Article published in The Sentinel, a magazine for IIRSM members.
Tim Bird, Managing Director of Eddistone Consulting Ltd, examines the responsible business approach to emergency planning and response.
Let’s be honest, the current world’s a bit unpredictable. Storms, cyber-attacks, equipment failures, data leaks, supply chain issues – you name it, something’s always looming.
For businesses, it’s not enough to just hope nothing goes wrong. Every one of your stakeholders, including the passer by in the street, expects you to have your crisis and emergency scenarios nailed.
We know that being prepared for unscheduled emergency and crisis events is part of being a responsible, reliable organisation. You’ve got to manage your risks properly and anticipate every reasonably foreseeable scenario. The penalties and consequences of poor response often outweigh the efforts needed to get it right. At Eddistone, we work across 17 different sectors, helping organisations prepare for unscheduled situations and one of our favourite phrases is: “Go on then”. We encourage people during training and exercises to do exactly as they really would, access that document, contact that person, create a holding statement. Response capability competence isn’t gained by just ‘talking’ a good response, you need to try it, to make sure it’s fit for purpose.
It’s not just about planning; it’s also about trust. When something goes sideways, your team, your customers and even the public are watching how you respond. If you’ve done the work in advance, you should expect to be able to handle the situation in a systematic manner, remaining relatively in-control and calm, and retaining credibility. If you haven’t… well, let’s not go there.
So, what does ‘doing the work’ actually look like? It’s not rocket science, but it does take commitment. In the following few paragraphs, I’ve identified 10 key elements that we advocate doing routinely, in order to remain ready for whatever’s coming. I hesitate to point fingers or highlight fault in particular case studies; however emergencies and crisis events are usually hardest hitting when one of the following elements don’t go well or are incomplete. It is true that the most serious and significant events are more often, due to a combination of more than just one element not being effective.
1. Spot the hazards
You can’t manage what you don’t know about. The first step is relatively simple: identify the hazards that could trip you and your business up. Whether it’s a tech outage, a chemical spill, a PR nightmare, or a key supplier failing to deliver, someone needs to sit down, think these through and write them down.
The key is to think big picture – some scenarios are obvious, others less so. Others only show up when you zoom out, talk to your teams, and dig into the ‘what ifs’. However, these are still reasonably foreseeable in the eyes of the regulators and prosecutors. Sometimes it’s easier to get a fresh pair of eyes. My team and I help customers to be honest with themselves and ask whether the situation is reasonably foreseeable and mostly the answer is ‘yes’.
2. Assess and monitor your risks
Once you have identified the potential hazards, the next move is to figure out which are most likely, and which could hit you hardest and to what degree. This isn’t a one-off exercise. Risks evolve – especially with changing regulations, new tech and global events – so they need to be looked at regularly.
We see our customers using parent and daughter risk registers, with one informing the other. We help facilitate regular reviews and critical team input to stay sharp. In this way, the business stays informed and can change or improve and adjust the risk control measures.
3. Clear approach to emergency and crisis documentation
Let’s say something does go wrong. Who does what? Who makes the call to evacuate? Who tells customers what’s going on? Where are the emergency contacts?
Three things set up the response for success, from the initial moment:
- Clear roles and responsibilities.
- Simple systematic response approaches specific to each level of the organisation.
- Availability of familiar role-critical information, for example: shift leader shutdown, neighbour contacts for the security team or additional legal counsel for the crisis team. The information should be familiar because the team members have attended valuable training.
We have tried and tested systematic approaches for all three levels of response – operational, tactical and strategic – and these don’t rely on check sheets or action lists. They are as simple to remember as ABCDE and they help you to figure out what the situation really means and determine some meaningful actions. During a response Organisations need their response leaders to be familiar with these systematic approaches and able to overlay these to the site, hazards and/or business.
We create documents with easy-to-read information and engaging content, in line with the Health and Safety Executive’s Reducing error and influencing behaviour study (HSG48) and other best practice. We’ve been saying for a long time that weighty emergency plans are not referenced in an emergency. However, as events extend, additional time becomes available and you should delve into technical plans and reference material to make the difference between recovery and extended uncertainty.
