Crisis Management
Incident, emergency, crisis
An incident is a disruption; an emergency threatens life or property; a crisis threatens the organization's viability or reputation. The same event can escalate through all three, and the exam will test whether you can tell which phase you are in - because the priorities change.
The framework
Emergency management runs through four phases: mitigation (reduce the chance or impact), preparedness (plan, train, exercise), response (act), and recovery (restore). Start from an all-hazards vulnerability assessment rather than a list of scenarios; the response structure should work whether the cause is a fire, a flood, or a shooter.
Continuity vs recovery
Business continuity keeps the whole business functioning during disruption; disaster recovery restores technology and data. The business impact analysis identifies critical functions and sets RTO (how long you can go without the function) and RPO (how much data loss is tolerable). An order system with a four-hour RTO and fifteen-minute RPO dictates a very different architecture than one with a week and a day.
Crisis team and communication
A crisis management team needs a leader, operations, communications, legal, HR, IT, and a scribe - plus a designated spokesperson. Communicate early, accurately, and with empathy; saying "we don't know yet, and here is when we will" beats silence. Plan for internal, external, media, and family audiences separately.
Traps
- Treating a written plan as preparedness; untested plans fail.
- Confusing BC with DR, or RTO with RPO.
- Skipping the after-action review, so the same failure recurs.
Worked example
A fire closes headquarters. Priority one is life safety and accounting for people; two, stabilize the incident; three, protect assets; four, resume business via the alternate site and remote work. The after-action review then feeds mitigation.
Rule of thumb: life safety, incident stabilization, property protection, business resumption - in that order, every time.