Every crisis management program begins with a competent crisis management team. This group serves as the organizational backbone for crisis planning and response. The team is composed of several key figures, each with specific duties before, during and after a crisis.

Team Leader

The team should be headed by the organization’s chairman or another senior executive authorized to make binding decisions on behalf of the organization. This individual must have the confidence of the board of directors and the majority of the shareholders. He or she is the central figure of the contingency management plan and will make the critical choices during execution. The team leader must be willing to make—and enforce—these difficult decisions. 

Precrisis: As the team’s central figure, the leader exercises final decision-making authority. He or she determines and plans the policy and assembles the rest of the team.  

During: The leader makes critical decisions relevant to executing the program. The team leader should be one of few team members, if not the only member, with discretionary authority. In a crisis, too many decision makers may frustrate carefully laid plans.

Postcrisis: Again, the team leader is responsible for decision and policy making. In postcrisis situations, he or she works closely with the board to direct the organization.   

Finance Director

Typically the CFO, the team’s financial representative is responsible for handling all financial affairs related to crisis management.   

Precrisis: The finance director assesses financial implications of each aspect of the program, arranging for rapid disbursement of emergency funds from trusted creditors.   

During: The finance director handles all financial transfers related to the crisis, such as paying ransom money in a kidnapping. 

Postcrisis: The finance director maintains detailed records of costs related to crisis management and continues to advise the team leader on the financial impact of the crisis.

Legal Representative

The team’s legal representative can be outside counsel or the organization’s general counsel.

Precrisis, during and postcrisis: The legal representative examines the legal implications of any action taken by the crisis management team.

Security Director

The security director handles contingency planning, crisis response and information management through all phases of the crisis.

Precrisis: The security director is in charge of developing the contingency management program. He or she is responsible for establishing a crisis center and training employees in proper crisis response. 

During: The security officer serves as the primary information officer. He or she notifies other members of the team about the nature of the crisis and continues to supplement reports as events unfold. This director is the primary liaison with police and other safety officers. 

Postcrisis: The security director’s primary postcrisis assignment involves coordinating the evaluation and modification of the program.

Risk Manager

The risk manager assesses the potential impact of a crisis, secures adequate financial protection against that impact and helps with information management.

Precrisis: The risk manager acquires adequate insurance for continuing critical operations and determines how various contingencies affect coverage. He or she advises the team leader on the potential financial impact of these effects.

During: The risk manager assists the security director as a secondary intelligence and information officer.

Postcrisis: The risk manager prepares insurance claims and modifies organizational policies as needed. 

Communications Specialist

Also classified as a media or public relations specialist, this confident individual can assess a crisis situation quickly and convey important details without compromising the privacy of the organization or any individuals being investigated in connection with the crisis. 

Precrisis: The communications specialist prepares best- and worst-case press releases for various scenarios.  

During: The communications specialist controls the release of information within and outside of the organization, disseminating critical information without doing any further harm to the organization. 

Postcrisis: The communications specialist continues to work with the press and investigative authorities to disseminate critical information. 

Human Resources Representative 

The HR representative must be alert, sensitive and have an intimate understanding of the organization’s employees. He or she must remain aware of what is going on inside the organization and be able to discern and evaluate problems before they escalate into dangerous situations. 

Precrisis, during and postcrisis: The team’s human resources representative informs the crisis management team about issues affecting employees. 

Security Specialist or Consultant

Typically, this is an outsourced security expert capable of educating the organization on a variety of contingency planning issues. 

Precrisis: The security specialist serves primarily as a training officer and consultant. He or she researches and develops case scenarios aimed at distinct emergencies—from natural disasters to kidnapping to workplace violence—with an eye toward formulating and testing the organization’s program. This includes hosting employee security awareness briefings, studying issues that affect the modern workplace and preparing the organization accordingly.

During: The security specialist advises the team leader, offering specialized expertise in all areas of conduct during the crisis. 

Postcrisis: The security specialist assists the security director in the evaluation and modification of the program.

Leadership Support

A crisis management plan and the team that creates and implements it must have the strong support of the organization’s board of directors. If not, employees will not take crisis management seriously until the event occurs. 

The board should formally approve the plan, authorize the emergency response team to carry out its provisions and communicate its support for the plan to employees through channels like memoranda and internal newsletters. In addition, the board should appoint the emergency response leader.

Training Exercises

No team is effective unless it practices. The least expensive way to conduct training for the crisis management team is through implementation reviews and validation exercises. 

In an implementation review, which should be repeated every quarter, members of the crisis management team talk through various aspects of the crisis management plan in the safety and comfort of the organization’s conference room. The focus is on internal logic and consistency. Each member goes through the plan reviewing his or her responsibilities following the chronology of events as they would develop during an actual emergency. This early-stage review identifies responsible actors and any deficiencies in the plan before the execution of a costly full-scale simulation.

The validation exercise is more comprehensive. All relevant parties responsible for executing the plan participate in the walk-through. This is a larger-scale operation than the implementation review, and offers an expanded opportunity to test internal logic and execution capability. By involving more parties, the validation exercise more closely resembles an actual crisis response, subjects the crisis management plan to practical scrutiny, and has the added benefit of both educating employees on their roles and testing their knowledge. Validation exercises should be conducted every six months in order to maintain proficiency.

To make both implementation and validation exercises more effective, first assemble the group, then announce the triggering event. While the participants will not actually carry out their respective duties, they will experience uncertainty and time pressure, adding to the exercise’s validity. Participants must “execute” their responsibilities in order and under time constraints, while being evaluated by a moderator. This technique helps the team assess feasibility and capability without subjecting the organization to a significant disruption. 

While such tabletop exercises are effective, the best way to test a contingency management plan is to conduct a full-scale simulation in which team members and employees physically respond to a disaster. For example, the CEO of one software production company periodically walks into his organization’s main server room and pulls the plug on the primary server to test emergency response capability. A live fire drill does not need to be so dramatic, but a full-scale mock crisis will address any feasibility questions left unanswered by the tabletop exercises. It also identifies logistical errors not readily apparent during a nonaction drill. Although simulation exercises are expensive, they are necessary and should be held at least once a year. 

Next Steps

With the crisis management team in place, the organization can turn to the difficult questions of what to prepare for and how to prepare for it. This starts with a brainstorming session during which team members ask “What if . . . ?” As insiders, the members will have the most intimate knowledge of issues particular to their organization and can home in on the operational aspects that make their organization unique.