I consider crisis communications one of the most important things we do as business resilience / continuity professionals. You will undoubtedly be judged by management on how well communications are triggered and maintained throughout a crisis. Communications can make or break you, so I implore you to give it a lot of thought. You must get it right the first time and every time!
A robust and practiced crisis communications plan will empower you and your company to respond quickly, accurately and confidently throughout any disruptive event.
When a disruptive event occurs, such as a tornado, earthquake, active shooter, etc. the need to communicate can be immediate. These are fast breaking events where every second counts. Employee safety is your number one concern – ALWAYS.
Other events have a longer lead time – hurricane, winter storm, union strike… You have more time to prepare and release communications. Employees and their families must have clear, accurate and consistent information. Neighbors living near your site may need information—especially if they are threatened by the incident. Keeping all of this balanced will be much easier if you spend time preparing and practicing your plan. Templates are also valuable to save time and prepare you so you do not forget anything during early frantic moments of a crisis. Have these prepared, signed-off-on by management and tested before a disruptive event.
Beyond employee safety the continuity of operations is critical. If business operations are disrupted, customers will want to know how they will be impacted. Depending on your industry, regulators and local government officials may have to be updated on your status. I lived this in the finance sector for many years at some of the largest global companies. So be ready to communicate. Do not go into a shell at ‘crunch time’.
Throughout Ultimate Business Continuity, I discuss communications as it is at the core of what we do as business resilience / continuity and emergency management professionals. This post provides guidance and suggestions on the different audiences you may want to maintain communications with.
If you have a sizable company and are still using manual call trees, you may want to rethink that. Tools such as intelligent mass notification systems and a scalable – cost effective national employee emergency hotline will be incredibly valuable provided you select the right tools and implement them correctly. I specialize in implementing communication tools that empower organizations. My door is always open to you beyond this site. You have my attention if you need it. Just email or call me for advice.
I am sure you will want to modify the information in this post to fit your business but it will provide a solid foundation to build on. Understanding potential audiences is key, as each wants to understand: “How does it affect me?” So here we go:
Audiences you must include in your crisis communications planning:
Contact Information:
Accurate contact information for each audience must be readily accessible to you. Existing information such as customer, supplier, vendor and of course employee contact information probably are available within your organization. Leverage what you can. Try to maintain a gold copy of contact information. Otherwise it will become impossible to maintain the data quality (integrity) of these critical lists. We talk about data quality below, in the Golden Opportunities post and in the technology category. Data is one of my passions. Great data is power while bad data is…really, really bad, counterproductive and can become very expensive to an organization.
Include as much information for each contact record as possible (contact name, business telephone number, business cell number, business email address, personal cell, home phone, personal email address…). A big caveat though – if you are using a cloud / SAS vendor for your mass notifications, upload only the data necessary to contact employees. For example, there may be no valid reason to upload the home street addresses but city, state, zip code can be beneficial for geo-location to target messages for employees in location of concern. This was very useful to me during the Boston Marathon bombing when I had to do notifications to particular towns and zip codes as the event progressed and shelter in place was advisable by authorities. In addition to this post there is more information on improving contact data in the technology and data categories.
Contact lists must be updated regularly, secured to protect confidential information and available to authorized users at the emergency operations center or an alternate location for use by members of the crisis communications team.
Pay close attention to contact data integrity. Partner with Human Resources (HR) to improve the quality of the contact data. In my opinion, HR should own the contact data portion and possibly have Sales own the customer portion of the data. You cannot and should not try to do it all.
I also suggest you implement an automated process to keep data fresh and accurate. DO NOT underestimate the effort it will take to keep your contact data pristine. It might take a large effort from multiple departments to do this but it is well worth the effort. You will get extraordinary value from clean accurate data.
After you have clean data in-house you must get it into your notification system. Stay clear of manually uploading spreadsheets. I favor a simple automated process to add/update/delete data to a mass notification tool:
YOUR COMPANY IN-HOUSE GOLD COPY -> sftp upload OR real-time synch-> MASS NOTIFICATION TOOL
This type of automated process takes the human element out of the data uploads. The automated upload can be triggered as often as you like. Daily is often sufficient but I have also implemented real-time data synchronizations so when a change is made locally either in an HR system (SAP, Taleo…) or BCM system, a trigger is activated and the mass notification system is updated in a few seconds with the revised contact information. Even if you have 100,000+ employees the updates can occur almost instantaneously with the right tools and processes in place. In the database world, my world, 100,000 records are ‘teensie tiny’ (Marty technical term). Never let a vendor tell you that is a lot of records. I have created real-time database updates for databases with millions of records. My son has me beat – he has designed graph database solutions with over 12 billion nodes and no latency!
