Having a crisis response plan can help make the company more resilient now and later.
Following a framework for crisis response planning that engages management as well as the board can create significant political capital for internal audit, not to mention better prepare the company for crises that may arise.
Multipurpose framework. The head of internal audit at a major government contractor said in a recent NeuGroup meeting that his company uses the National Fire Protection Association 1600 Standard on Continuity, Emergency and Crisis Management. He described it as a “fairly transferable” framework that can be used across a variety of scenarios, from fire drills to much more complex and resource-intensive corporate initiatives. Most members participating in the meeting were unfamiliar with the NFPA document and listened raptly as the IA chief describe the benefits.
The member noted that the company’s risk committee chairman had required adopting the framework and given the nature of the company’s business, most of its provisions were already in place.
What not to do. The member said a fascinating outcome of crisis response planning is understanding better what executives are not supposed to do or say, “particularly for the C-suite, where it’s not uncommon to have lots of type A personalities.” The exercise clarifies what each executive’s role is and emphasizes letting the crisis manager inform them about developments so they can better determine their next steps.
By promoting understanding of the various scenarios and analyzing what to report versus what to disclose, the requirements and the cadence of reporting, “We really challenged management to think about that, and it was very helpful,” he said.
Muscle memory. “Every time we went through the exercise, whether [for a major initiative], or for cyber, or an inside threat, we’d learn something new, or ask questions we hadn’t thought to ask before,” the member said. The future will always bring situations that can’t be anticipated, and he recounted a few humorous ones. “There’s always something you don’t think about, but the more you do it, it builds muscle memory,” he said.
Political capital. The member noted that facilitating these conversations in his capacity as IA was highly rewarding. “It engaged management at different levels and created political capital that has paid dividends in so many different areas for IA,” he said.
