General. A solid crisis plan should provide alerts to those situations when you will need to jump in. But only practice, in the forms of simulations or drills, will show you what to do before you have to start dodging bullets.

Larry Kamer is principal of Kamer-Singer & Associates, a public affairs, public relations and crisis management firm based in San Francisco.