John F. Kennedy once said, “The Chinese use two brush strokes to write the word 'crisis.' One brush stroke stands for danger; the other for opportunity. In a crisis, be aware of the danger – but recognize the opportunity.” I would argue that one has to plan in order to exploit any opportunity that may arise, esp. in times of crisis.
Business disruptions are a prime example. Disruptions occur in a variety of circumstances. It could be a cyber-attack, power outage, fire, rogue employee or a weather related event. Weather related events readily come to mind and affect most areas of the country. This is something that is almost inevitable in Southern California with our earthquakes, wildfires, floods, landslides and even tornadoes. Many are unaware that early last century Newport Beach experienced a hurricane! So yes, these events are rare but they do happen. How does one prepare for a business disruption event?
Well, one can roll the dice and respond in an ad hoc way or be prepared. We believe in preparation. Straightforward planning, and practice, can improve a business’ resilience and result in tangible gains in their market.
Suppose a disruptive event occurs … how do you respond? At this point we assume the firm has been sensibly proactive and has in place a Business Continuity / Disaster Recovery plan that it formally tests each year. (Is this a fair assumption in your firm’s case?) This post is about the communication that is required as part of initiating this plan.
When an event occurs you must understand who needs to know. The first group is your company management so they can implement their response plans. Beyond management are the employees that produce whatever you deliver to clients. And let’s not forget the relationship managers that are directly serving those clients. How will all of these people be made aware of a disruptive event? Once you open the communication links outside of company staff, it is absolutely critical that the correct message be delivered to each affected party. Sometimes the message is the same yet at other times the message might be tailored to the affected party. The key is to ensure that the messages are consistent so as not to undermine your firm’s reputation.
One effective mechanism for ensuring that communication is effective is a Calling Tree exercise. Beginning with internal communication, every senior executive in the company should know what they need to do should an event occur. When they are apprised of an event’s occurrence, they immediately begin contacting their staff to inform them of the initiation of the recovery plan. Will staff be reporting to work as normal or will they now be working from home or, if available, at an alternative or disaster recovery (DR) site. If they’ll be at home, they should confirm their set-up is up and running so the executive can rely on their contribution to the firm throughout the event. If there will be a move to the DR site, they should prepare to report there as required.
External communications require specific action. In the event the firm is regulated executives need to inform their regulator of the event and how it is being addressed. If your company manages client money and experiences a disruption that impacts your investment process, the regulator will require evidence that your response meets your fiduciary responsibility to your clients. If you are an executive of a pharmaceutical company supplying a treatment to the US market and a firm in your supply chain experiences difficulties in producing contracted products, you need to inform the FDA so they are able to alert the market if the supply of your medications / products moves into shortage.
Even outside the regulated space, both your clients and supply chain need to be kept informed of the event status. So a plan must be in place with a clear chain of command and communication that confirms what messages are to be sent, to whom and in what time frame. This control can only be delivered if there is a single point of contact so that each third party only receives information from that contact. This is essential as incorrect perceptions of what is happening can be very damaging. Even if you have not solved the underlying problem, clients are more willing to understand if they see an appropriate and timely response to a disruption.
Let’s briefly describe a Calling Tree exercise. First, these exercises have to occur randomly and ideally at least once each year. It will be a refresher for those who participated in a previous exercise and any new staff will learn from the experience. An element of the exercise should be required review of the business continuity plan. Another requirement for the test is that these should occur outside of business hours. If an event occurs during business hours most staff will be in place and have at hand the necessary documentation. Conducting the test out of business hours will reveal which staff members know and understand what they need to do.
To evaluate the exercise, some data will need to be recorded. For example, if the COO initiates a test, he or she will want to know how quickly managers receive and confirm receipt of the notice. Next, response times for the entire call tree are monitored (i.e. the times that manager’s initiate calls to their team members to inform them of the exercise and how quickly the confirmatory replies come in if messages are left or SMS is used). Once word reaches those with external contacts (clients and supply chain firms) the timing of the required conference calls should be noted and the decisions taken during those calls should be recorded. All of this information will be necessary to grade the performance of the firm in responding to the supposed event.
As executives who might have been involved in similar exercises, I think you see the importance of planning to control and manage a disruption event. This exercise ensures the firm has the ability to react to an event with ease and competence. In the case of a real event, the follow-on communication with both clients and supply chain firms will be a positive signal that management is on their game. Any specific details communicated to clients will enable them to make adjustments in their own best interest. Likewise for firms in the supply chain, they will have reason to view management as capably in charge.