A five stage framework for a crisis management process

Threat, uncertainty, and the need for some form of immediate response are generally considered common features of crises. Crises may be intentional (e.g. terrorism, sabotage, sustained unethical management) or unintentional (e.g. natural disasters, economic downturns, product failures). There are two broad approaches to the managing of these events:

(1) Try to keep them from reoccurring, and (2) mitigate or soften the impact of the crisis when it does occur. Crisis management is the discipline that addresses these two approaches.

To solve a crisis an organization needs to have a framework, a way of visualising crisis management through the lens of a particular viewpoint. In this article a framework for approaching organizational crises will be presented.

Introduction

Most organizations will face a crisis at one point or another. “A crisis represents an unstable time when a decisive change may be impending,” (Fink, 1996) and “has the potential to seriously undermine the organization’s image, financial standing, and personnel,” (Mitroff, 1989).

A “crisis interrupts normal business transactions and can sometimes threaten the existence of the organization,” (Monathan, Brendam, 2023), therefore, a timely and appropriate response may be “critical in reducing, offsetting, and containing harm,” (Armstrong, 2023).

While some crises “might occur as an accumulation of ‘normal errors’,” (Phelps, 2018), others may be attributable to external events that lie outside the company’s control.

Regardless of the genesis of a crisis (external or internal) and its causes, the consequences of mishandling a crisis could be severe and range from a tarnished reputation to financial penalties and legal costs.

In the following article we will define what crisis means and the components of a framework for crisis management will be presented.

Crisis definition

The definition of a crisis must be established before a suitable framework can be developed. Numerous definitions have been offered and most synthesise previous definitions to some extent. Fink (1996) offered one of the first of the comprehensive definitions:

“An organizational crisis is a low-probability, high-impact event that threatens the viability of the organization and is characterised by ambiguity of cause, effect, and means of resolution, as well as by a belief that decisions must be made swiftly.”

The most important aspects of the definition are:

• A crisis is a low-probability event. This characteristic makes the planning for a crisis even more troublesome. Events that are not perceived to be imminent are hard to plan for. In addition, it is often difficult for management to find the motivation to plan for such an event. The notion is, “Why plan for something bad if it may not occur?” (Kovoor, 2020). Many managers have asked that same question; until they got hit with a big crisis.
• A crisis can have a high-damage impact. Because of this reality, it should be remembered that a crisis can devastate an organization, drive it into the ground, kill it, or, at best, leave it reeling.
• The reference to ambiguity means that the causes and effects of the crisis might be unknown, at least initially.

Another definition is the one presented by Monahan (2023) it states:

“A crisis is the perception of an unpredictable event that threatens important expectancies of stakeholders and can seriously impact an organization’s performance and generate negative outcomes.”

This definition emphasises perception. A crisis is generally perceived to be a threat by the organization’s stakeholders. Stakeholders are various groups that have an interest in the organization.

One of the most recent definitions is the one developed by ISO 22361:2022. This global standard defines a crisis as an “Abnormal or extraordinary event or situation that threatens an organization or community and requires a strategic, adaptive and timely response in order to preserve its viability and integrity.”

This definition is instructive for a number of reasons:

• A crisis is unusual – it is not part of business as usual and crisis management is therefore different to business continuity management.
• Crisis management is a function of top management and is strategic in its response – it may provide guidance to emergency and incident response teams, but it is not involved in the actual delivery of this response.
• A crisis is an existential threat to the reputation and the viability of an organization and therefore may require a whole of organization response.

In this article the crisis definition guidelines offered above are considered and a new definition is created, which can be followed for the creation of a framework for crisis management.

A crisis is defined here as: “An event that has a low probability of occurring but, should it occur, can have a vastly negative impact on the organization. Its resolution should be approached as quickly as possible. A crisis can affect the organization’s strategic objectives, its reputation, and its viability.”

