Recently I had an interesting meeting with a fellow Business Continuity/Disaster Recovery professional regarding roles and responsibilities. There were stating that the place they were working at had a great Crisis Management Team (CMT) structure and actively promoting how it represented their organization. Wonderful, I’m thinking to myself. Then I happened to chat with someone else who worked at the same company (an acquaintance) who noted she had no idea what her organization CMT would do in a disaster; who was on it; or what the roles were. In fact, she had no idea there was even a CMT in place. Now, of course, there is an obvious gap here with communications and awareness but the point here is about the CMT team.
It reminded me of another instance where I was chatting with a person at a local professional gathering and she just happened to mention she was a member of her company’s CMT. She went on to say overall, she didn’t know why she was on the team and didn’t know what was expected of her. You see, she’d been assigned to the “Administration” team but worked in Finance and didn’t do any administration task as part of her regular role and daily activities. I thought this mighty odd. How could someone on the CMT not know what he or she are supposed to be doing, what they are responsible for or even why they are on the team?
I think it’s because corporations build their CMT structures that don’t reflect their own corporation. They follow other structures in place like the ones proposed by the Disaster Recovery Institute (DRI) or the Business Continuity Institute (BCI). I’m not saying that either of these are wrong or that there is anything wrong with them – they’re quite good when you’re starting out and developing a CMT team and structure. However, when a CMT is developed it must reflect the organization and it must be something that people assigned to it, can utilize to full efficiency.
If someone assigned to the CMT doesn’t know why they’re a part of the team or what they are supposed to do as part of the team, do you think it will be a successful and effective team? Probably not. That’s because many organization create team structures that don’t reflect the actual organization and include people assigned to positions and responsibilities for which they aren’t responsible for during their normal operations. In my earlier example, this lady was assigned to administration work that she didn’t do on a normal basis. It probably means that she reports to someone she may not even know during her daily work routine. So when she is called upon to be part of the team – because of some disaster or other reason the team is activated – she won’t have any idea what to do.
I remember her asking me, “Why on earth does she suddenly become responsible for things she doesn’t do on a normal basis and isn’t responsible for when there isn’t a disaster?” I assumed she was being rhetorical and really couldn’t provide her a response anyway. Why do we reassign people to different roles when a disaster strikes and the disaster team kicks in? It makes no sense when the appropriate skill sets are probably already in existence throughout the organization, so why not utilize them instead of reassigning them?
This is why organization don’t create good CMT team structures. They throw people together that don’t normally work with each other, assign them roles and responsibilities they don’t normally do and create teams that under normal circumstances don’t exist within the organization.
If a Finance team already exists (as an example) in the organization, then those same managers and employees should be part of the CMT and take on the role and responsibilities of the Finance team during a disaster. That way the roles stay the same with those individuals that actually have the skills to do them and not be reassigning the role to those that don’t know it. I know that is a simple example because many organization (if not all) have some sort of Finance department or function within them but you get the idea.
Another thing that ends up happening with these structure is that people end up reporting to people they don’t know, understand, or that understand them, and that have no idea how each other operates. Why? Did the Director of Finance suddenly forget how Finance operates and the function is suddenly the responsibility of the IT Director?
As a side note, I’ve actually seen a structure many years ago that stated in no uncertain terms that if a disaster struck, the Human Resources function and the Finance functions – along with many others – were suddenly the responsibility of the IT Vice President. I asked him if he knew this and he said no and wanted to know why he suddenly had responsibility for them. Did the VP’s or Director’s of other areas suddenly believe the IT VP was super hero and knew everything? We changed the structure shortly thereafter to reflect the organization properly.
Back to the other point. I report to Sally on a regular basis and we had a great working relationship – even a friendship. A disaster strikes and suddenly reporting to Bob, who I don’t know and have never had any dealing with. Which one am I going to feel more comfortable with when I’m finding issues or resolving issues? It’s natural for me to update Sally first so she know where things are and how things are progressing, even if she isn’t part of the CMT team. Bob – though knowledgeable he may be – is just someone who is on the CMT team, not someone I know how to communicate with or feel comfortable with. Let’s face it, during a disaster I’d rather be around those I know and draw strength and support from than those I don’t know and don’t feel comfortable around. Communication demands go up while the time to communication and investigate go down (during a disaster) so I’d rather be talking with someone I know than someone I don’t. It helps me work on the issues I need to do because we have already established a working relationship – Sally and I.
So why create a CMT that doesn’t reflect the organization? It’s because they take what methodology is out there and simply overlap it to their organization. In many instances it doesn’t work, as an organization can be quite complex. That doesn’t mean the CMT structure has to be complex but it does have to reflect the organizations nuances and intricacies. If it doesn’t, things will be missed and the team will be ineffective.
The Business Impact Analysis (BIA) will help identify the various roles and responsibilities that exist within a corporation so it can be the base upon which to identify the key areas of responsibility for the CMT team. That doesn’t mean that every single department must have a representative on the team. It does mean that the roles and responsibilities (and activities) of the CMT can be detailed to a greater degree so that people can become familiar with the various considerations and decision they’ll have to make when they’re on the ‘hot seat,’
Finally, if you want a good CMT then rehearse and exercise it. Don’t assume everyone knows what to do and how it should be done. You’ll only end up proving that no one knows and confusion runs rampant. Whether exercising is done as tabletops or some other exercise initiative, make sure it gets validated and people get the opportunity to practice the roles and responsibilities they – or their alternates – would be required to initiate when the CMT is actually activated. If they get to practice, they will have the opportunity to make the CMT more robust and find the gaps that may exist; gaps you don’t want to be finding when a real situation occurs.
So my suggestion to you dear reader, is to adapt the right CMT structure (or whatever name you want to give you team structure) to your organization. Don’t try to adapt your organization to a specific structure or methodology. That doesn’t mean that the methodology or examples out there can’t be utilized to be a base model upon which to build your team but it does mean that the team must be established in a way that will offer the best benefit to the organization when a disaster strikes. A corporation is complex to operate on a daily basis, so if you’re trying to run a corporation through a disaster, the CMT that is put in place better be able to manage the increased level of complexity as a result of a crisis or disaster. Get the right people in the right spots and ensure that the structure doesn’t deviate from what everyone in the corporation is used to. A CMT structure may look good on paper and look effective but if you change all the rules and structure of an organization and the CMT doesn’t reflect that, then there’s a chance it may not work when it’s needed.
So make your CMT structure strong – and you’ll be better for it.
The new book by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3, “Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a Social Responsibility.” Available at www.stone-road.com **