Notifying Employees:
OK, allow me to be repetitious, employees are our number one priority. They are our life-blood. They are our most valuable asset. They must always be kept up-to-date with consistent accurate information. In my opinion Human Resources (HR) should own and assume responsibility for the day-to-day communications with employees regarding employment issues and benefits administration. HR management should assume a similar role on the Incident Command Team and the Crisis Communications Team. HR and Corporate Communication should coordinate communications with management, supervisors, employees and families. They should also coordinate communications with those involved with the care of employees and the provision of benefits to employees and their families. Close coordination between management, company or division spokesperson and HR is needed when managing the sensitive nature of communications related to any incidents involving death or injury.
If you have a mass notification tool HR should be trained to be able to do notifications with your support if they need assistance. Don’t fall into the trap I did years ago, of doing all the notifications by yourself. This can cause issues for your company and your health. It was a learning experience and partially my fault for letting it happen. I later trained representatives throughout organization to be able to do their own notifications. It became so much better for everyone, including me!
Tip – Develop pre-defined and approved templates for various scenarios. It makes it easier to modify them at time of launch rather than writing them from scratch and getting them approved. We will discuss a lot more on mass notification tool best practices elsewhere in posts on Ultimate Business Continuity.
To recap – HR should own the quality of employee data that is used for crisis management purposes. You should not own it. The data should originate from a gold source such as SAP. Make sure they understand that. Document it in your RACI chart or elsewhere. It could come in handy if finger pointing starts.
Notifying Management:
Oh boy!!! Protocols for when to notify management should be clearly understood and documented. Trust me, you had better keep management informed. IF MANAGEMENT GETS BLINDSIDED you are toast! You want to be the person that notifies management. If they hear it from their management or from some cowboy that should not be reporting-up but sees it as an opportunity to score brownie points that spells BIG trouble for you.
For you, management notification is the MONEY SHOT! Get it right and you are set – get it wrong and it ain’t pretty. After the crisis is over you want them to call you with praise for making them look good. The last thing you need is to receive the dreaded call from the Big Kahuna asking why you ‘dropped the ball’.
Providing consistent updates to management by phone, email and secure text messaging is especially critical during and after a crisis! If I had to choose between under communicating and over communicating I would skew toward over communicating every time.
It should be clear to staff the scenarios that require immediate management notification and the proper process to notify them. If it is important then you must notify management at 4 am. Don’t worry about waking them up. Similar protocols and procedures should be established for notification of directors, investors and other important stakeholders. Trust me, management does not want to learn about a problem from the news media Wake them up!
Tip – Sometimes local teams are hesitant to give management bad news. My advice is to be honest and open at all times. If you hide things it will come back to bite you in the worst way and may even rightfully cost you your job.
When communicating status using email:
- Use a clean-consistent structured email template
- Include pictures if they add value to help management make decisions
- Always mention the next scheduled status update date and time
- Test the message beforehand on all types of devices you will send to such as mobile phones and tablets – especially if you are using rich text formatting to delineate fields in the message
Be sure to include update information such as:
- Date of Incident
- Type of Incident
- Time of Incident
- Location of Incident
- Current Status
- Business Impact Rating – Low/Medium/High
- Business Impact Description
- Overall Description
- Management Response
- Current Update
- Next Steps
- Photos Attached
- Additional Info Links – Internal and/or External Sources
- Next Scheduled Update
- History of Prior Update(s) – Optional
Tip – Be consistent. Using a structured format will enable you to deliver important information that will allow management to make decisions. There will be no surprises. Each update brands your name to management, which is an extra benefit for you. Just make certain you get it right. When review and bonus time comes around they will remember how proactive you were keeping them informed.
I would strongly suggest you also consider using a mobile Incident Management tool. I provide more info on the value of such tools in the technology solutions categories on Ultimate Business Continuity.