Developing a framework for crisis management

What is a crisis management framework and why is it important? “A crisis management framework is a structured approach that outlines processes and procedures for effectively managing crises within an organization,” (Crandall, 2020). It’s important because it provides a roadmap for navigating unexpected challenges, minimises confusion during crises, and helps mitigate potential risks to the organization’s reputation and operations.

A framework is a way of visualising crisis management through the lens of a particular viewpoint.

Figure one presents a five stage framework for a crisis management process. In this five-stage framework there is an analysis of both the internal and external environment of the organization.

Figure one: A five stage framework for a crisis management process.

Each stage is as follows:

Anticipate

The anticipation stage comprises of three specific capabilities: the ability to observe internal and external developments, the ability to identify critical developments and potential threats, and, as far as possible, to prepare for the unexpected.

Considering the internal environment, the organization has to develop a system of threat intelligence that will allow the organization to identify the general industry threats and those unique to the organization, including its location or region, market, products, and processes. After identification, risk assessment for likelihood and the expected severity of the impact need to be carried out. Then warning signs for each crisis need to be identified. These assessments will assist with prioritising actions and allocating resources.

Organizational capabilities are assessed, a response plan is designed, a crisis response team and other responders are trained, and exercises are developed to practice the actions of the recovery teams, simulating crisis scenarios.

Considering the external environment, it focuses on events occurring outside of the organization. Here, an industry vulnerability assessment should be developed to find out the types of crises a specific organization could encounter. For multinationals operating overseas the degree of political stability of the host country is important to consider.

The technological ramifications of the industry must also be considered as part of the external environment.

Prepare

Considering the internal environment, the prepare stage begins with the forming of the crisis management team. This team acts as the body that prevents or manages crisis events. One of the tasks of the team is to periodically assess potential crises that may happen to the organization. The next step is performing a risk assessment to identify the main crisis scenarios which have the possibility of damaging the company. For each scenario a crisis plan is developed. A crisis plan is the core of an effective crisis management program, providing critical structure and guidance when an unplanned event strikes. Effective crisis plan development includes articulating scenarios that rise to a crisis level and how to assess the impact.

At this stage the organization ought to develop an emergency communication system. An emergency communication system facilitates rapid and effective communication during crises, ensuring timely dissemination of critical information. Organizations need such systems to minimise response time, protect assets, and safeguard their most valuable resource – their people.

Here, also, training plays a very important role. The crisis management team needs to increase their competence in several things, such as conflict management, cause analysis, brainstorming techniques, among other needs. A program of exercises and tests needs to be developed. Crisis scenario identification plays a very important role.

Considering the external environment, the organization has to look at what is going on in the industry to prevent and manage crisis events. Existing government regulations in many industries are designed to prevent a crisis from occurring. Almost all industries impose additional standards through associations that exist for that particular industry.

Another very important issue at this stage is the development of effective working relations with the media.

Respond

Crisis response is the phase of crisis management that involves implementing various plans and strategies to address and mitigate the impact of an unexpected event or emergency situation. It can encompass a range of actions aimed at managing the immediate consequences of the crisis.

Regarding the internal environment a crisis response plan needs to be activated if a crisis occurs. Crisis response planning provides the guidance, training, and resources an organization needs to ensure that each crisis does the least damage possible to its operations, assets, and people. Having a crisis response plan in place before a crisis occurs offers many benefits in that critical moment.

The strategic level in the organization should develop the crisis response plan. The typical development steps include:

• Risk assessment and scenario planning: the assessment of potential crises and their risk to the organization are identified.
• Establish a crisis management team, assigning people with the roles they will take when a crisis occurs.
• Develop response procedures and protocols. This includes defining the scope of the crisis response team, the type of crises they can handle, their level of authority, and determining the communication protocols.
• Training and exercises. It is vital that both crisis response leaders and their teams go through training and exercises to ensure that they are ready to act swiftly and competently when a crisis occurs.
• Review and update regularly. Tools, resources, and risks are constantly changing, so it is important to review and update the crisis response plans regularly.

