Crisis Management Series: Selecting a Crisis Management Consultant

There is always someone trying to sell your firm something. When it comes to crisis management planning, how do you determine if you really need help? And how do you pick through the candidates? Finding an advisor for crisis management advice is more complicated than arranging the typical consulting gig because so much is at stake.

Start with the Basics
Although it is routine for experienced risk managers, conducting a thorough risk analysis is a good way to start a search. This will help you to determine whether or not you need a crisis management consultant and what you might need one for. 

Leon Kappelman, director of the information systems research center at the University of North Texas in Denton, Texas, used a simple five-point analysis of his risk management program before he chose a crisis management consultant. “Before you’re ready to start thinking about a consultant, there are some basic risk management principles you need to [examine], regardless of industry or risk tolerance,” he says. “In doing so you’ll begin to understand where a consultant’s help might be worthwhile.”

These five steps shape the crisis management plan and the consultant’s role in it:

1. Look at the big picture and continuously manage risk.

2. Develop a risk management policy and communicate it.

3. Establish clear accountabilities and responsibilities for identifying, managing and monitoring risks.

4. Seek balance. There are trade-offs between risk and reward, risk and control.

5. Encourage openness, conflict resolution and learning about risk management.

Within this general risk management structure, outline your crisis management needs. Identify the types of emergencies your firm might be exposed to based on frequency and severity. Have an idea of what the potential dangers are and the chances of them occurring. Prioritize your risks, assess your internal resources and, finally, see what types of external resources you might need. 

Understanding the needs and goals of your company will also refine your search for a crisis plan and consultants. Crisis management is different for a school district and a chemical plant. Organizational structure and culture also play an important role. 

“I often say to people when they are thinking about crisis planning, ‘Hold up a mirror,’” says Andrew Gilman, president of Commcore Consulting, in Washington, D.C. “Every company is different. One company I know of, all they care about is their product and their reputation. Another company in the same business has a very high-profile CEO; their [crisis] management has kidnap plans.”

Evaluate Your Options
Once you have determined that you need a consultant, and you have an idea of what areas you want that firm or person to operate in, you must ask the tough interview questions.

Or really, question. Pose this to potential business suitors: There are a number of firms and individuals that we can hire. Why should we hire you?

It may seem like an obvious point, but everything hinges on the response to this query. The manner in which prospective consulting firms answer says a lot about them. You want to hear responses that are specific, not a politician’s answer that can be interpreted in different ways. In the military, all members of the armed forces are always expected to give an accurate verbal assessment of a situation along with solutions. Demand as much from your consultant.

Your specific requirements for a consultant will be dictated by your risk assessment, but there are some common features that you may want to examine. The consultancy should have experience in the specific fields that you have marked as vital for your crisis management planning. More important, make sure it has a list of former customers or professional societies that can attest to its performance and competence. The Federal Emergency Management Agency is a neutral and thorough reference for this.

“Of course, you have to do your due diligence,” says Kappelman, “as you would for any important purchase. ‘Trust but verify’ is a good rule of thumb, meaning check references and credentials.”

Depending on your needs, you may also debate whether to hire a generalist or a specialist. Carol Fox, risk manager for Convergys in Cincinnati, looks for depth of knowledge in her crisis management consultant. “On the front end,” she says, “I would bring in more of a generalist, someone who’s had experience assisting companies in disaster areas and who could bring those lessons to the table in order to map out, from a strategic and management point-of-view, what needs to occur.”

Indeed, consultants can provide a vital perspective, based on experience, which could be essential during the initial planning stages. “I was doing a plan for a credit union,” says Steven Davis, principal of All Hands Consulting in Columbia, Maryland. “In the site review I noticed that the building across the street was storing hazardous material. I told them they needed to be concerned about that because if there was ever a leak, they might have to evacuate or enact shelter procedures. Within a couple of weeks there was a spill and they had to be evacuated.”

The culture of the consultancy is also an important factor in choosing a business partner. “To tell you the truth,” says Fox, “I look more at the individuals delivering the service and their experience.” 

A good consultancy will thus be able to match the right employee to your company. “The company’s culture is important,” says Davis. “It’s a factor in who I recommend to staff a job. The financial sector is very different from the industrial sector. The public sector is very different from the private.”

The advisor must also adapt to your organization. You need someone who is willing to learn about your company and shape their insight to your way of doing business.

“We believe that we understand our business better than a consultant coming in would,” says Fox. “We control our own disaster recovery/ business continuity planning internally. We don’t have them come in and write a plan for us. Unless we have internal ownership of those plans, they’re not going to be as valuable because people may not buy into what a consultant comes in and tells you to do.”

From the consultant’s point of view, however, this can be a tricky balance. “I have a philosophy of making the client happy,” says Davis, “but it’s not ‘no matter what.’ There is a limit. I’ve had clients want something that would be ineffective. They didn’t want to address the life safety concern. They chiefly wanted to make the insurance company happy. And I told them I wasn’t comfortable doing that.