Notifying Customers:
Customers are critical to staying in business and prospering. Providing customers with accurate and timely information is a top priority. Customers may become aware of a problem as soon as their phone calls are not answered by customer service, sales or their orders are not processed. Your business continuity plan should include action to redirect incoming telephone calls on customer facing lines (possibly toll free’s) to an alternate call center (if available) or to recovery employees crossed-trained to take calls until you are able to get the primary staff to their recovery locations.
A voice message indicating that the business is experiencing a temporary problem can be used but I dislike using voicemail. I strive to do better than that! I only use VM as a last resort in the most extreme circumstances when all else fails and only for as long as absolutely necessary. Perhaps a few minutes until calls can be redirected to recovery personnel.
Your customer service business continuity plan should also include procedures to ensure that customers are properly informed about the status of orders in process at the time of the incident. Customer service can make outgoing calls to your most important customers. Make sure you have an accurate list of customer contact information.
You can also consider adding your customers to your mass notification system. This will greatly compress the time it takes to notify customers and to keep them regularly informed of progress throughout a disruptive event. They will appreciate it and they will remember how proactive you were! It could result in keeping them as customers in the future when the competition tries to snatch them away. You should speak with your mass notification vendor regarding any licensing concerns when using the system beyond employee contacts.
Notifying Suppliers and Vendors:
Your crisis communication and business continuity plans should include documented procedures for communicating with suppliers. Typically, I include this in plans for purchasing, facilities and all other processes that deal directly with suppliers. Also, this information should roll-it up to your division and regional plan as backup. Procedures should identify when and how suppliers should be notified. Also, remember to implement redundancy for critical suppliers and vendors along with contact details. Test the ability to contact representatives just as you would employees. You do not want to find out at crisis time that you cannot reach a critical vendor or supplier.
Notifying Government Officials & Regulators:
Communications with government officials depends upon the nature and severity of the incident and regulatory requirements. I spent a good portion of my career in the securities industry which is highly regulated. I was on a lot of calls with SIFMA, the SEC and the Federal Reserve during Hurricane Sandy. The calls were really interesting and valuable. It was cool being part of decisions that impacted the entire financial system. Make sure you have the ability to reach the proper regulators in a timely manner.
Notifying Your Community:
If there are hazards at a facility that could impact the surrounding community, then the community becomes an important audience. If so, the procedure detailing how you will achieve community outreach should be part of your crisis communications plan. This is often overlooked. Your plan should include coordination with public safety officials to develop protocols and procedures for advising the public of any hazards and the most appropriate protective action that should be taken if warned. You should have these numbers available to you for all your facilities.
Beyond Continuity Value – This can also be an opportunity to help your community. It is the right thing to do. You may have excess resources – space, food, fuel that can benefit the community and possibly help your company in the future. Remember, the community includes customers and perhaps future customers. Be a good neighbor.
Communicating with the News Media:
If the incident is serious, then the news media will probably seek you out in person, by phone or email to obtain details. There may be numerous requests for information from local, regional or national media. The challenge of managing large numbers of requests for information, interviews and public statements must be planned. In our information age requests can come from the established media or from bloggers – some of whom can be very influential. Prioritization of requests for information and development of press releases and talking points can assist with the need to communicate quickly and effectively.
Develop a company policy that only authorized spokespersons are permitted to speak to the news media. Communicate the policy to all employees explaining that it is best to speak with one informed voice. Determine in advance who will speak to the news media and prepare that spokesperson with talking points, so they can speak clearly and effectively in terms that can be easily understood. You have probably seen carefully worded responses to major cyber-attacks that frequently make front page news. I suggest you make the process for communicating to the news media part of your tabletops scenarios.
News Media TIP – ‘No Comment’ is not a good comment:
It is very important to make employees aware of the proper procedures if they are approached by a member of the media for comments during a disaster. Incorrect comments regarding the safety of an employee or the impact to your organization because of a fire or other crisis can be devastating. It could affect a family or customers. You definitely do not want them reading sensitive information in the news or hearing it on TV rather than receiving correct information directly from your organization.
In many organizations, the procedure is never to say ‘no comment’, rather it is to direct the media person to an official organization spokesperson that can make a well informed accurate statement. Employees must have awareness PRIOR to an event on the procedures and who to contact. When you develop the official process make it part of your training and awareness program. I include it in all my tabletops.
Your best course of action is to meet with HR and Corporate Communications to develop a holistic strategy, the proper language and process when communicating with the media.