Why crisis management should be more than a kinda-sorta plan in your head

When Frances Haugen told the UK Government that Mark Zuckerberg “has unilateral control over 3 billion people,” it was a major blow to Facebook. And yet, the company remains undeterred by the many allegations and blows it has received in recent years. That’s primarily because of the company’s crisis management efforts.

Back in March of 2021, Nine Network was the target of one of Australia’s largest cyber attacks, bringing the network’s many news services to a standstill for over 24 hours. The good news? Nine Network is still functioning just as it always did. The company came out of it mostly unscathed, expect perhaps that it opened our eyes to some of the very real threats we face every day. The network did a lot of things right, the most prominent of which was tweeting about it immediately, acknowledging the situation, and making sure their audience knew what was going on every step of the way.

A few years ago, Zoho’s domain provider took our domain down, citing payment delays. It was undoubtedly one of the biggest outages Zoho has ever experienced, and we were in the unfortunate position of pausing millions of our customers’ businesses. Our CEO took to Twitter instantly, apologising to our many upset customers, explaining what went wrong and what we were doing to fix it.

He also wrote a blog assuring our audience that we’d do whatever it takes never to be in that situation again, even that meant developing our own back-end internet systems. Two+ years later, and our customers still trust us and continue to do business with us.

Crisis in business

It happens to every organisation, even if we don't want to deal with it. Most small business don’t consider that high-profile crises like those highlighted above might threaten them. One of the benefits of being a small business is the agility that comes with it. You can adopt new technology, hire extra help, pivot your operations, and even take a few days off—all without making major compromises to your bottom line. However, that doesn't mean an SME shouldn't have excellent crisis management plans in place.

If you run a grocery store in your neighbourhood and one of your staff members discriminates against a customer, it can seriously damage your brand reputation. Being a small business in a small town, though often a boon, can become the bane in this case. Word travels quickly and people may start to question your values, choosing to buy from your competition instead.

Based on how long you’ve been in business in that neighbourhood, who that employee is, and how you deal with the situation all determine its impacts on your business. If you’ve been around for 30 years and you handled the situation swiftly and appropriately, then you may not face the community’s ire. On the flip side, if you’ve recently moved from a capital city to a regional town, you wouldn’t have earned the local community’s trust yet. That’s when an incident can quickly escalate into a crisis that affects your livelihood.

What is crisis management?

Most of us living in Australia have a bushfire plan. When fire season starts, we check our gutters, clear fallen leaves, and make sure we have plenty of water and hose to go around our houses and workplaces. Preparing for fire and storm season is second nature to us. That same foresight and level of precaution is necessary to prevent business crises from escalating out of control as well. Though most businesses are prepared for a natural crisis, many don’t spend enough time preparing for things like cyber attacks or data leaks.  

A crisis is anything that can potentially damage or endanger your business’s finances or reputation, your staff’s health and well-being, your customers, and the general society. These can be both internal, such as employee misconduct or issues with product or service quality, and external, like cyber attacks and natural disasters.

Crisis management describes how a business deals with these constant threats. The activities involved in this process can be categorised as:

• Pre-crisis
• During-crisis
• After-crisis

What to do before a crisis occurs

Plan. That’s the first step of crisis management. The planning phase involves a variety of activities, including appointing a crisis management team to assess the risks your business is exposed to, analyse the probability of those risks impacting your business, and formulate an action plan in case those risks eventuate.

This is more comprehensive than risk management, which is just one part of crisis management. Risks are threats that you know your business faces—like financial losses. They’re high probability situations.

Crisis, on the other hand, also considers low-probability threats like the Black Summer bushfires. Though we know fire is imminent every summer, most regions don't experience anything worse than spot fires and smoke that may cause partial closures—those are risks. 2019-2020 was an exception. It was a crisis.

Pre-crisis planning is an outline for what you’ll do during a crisis and how you’ll transition out of it without major losses. Here are a few things to prepare and set up in this stage:

• Form a crisis or critical incident management team to assess and prepare for crises
• Set up systems that regularly backup business data
• Conduct a comprehensive risk assessment
• Analyse all kinds of crises that can possibly occur, and assess the impacts each incident can have on your business

Draw a plan specifying details such as who will respond during a crisis, what messages they’ll convey, and which communication channels they’ll use to communicate with your customers and audience

When assessing how you’ll come out of a crisis, assess your financial and operational status, and consider any losses you may encounter. If your modelling forecasts that you might have to let go of employees to prevent major losses, consider what it might cost—in terms of people, money, and time—to clean up after a crisis. A cyclone would be far more financially draining than an employee who put out a discriminatory post on Facebook. However, that employee’s behaviour could cause longer-term branding issues. Your plan should be comprehensive enough to consider and cover all scenarios.