“Some people think, ‘Well, we just need a plan,’ but they don’t want to bite the bullet in terms of the other planning and processes. It gets more and more expensive the more you do, of course. But we’ll work with people to identify how much they can afford to spend and how much risk they can afford to take.”

In the end, you are selecting a relationship that you will depend on in a time of dire need. “When you bring in a crisis counselor, it’s usually because a company’s reputation, product or current or future sales are at risk,” says Gilman. “You’re responding rapidly. You’re under pressure from shareholders and investors, possibly regulators and the public through the press. In these situations, there’s less room for mistakes.

“You need a great deal of trust with the team you’re working with. You want people who are with you 24-7. You want somebody to provide the outside perspective, but also someone who’s already familiar with you and how you work. A good relationship with a crisis counselor should be established in anticipation that something could happen later on.”

You May Already Have the Consultant You Need
When the crisis management plan expands or becomes more complex, or when your organization is facing a very specific need (such as public relations requirements), you may have to turn to a specialist. For other crisis management plan aspects, however, your broker and insurer may be the only source of advice you need.

Even if they do not call it “crisis management consulting,” most risk managers look to their broker for information. Consider, for example, if an organization has a fire. The survey and recommendations of the safety representative of the insurance carrier and broker are a form of crisis management preparation. Long before Osama bin Laden, there were hurricanes in Florida, floods in the Midwest, blizzards in the North, riots in Los Angeles and earthquakes in California. Each is a crisis that threatens organizations. Brokers and insurance safety representatives have long helped their clients prepare for these kinds of disasters.

At Convergys, Fox uses her broker, New York-based Marsh, as a consultant to design tabletop disaster recovery scenarios annually. This service is a specialty within the broker’s expertise. “One of the things about using the broker’s services is that they better understand the integration of an enterprisewide view better than an independent consultant,” she says. When specific situations arise, Fox brings in specialists to assist Convergys’ crossfunctional, crosscompany business continuity counsel.

Another advantage to having a carrier supply your crisis management consulting is the shared risk. The insurer can partner with its client to the mutual benefit of both organizations.

Discovering the Problems
In order to effectively use a consultant, the organization must buy into it from the top. “Where I’ve seen business continuity and disaster planning not be as successful is when it’s done in isolation,” says Fox. “For example, you’ve got a data center doing disaster recovery for itself without any integration with human resources, risk management or facilities. So they would bring in a consultant that would have a narrow view of ‘How do I recover my servers?’”

When selecting a crisis management consultant you may discover an unsuccessful choice only after the fact. With a general management consultant, the goal is result-oriented, based on daily assessments. A crisis manager, on the other hand, may have a great plan and have excellent skills, but you will not know for certain until both are tested. If there are problems, only then will your consultant’s shortcomings become apparent. But by then, it is too late.

SIDEBAR: Personal Account: Finding a Consultant in the Aftermath of Catastrophe by Damar Hawkins After September 11, 2001, it became clear to the management of The Institute for Genomic Research (TIGR) that we needed a disaster recovery plan, and no one within the organization had the time or the expertise to create one. I contacted our insurance provider and asked for a recommendation. The provider offered a couple of names, but because of the unusual nature of our organization—a nonprofit research institution—and the fact that our facilities include both office and laboratory space, it would be important to find someone who had some laboratory expertise and experience. So I went on the Web, found possible contacts and called several individuals who pointed me in the direction of the organization that we subsequently used. Although the search for a crisis management consultant did not differ greatly from the way we would find any other sort of consultant, the sobering reality of the events of September 11 showed that such an attack could devastate any organization. The tragic and quick introduction to the field of crisis management for our organization made the search more difficult than finding, for example, a human resource recruiter. Because we have a very sophisticated information technology department, which is fundamental to the work we do at TIGR, this became an overriding consideration in finding someone to develop a disaster recovery plan. Our consultant found someone experienced in IT to help our staff write an IT disaster recovery plan, which fit within the overall plan. Since we do not have a dedicated environmental, health and safety position, the consultant brought in a team to evaluate those needs. As a result, we realized the importance of establishing such a position within TIGR. Each of these additional studies was subcontracted and added to the overall expense of the project. It was important to establish a relationship with the consultant before signing a contract. We arranged for the consulting team leader to meet with several senior managers to explain what disaster recovery planning was, the necessity of it and how much time they would have to contribute. Our team did not realize the level of effort each department would have to commit to make a successful, viable plan. The leader also stressed the importance of the president buying into the concept and forcing the organization to devote whatever time and energy was necessary to make it work. With this groundwork set up, we will be in much better shape to update the plan, as necessary. Damar Hawkins is vice president of administration at The Institute for Genomic Research in Rockville, Maryland.

Laura Sullivan is editor in chief of Risk Management Magazine. Shawn Adams, CPCU, ARM, PHR, CHCM, is director of risk management for AdminSolutions in Charlotte, North Carolina. His last article for RM was “A Beginner’s Guide to Learning Emergency Management,” in May 2002.