Agreed, we need to create a plan and a reference manual. We need policy. But we need to make it all valuable.
4. Train like it’s real
Plans do not work if no one’s trained to follow them – it’s that simple. Training consists of two parts: training individuals to work alone and training individuals to work as a cohesive team.
Let’s look at individuals first. Competency isn’t just reading and signing your name. Individual competency is about skill, knowledge, abilities and behaviours. Competency is about explaining the ‘why’ behind the individual’s role and giving them a chance to practice and demonstrate it. Assessment of competency includes using some kind of competency framework to validate a candidate’s abilities.
Eddistone trains more than 200 operational and tactical response team leaders per year against lawful competencies through a series of accredited training courses. We’ve trained team members to deliver actions at the right time, to predict outcomes and complete proactive actions to expedite mitigation of any impact.
We give leaders systematic approaches, which help to decipher the complications of emergency response and incident management.
Let’s look at individuals acting as a team. From fire drills to cyber breach scenarios to crisis communications, it is imperative to put time into real-world training. You don’t want your first test to be a real emergency. It’s not enough to say that you have done some training – you should know if your team can actually do what’s needed, and that’s where validation exercises come in.
We often hear observations and comments along the lines of: “In reality I would do such and such,” “Normally I would…,” or “If this was real, I would…” In response, we say: “Go on then!”
Our simulation equipment creates immersive environments where team members ring 999 or the operations manager’s mobile. We introduce ourselves as fire service officers and request briefings and create learning points and experience which are as real as can be.
5. Use best practice, not guesswork
You don’t need to figure it all out on your own. There are industry standards, proven methods and plenty of real-life case studies to learn from. The best-prepared organisations borrow from what works, tailor it to their business and apply it consistently.
The most forward-thinking Eddistone customers often ask:
- How do we stack up against a gold standard?
- Can you help us improve?
- Can you help us us engage with our stakeholders and build resilience?
They benchmark and improve because they know that guesswork is risky, and adopting what works is smart.
6. Test, test and test again
Here’s where everything gets real. Testing your emergency plan is non-negotiable. This is where you find the holes, fix the problems and build corporate memory. It might be a desktop scenario where you walk through an event step by step. It might be a full-scale simulation that flexes the limits of your systems or people. However you do it, the aim is simple: make sure the planned arrangements are fit for purpose.
Some of the most resilient Eddistone customers exercise and test quarterly, run spot drills and follow every test with a debrief. The sooner team members understand that exercises are not about catching people out, the sooner the response becomes faster and more effective.
7. Keep communication front and centre
In a crisis, people want information fast. Your internal team wants to know what’s happening. Your customers want to know they’re still in good hands. Your stakeholders want reassurance.
That’s why a good communication plan matters. Plan in advance who speaks for the company, what channels you will use for your communications and prepare some reasonably foreseeable messages.
We’ve seen Eddistone customers get through a crisis by being calm, clear and human when things go wrong. They were not over polished or defensive, just honest and decisive – an approach that builds trust with every stakeholder.
8. Lead from the top
Emergency readiness is not the reserve of the health and safety or IT teams alone. Responsibility to drive this sits at board level. Senior leaders should care just as much about resilience as they do about revenue.
Responsible organisations ensure emergency planning is part of their governance framework and ultimately environmental, social and governance (ESG) scoring. We see key staff within organisations develop in confidence and competency and those organisations that need to also gain compliance.
Every organisation should delegate authority to react, ask the tough questions, invest in resources and support the team members who are doing the work.
Why it all matters
When a crisis hits, your response is a direct reflection of your values. Eddistone customers are on message with this, and that’s why they invest in preparation – not because it’s required, but because it’s right. When things go wrong (and they will at some point), the businesses that are ready protect their people, their operations and their reputations. They earn respect, they show leadership and, most of the time, those organisations bounce back faster.
A short article like this can’t do justice to the multiple facets of emergency response but preparedness doesn’t have to be rocket science and it doesn’t need to sit on the difficult pile. So, what are you waiting for? Go on then!