The crisis response plan also needs to include a crisis communication plan. This is a set of guidelines which include communication steps to take when a crisis first emerges. Organizations must be prepared for rapid misinformation spread, public scrutiny, and evolving narratives.

Recover

The recover stage looks at the actions taken in the aftermath of a crisis to return organizational operations to their previous state and to mitigate the potential effects of future crises. Recovery consists of those activities that continue beyond the emergency period to restore critical functions and to manage stabilisation efforts.

The first step in a successful recovery is conducting a thorough assessment of the damage. This involves both physical inspections of the facilities and a review of the IT infrastructure and data integrity. Creating detailed reports and documentation during this phase will also help in communicating with insurance providers and in planning the restoration steps. Parallel to the site assessment, it is crucial to evaluate the impact on employees and customers. Once the damage has been assessed, the next critical step is to secure the resources necessary for recovery. At this stage the development of a comprehensive recovery plan is vital. It involves setting clear goals and timelines for restoring operations.

Concerning the internal environment, actions have to be taken to return the organization to an operational status as soon as possible.

In terms of the external environment, communication has to be established with all stakeholders explaining the situation and the status of the recovery process. Stakeholders include clients and regulators.

Learning

Learning the lessons from incidents and exercises is a vital aspect of the crisis management process, but to enable this the goals and criteria for success need to be defined. These consider how effectiveness, efficiency, and appropriateness of actions and decisions will be measured.

Key lessons learned from the crisis management process should be identified and prioritised. These are insights and recommendations that will help improve crisis management policies, procedures, practices, and skills.

The lessons learned should be categorised according to the different phases of the crisis management process: anticipate, prepare, respond, recover, and learn. The lessons learned should be ranked according to their urgency, importance, and feasibility to determine which require immediate action, which need further planning, and which are optional or long term.

The final step is to implement and monitor the changes that the organization has decided to make based on the lessons learned. A clear and realistic action plan, with specific objectives, tasks, responsibilities, timelines, resources, and indicators has to be developed. The action plan should be communicated to all the relevant stakeholders and their feedback and support requested. 

Crisis management and resilience

Crisis management plays a vital role in safeguarding the stability and continuity of businesses and organizations during times of unexpected disruptions. It encompasses a range of strategies, processes, and training aimed at effectively responding to, recovering from, and mitigating the impacts of crises. With the ever-increasing complexity of modern industries and the potential for various emergencies, companies are recognising the need for robust crisis management practices to protect their people, assets, and reputation. Crisis management is a core aspect of resilience.

 Bibliographical references

• Alexander, Alberto. Managing Operational Resilience. Resilienceforward.com October, 2023.
• Fink, S. Crisis management: Planning for the Inevitable. New York: America Management Association, 1996
• Mitroff, I. Programming for crisis control. Security Management, pp. 75–79, 1989.
• Smith, D. Beyond contingency planning: Towards a model of crisis management. Industrial Crisis Quarterly, 4(4), 263–275, 1990.
• Armstrong, Sarah. Effective Crisis Management bpb UK, 2023
• Phelps, Regina. Crisis Management Chandi Media, CA, 2018
• Crandall, William. Parnell, John. Spillan, John. Crisis Management: Leading the New Strategy. SAGE, UK, 2014.
• Monahan, Brendan, Strategic Corporate Crisis Management. Routledge, New York, 2023
• Kovoor, Sarah. Crisis Management: Resilience and Change. SAGE UK, 2020
• Crandall, William. Crisis Management: Leading in the New Strategy Landscape, Sage Publishing, 2020
• ISO 22361:2022 Security and Resilience Crisis Management – Guidelines

The author

Dr. Alberto G. Alexander holds a Ph.D from The University of Kansas and a M.A. from Northern Michigan University. He is a MBCI, BCMS, IRCA Lead Auditor and Approved Tutor. He is the managing director of the international consulting and managerial training firm: Eficiencia Gerencial y Productividad SAC, located in Lima, Peru. He can be contacted at: alexander@egpsac.com He is currently Professor at the Graduate Business School of ESAN University, Lima, Peru.