Facilitating an exercise? Find out how to reel people in!
Last month, I showed up at a client’s manufacturing site to facilitate an annual tabletop exercise. The company had recently kicked off its crisis management and business continuity initiative, so I wasn’t surprised to walk in and hear several people ask what this meeting was about, and how long it was going to last.
It is commonplace within organizations to have initiative atrophy or program of the month syndrome. People are doing more with less. Everyone is highly skilled at prioritizing work and recognizing false positive initiatives. Crisis management and business continuity can quickly get categorized as a ‘not now’ or ‘postpone as long as possible’ project in this environment. Therefore, it is important for risk and security professionals to allow our stakeholders bring themselves into the program. We need them to want the program and value the work we need them to do.
In my experience, there are usually three different types of people sitting in the room.
First, you have your evangelists, or your program advocates—they’re often the ones leading the initiative or they’ve already experienced some kind of catastrophic event. On the other end of the spectrum are those who have already decided risk management is irrelevant, so they’re checked out and sighing loudly.
But almost everyone in between is a good corporate citizen who has showed up with a printed copy of their plan because they were told to. Other than the occasional email, they’re not used to thinking about risk. You can’t blame them for wanting to just get the meeting over with and get on with their lives.
This mindset, unfortunately, is not uncommon. Whether people are unaware of the program or struggle to understand its value, it’s important to recruit them as active participants. So what are we as risk management professionals to do?
Here’s how I have approached this challenge: before beginning any exercise, I preface it by acknowledging common questions and concerns. Here’s what I tell them:
Before we get started, I want to discuss three questions.
Question #1: Be honest ... how many of you want to be here?
Usually, only a few people raise their hand. Sometimes I even have to solicit support from the program sponsors. We usually get a good laugh with this one.
Why are we so turned off by crisis management and business continuity management?
One of primary reasons is because risk management is extremely difficult for people to process cognitively. It is not natural or intuitive. Here are just a few well-researched and documented reasons by Max Bazerman (book: Predictable Surprises):
- Delayed Benefit It is very difficult for us to make a definite and immediate investment (time, money, and resources) for a probable, delayed, or ambiguous benefit.
- Overly Discount Future We are notorious for overly discounting the future, reducing our courage to act now to prevent some disaster that we believe to be quite distant. Rather than consciously evaluating options from a long-term perspective, people tend to focus on short-term considerations. When people focus on present gains, they are likely to discount the future, even if they personally would reap the benefits of taking future interests in account.
- Lack of Vivid Data Additionally, most of us don’t want to invest in preventing a problem that we have not personally experienced or witnessed through vivid data. Thus, far too often, we only fix problems after we ourselves experience significant harm or after we can clearly imagine ourselves, or those close to us, in peril. We see this in our personal lives where people don’t properly save for retirement or don’t take care of themselves until they get sick.
- Planning for Success To make it worse, we don’t like planning for failure. Almost our entire professional and personal lives are spent planning for success, which typically means growth. Very rarely do we take the opportunity to plan for failure. Some cultures actually believe bad things will come if you invite or discuss bad things. When is the last time you walked into a room and said you have a great plan for 40% market share loss. This only happens when it is actually happening.
The reality is, our world is chaotic. While there is a great deal that is beyond our control, but our biggest risk is being caught unprepared. This is a rare opportunity to be proactive and prepare as a team for what happens when things go wrong—it’s part of our responsibility as leaders that we owe to our business, stakeholders, and community. When something happens, we’ll be in a better place to guide others and respond.
Question #2 is one I get frequently asked and one that you may be wondering too: Do you have an example of a company that has successfully used and followed its plan to manage a crisis?
Now, I’ve been in this business for almost 20 years. I’ve worked with companies all across the country, as well as all around the world, so I’ve heard my share of stories. And I can honestly say that I don’t know of a single company that has pulled out its plan and followed the procedures in their plans to successfully respond to an incident. I usually pause here as people try to make sense of what I just said.
What do you think about this? If no one is actually using their plans (prescriptively) to manage a crisis, then, what’s the point in being here today? Let’s think about what we are planning for. We are planning for an event with a lot of unknowns—we don’t know the exact event and effects ... we don’t know the date or time it will occur, so we don’t know the impact it will have, especially given that our business environment is constantly changing.
Context is everything—and without considering the specifics of a situation, we can’t properly plan and respond. How can we create a set of procedures for an event that we can barely imagine? For this reason, detailed plans and procedures don’t work very well in situations with so many unknowns and variables.
So then, why did we even ask you to develop plans in the first place? The real value is in the planning process; plans are still valuable, but they’re simply a byproduct of planning. A plan is like a handrail in that it can provide basic guidance and information about your team’s mission, roles and responsibilities, mission-critical activities, time constraints, and resource allocation. All useful stuff, but what a plan won’t do is tell you exactly what to do in any given situation. Rather than being a script to follow, a plan is a framework from which you will need to adjust based on what’s happening.
The planning process—including tabletop exercises—is an opportunity to make sure everyone on your team is clear about what to do, where to go, and options for recovering the business. It’s key for us to figure this out before an event, not in the midst of a crisis.
So, as odd as it may sound, do plan on your plan failing. The measure of a good plan is not whether things transpire as planned, but whether the plan is a good enough starting point for your team to take action. The real planning starts at time of event.
Question #3: Why are we here?
Exercising helps to validate our plan and the overall planning process. We use scenarios to imagine future events, envision the possible ways our teams will respond, and consider the potential outcomes that might unfold. The goal of this scenario planning is to help us identify where our vulnerabilities are, so that we can come up with some solutions.
Also, remember that most of us don’t work together every day, but we certainly will in a crisis. As leaders, it’s important for us to share our expectations and assumptions, and gain familiarity in how we think and operate as a team. Practice is everything—and exercising is the next best thing to actually experiencing a disruption.
Through this exercise, we’ll gain practice in communicating information, prioritizing goals, and making decisions as a team. We’ll even practice using the plan, so that you become familiar with what key information it contains and can rely on it as a handrail.
Those are my three questions. Now before we begin, what questions do you have?
We are leaders in crisis management and business continuity exercising and training. Contact us before your next exercise.