Additionally, consider how you’ll hire employees after a crisis—would you re-hire staff you may have stood down, or would you prioritise hiring new staff based on your situation at the time? Asses your financial position to decide whether you can invest in rebuilding initiatives, whether you’re opening up after a fire or investing in marketing to recover from a reputation loss. If you find that you’ll need external funds to help in your crisis recovery, consider how you’ll secure those funds.

This decision depends on your business strategy as well: if you’re a company, would you enlist as a public company to accept capital from investors, or would you get a loan? If you want to apply for government grants, how confident are you about your grant writing skills, and would you have to hire a specialist firm to help out? Asking questions and thinking through each situation is a big part of preparing for a crisis. The more thorough you are in your planning, the more efficiently you can handle a crisis when it hits.

What to do during a crisis

Put your crisis management plan into action. As soon as a crisis hits, you’ll be under pressure from all sides to mitigate impacts and steer your business in the right direction. It’s a lot to deal with. That’s why your plan should be as detailed as possible.

When Covid-19 hit Australia in March 2020, the government immediately rolled out Covid crisis payments to those who lost work. This rollout applied instantly only because the government’s Centrelink database was already in place to implement fund transfers.

Taiwan’s government has been regarded as one of the most successful in suppressing Covid-19. The reason? They had strong plans in place to deal with such an outbreak—they had quarantine facilities before most of the world even knew we needed them. Taiwan was unprepared for SARS in 2003, but after the devastation that it wrecked, the government implemented a strong crisis management strategy. When they got wind of Covid, they immediately implemented mask mandates and launched contact tracing efforts.

When a crisis hits your business, you should know what to do. Your top management should know who exactly they should turn to for answers. If you’re facing reputation damage, as in our grocery store example above, the business’ owner or their representative could make a public statement condemning the employee’s behaviour and reassuring their customers that this wouldn’t happen again. Based on the size of the business, this statement could be as big as a press conference or as small as a column in the local newspaper. If it's the latter, you should know which newspapers you’d contact to get your messages out and have a list of possible actions you’d take against that employee. At that time, you shouldn’t be wondering whether or not to compensate the customer—instead, you should know whether or not your crisis team has planned for compensation and what that looks like.

Similarly, you should also have a plan to communicate internally with your other employees. Based on how serious the incident is, other staff members may need reassurance from their supervisors. You may have to open up a discussion about discrimination within your employees and encourage staff to report incidents that may have happened in the past.

It’s important to remember that the crisis affecting your business also impacts your customers or the general public, sometimes seriously. Therefore, it’s necessary to acknowledge any harm that you or your business may have contributed to, however unintentional. In our grocery store scenario, the owner/spokesperson, while taking steps to avoid repetition, should also extend their genuine sympathies to the customer who was wronged. Apart from mitigating the impact of the incident on your reputation, it’s also just the decent thing to do.

What to do after a crisis

It's time to pick up the pieces. Undoubtedly the hardest part of managing a crisis is keeping steady as you sail through it, implement changes, and make promises going forward to avoid a repeat disaster. The post-crisis phase involves delivering on those promises.

For example, during a reputation crisis, the grocery store’s owner may have told the public that the incident won’t happen again. They may have immediately let the employee go. As the business starts to resume its activities, the owner, now held accountable, should be transparent with their audience about what they’re doing. Activities may involve conducting a workplace culture course for employees, setting up a strict anti-discrimination policy in the workplace, actively hiring people from diverse and traditionally marginalised backgrounds to help team members understand and learn from their differences, and contributing to and participating in community events to raise credibility.

As we noted earlier, crisis management is a circular process. As you come out of a crisis and take measures to recover successfully, you and your crisis management team should analyse how you handled that crisis and what you could’ve done better. The more you assess yourself critically, the more ways you’ll identify to improve your crisis planning and execution strategies.

Parting thoughts

Crisis management is a lot of work and a lot of dealing with uncertainties. We genuinely wish you didn’t have to go through the rigmarole—but we also realise that you probably should. If you’re in business, regardless of where or how big you are, you should have a crisis management plan and a team to support you through it. There’s no saying when a crisis might hit, or how. Some insurance companies offer crisis coverage, an insurance plan that can protect you against reputation damage caused by technological blunders. While it can be helpful to invest in, know that crisis insurance policies aren't exhaustive. As our natural and cultural worlds change, we’ll see even more catastrophes that can upend our lives. It’s not a reason to panic, but one to prepare for.