BUSINESS STANDARDS
is the online magazine of BSI Group, highlighting the vital role that standards play in today's business environment by helping organizations improve quality, save money, reduce risk and be more sustainable. Features include interviews with leading business figures, as well as news on the latest developments in management systems, standards, testing, healthcare and certification.

Business Standards > Articles

Crisis talk: PAS 200 Crisis Management

29 Jun 2011
Topics: PAS 200, Crisis Management, Guidance and Good Practice, Business Continuity Management

Can management, policies and frameworks be implemented in advance to help you handle a crisis promptly and effectively?

As far as the global media is concerned, it often seems that any event can be branded a crisis for the sake of a headline - a fall in consumer spending, heavy snowfall hindering holiday plans, or even your country crashing prematurely out of the World Cup. But what really marks something out as a crisis and, once a potentially catastrophic chain of events has been set in motion, how can you contain it?

Currently being finalized, BSI standard PAS 200 Crisis Management. Guidance and Good Practice attempts to provide some answers. It is designed to raise awareness of just how crisis situations can arise and suggest practical steps for containing them effectively.

By understanding its vulnerabilities, an organization becomes more resilient. It is prepared for the worst, can recognise the warning signs earlier, and has the resources ready to take action as appropriate.

"PAS 200 will describe what a crisis is, how you identify one, and suggest ways of handling the situation to limit damage most effectively," says BSI sector content manager Tim McGarr. "But you need to read and reflect on the issues raised well in advance of a crisis - not when one hits."

Reputation risk

However, PAS 200 is clear that crises are not to be confused with other business continuity management (BCM) incidents. They can present different challenges, demand a different response, and have consequences that could be both severe and enduring.

A possible example in the recent global financial "crisis" was the run on bailed-out UK bank Northern Rock. It was the first such incident the country had experienced in 150 years, with a rush to withdraw around £2bn from bank accounts in a single weekend.

Another might be last year's tragic explosion on BP's Deepwater Horizon Rig in the Gulf of Mexico. Chief executive Bob Dudley has spoken of "a corporate crisis that threatened the very existence of our company - a major loss of value and loss of trust."

"One argument is that you don't attempt to differentiate between a crisis and an incident," says McGarr. "But, many people feel that a crisis is different; it is something that could truly bring a business down and, therefore, a different approach is needed."

For example, he continues, one PAS 200 recommendation is to have a clearly defined crisis management team, separate from other business continuity measures and operating at a senior level in an organization.

However, the standard also makes clear that assumptions should not be made about an individual's fitness for a crisis management role based solely on criteria such as seniority. As crises often arise from previously underappreciated risks, a different response could be needed, requiring different skills.

"Crises, as we have defined them, have potential implications that are more complex, more far-reaching, subtler and more fundamentally strategic than those of most incidents," says Mark Leigh, courses director at the UK's Emergency Planning College (tasked with improving national resilience through training). "In such cases, prepared solutions are unlikely to be the most optimal - so crisis management is fundamentally about building the capacity to cope with the unexpected."

Indeed, PAS 200 explicitly recognizes that those managing a crisis might need to step outside of standard rules. It therefore recommends careful identification and training of people with the most relevant skills - wherever they may be found in the management chain.

"The keynote purpose is to present the most senior managers with an outline strategy for building and developing effective crisis management mechanisms," Leigh explains.

Media management

Another key feature of crises that PAS 200 highlights is their tendency to attract uncomfortable external attention. Media frenzies mean people and policies can come under intense scrutiny, and individual employees may have to deal with distressing subjects and extremely demanding workloads. This is another good reason to ensure a team has all the necessary skills in place before a problem presents itself.

For example, the standard outlines how those managing processes may need to choose between competing communication priorities - the urgency of releasing any useful information as early as possible and the desire to have the most accurate picture of a complex problem.

It also calls for a detailed crisis communications strategy - taking account of all stakeholders, but separating them as to which information to impart, and how and when to do so.

External communications were clearly a particular concern in the reputation management of BP. With the oil spill dominating the mainstream media, the business even dedicated a clear section of its website to the disaster, with a response timeline, regular updates through pictures, videos and response maps, and interviews with key players on social media sites.

Then the company released the results of its internal investigation into the accident, with 25 recommendations for future organizational changes. This also exemplifies another aspect of PAS 200 - optimizing information management to learn useful lessons for the future. PAS 200 describes information as the "key asset" in crisis management. Whether caught in time to prevent a crisis or not, it should be formally processed and used as a basis for future decision-making.

A new safety and compliance function was then also announced, together with reviews of both employee reward strategy and management of third-party contractors. Dudley said that these were "the first and most urgent steps" in rebuilding trust in the business - a trust that was "vital to the restoration of shareholder value".

Planning ahead

However, the PAS 200 framework has the potential to help an organization regardless of its field or where it does business. Indeed, intrinsic to the concept of a crisis is that the underlying faults or factors can all too easily go undetected. "Crises tend to be products of unforeseen risks, or risks that combine and present in unforeseen ways," says Leigh.

Even so, BSI Americas product manager Robert Whitcher suggests that it will probably prove most useful to larger companies, which may operate in several locations worldwide. As a business expands, he explains, its risk profile inevitably becomes more complicated.

In the US, moreover, the standard's themes complement the Department of Homeland Security (DHS) Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep) - an initiative adopting just three standards, including BSI's BS 25999 Business Continuity, to promote private sector preparedness in any line of work. Introduced following a recommendation of the 9/11 commission, the program allows businesses to be independently assessed for emergency preparedness, and certified for up to four years if successful.

While stressing the important differences, PAS 200 also shares some points in common with such risk management frameworks. "The model of crisis management is complementary to the BCM lifecycle model, but also goes beyond it," Leigh explains.

For example, it offers guidance for creating crisis management plans, suggesting that - like business continuity plans (BCPs) - these should be subject to rigorous and ongoing review. Global private equity firm Altius Associates is just one of many to experience the benefits of a BCP, gaining both internal and external reassurance that normal business can quickly be resumed in the event of a disruption.

"Things do go wrong and the unexpected happens," says Altius' head of client services, Adam Heaysman. "Since the terrible events of 11 September, 2001, more customers are asking for evidence of their partners' business continuity credentials to ensure that they can continue to provide services in the event of an incident, whether that be a terrorist attack or something more mundane such as a power failure."

The key management system principle of continuous evaluation to secure improvement is just as relevant to building a crisis management plan. Together with the other practical points covered by PAS 200 it will form a robust, reassuring and flexible framework of resilience, enabling a proactive and timely response should a true crisis strike.

---

Register your interest in PAS 200.

For more information on business continuity management.

Business Standards © 2010. Editorial produced by Caspian Publishing in association with The British Standards Institution. Editorial opinions expressed on are not necessarily those of BSI Group or Caspian Publishing. Neither Caspian Publishing nor BSI Group accept responsibility for advertising or editorial content, nor for that appearing on linked third-party websites. Reproduction in whole or in part is forbidden without written permission from BSI Group or Caspian Publishing.

Question: Why is ISO 9001 still relevant?

This question has been raised before and at BSI, we make certain to ask the question as a matter of course. The forthcoming update to the standard - ISO 9001:2008 Quality management systems. Requirements - is the result of just such questioning.

Read more

Have a standards-related question for BSI or a comment on the website? We'll find the right person to answer.