Crisis Management
Definitions
An emergency is a localized event handled by first responders; a crisis threatens the organization's viability, reputation, or stakeholders and demands executive direction; a disaster overwhelms local resources. Business continuity planning (BCP) keeps critical functions running; continuity of operations (COOP) is the government-oriented analogue; disaster recovery (DR) restores IT systems. Questions frequently test these distinctions.
Planning
Start with a business impact analysis (BIA): identify critical processes, dependencies, and maximum tolerable downtime. From that derive the recovery time objective (RTO, how fast it must be back) and the recovery point objective (RPO, how much data loss is acceptable). Build a crisis management team with defined roles (incident commander, communications, legal, HR, operations), an emergency operations center, and call trees. Plans must be tested: tabletop, functional, and full-scale exercises, each followed by an after-action report with assigned corrective actions.
Communications
Crisis communication is planned, not improvised: pre-approved holding statements, one spokesperson, employee notification, family and next-of-kin protocols, regulator and law enforcement liaison, and social media monitoring. Both silence and speculation damage credibility.
Traps
- Confusing BCP with DR.
- Reversing RTO and RPO.
- Plans written but never exercised.
- No after-action follow-through on identified gaps.
Worked example
A flood closes headquarters. The BIA shows payroll must run within 72 hours (RTO 72 hours, RPO 24 hours). The team activates the alternate site and remote work, issues a holding statement within two hours, and logs decisions. Afterward the after-action report assigns owners and dates to each gap, the step most often skipped.