Your Risk Management Process is a poor Crisis Response Plan
A fair bit of confusion exists in business silos about risk management versus crisis management.
I say this because one of our prospective clients encountered [and freely shared] a pretty interesting hurdle while initiating their crisis management strategy and companion Comms plans. The hurdle seems to be an Executive Perception that you don't really need a Crisis Response Plan, if you already have a beefy Risk Management Manual or Risk Management process in place.
In our experience, while your risk management plan and your business continuity plan and your crisis response strategy must all be related - and mutually referencing - they ain't the same thing, and don't have the same tasks or purpose.
Let's start with a couple of key differences between risk management manuals and crisis response strategies or plans:
Generally, risk management plans attend emerging or potential risks, their likelihoods and imagined severities. While they cite causes, consequences and effects, they tend to be somewhat thematic and broader-brush by nature.
Crisis management strategies, however, are mainly devised to deal with actionables and specifics pertaining to curbing actual crisis incident devastations. Often, crisis plans are incident-tailored and activity driven in their mission to negate damage and discomfort, and restore BOSAU 'business-or-service-as-usual'.
To give a crude and imprecise analogy from the funfair: Risk Management is like a session in the fortune teller tent envisaging the future, while Crisis Management is closer to 'rescuing' valuable trinkets from a goodie-filled pond, using nets at the end of long sticks. Applied theory vs actionable practice, I'm musing...
I'd further add that Risk Management is often seen as a proactive and long-term science while crisis management tends to be perceived as a more immediate brief. [But in truth, while the Crisis Management deliverables become most visible when the ships hit the flan, Crisis Strategies can be just as long-term as Risk counterparts, although rarely treated with the same gravitas, you could argue].
Now, I'm in no way denigrating Risk Management; I mean, look at all it has got going for it as a discipline...
They take the long view and relate very closely to your routine operations
They are proactive in how they assess, accept, avoid, stem and transfer risk
They're obstacle spotters and dismantlers - which is a bloody valuable endeavour
They are squarely aimed at ensuring you can keep on-track in pursuing your goals
Yet let’s remember that a good crisis management plan is not short of rightful admirers either…
It's ever vigilant, scenario scanning and intel-tracking live for the first sniff of danger
It can react with clearly defined roles, responsibilities and resources at a moment's notice
It's instantly on-the-ground to alleviate pain with remedies and support
It's collaborating with third parties to protect people, property and potential contagions arising from any further incident blow-up.
Recognising that the disciplines are complementary seems entirely reasonable. And there's certainly no need to bias one subject over the other. Yet it's surely to the organisation's best benefit that they are also accepted, designed and enacted as quite discreet specialties, which have shared interests but different skillsets ?
However, if your risk management strategy does include a forensic and weighty chapter on crisis response planning and crisis mitigation strategies detailing who-does-what-and-why-when-what-went-wonky, why that's a different matter. Of course, if the risk management instructions are too unwieldy, thematic or hard to apply when the crisis erupts then you have another set of problems to tackle.
And that why your Risk Team should form a Brains Trust with an expert Crisis Crew; in order to design the most applicable and usable plans that spot issues, react appropriately and fix problems nimbly before, when and after they emerge.
A risk management template is simply not the same thing as a crisis response plan.
Do you know The Drill ?