Contingency Planning and Crisis Management

An Introduction

The lead body promoting business continuity to the aviation business is the International Air transport Association

•It has established the ABC project which aims to support the non-competitive exchange of information and experience in the development of business continuity plans.

•It works closely with the BCI

•Business continuity within aviation has to cope with a complex web of interdependencies. Serious interruption to one company can have a costly impact on another.

•Other factors which to add to this complexity are a reliance on airport authorities, increasing use of third party contractors and vast legislative and institutional regulations.

•Financial institutions/audit requirements now specify that publicly quoted companies must have risk management strategies in place. (responsibility for not having them lies with the company directors)

•Automation of the industry has changed the risk profile unrecognisably

Why Business Continuity?Disrupted Operations can cause;

loss of operational capacity

loss of data

loss of intellectual property

loss of reputation

loss of confidence

diminished shareholder value

lost profits

lost customers

Phases of Business Continuity

Phase One - Preliminary Planning

•Business Impact Analysis

•Dependency Modelling

•Risk Identification and Analysis

•Business Contingency Strategy

Phases of Business Continuity

Phase Two - Continuity Plan Management

•Training of personnel in theories of risk, disaster management, plan development and implementation

•Validating plan through crisis simulations

•Implementing maintenance programmes to address industry changes

Phase Three - Crisis and Disaster Management

•Safe evacuation of premises in a crisis

•Liaison with emergency services and security teams at disaster scene

•Communication with the media, customers, suppliers and other key stakeholders

•Relocation of business operations

•Initiation of manual business operations

Phases of Business Continuity

Traditional Emerging

FocusMinimising the financial impact of disasters

Ensuring financial continuity, customer satisfaction and productivity despite a disaster

ApproachRecovery from single episodes of downtime only

Business driven continuous availability through management of information and operational risk

RisksLow frequency - high impact disasters

Traditional and emerging threats to infrastructure

BenefitsRecovery of downgraded service expected 12-72 hours after event

Up to 99.9% availability of critical infrastructure expected + performance improvement immediately.

EnablersDocumentary plans reply on after-event recovery

Emerging technologies

A Growing, Potentially Costly Capabilities Gap

The gap between the cost of

downtime and the ability to deliver is

widening

Increasing cost of unplanned downtime

Ability to deliver through traditional

mechanisms

Value layers in a business continuity framework.

Commitment and Value

Risk Exposure

Can I Recover my Physical

Assets

Can I recover my automated processes

Am I always able to be there for my customers

I am able to offer value chain excellence to all stakeholders

React / Control / Transform

1 Year

5 Years

10 Years

25 Years

50 Years

100 Years

Negligible Marginal Critical Catastrophic

PROBABILITY

SEVERITY

Action/controls already in place

Controls to limit severity

Controls to limit

Responsibility for action

Critical success factors and KPI’s

Review/test frequency

Key Date

Team members

Actions in first 24 hours - Stage 1

Action in next 3-5 days - Stage 2

Action from day 5 onwards - Stage 3

Person responsible for completion

Review/frequency

Test Date

Questions to ask business leaders

•Is the BCP event driven, risk driven or, stakeholder focused?

• Is the BCP aligned to organisational strategy?

•Who are our stakeholders and what is their tolerance for unplanned downtime?

•Does the BCP address people, processes, technology and the extended enterprise?

•Does the BCP eliminate single points of failure?

Crisis Management

Caroline Sapriel

“ A Crisis is, by definition, ‘an event, revelation, allegation or set of circumstances which threatens the integrity, reputation, or survival of and individual or organisation.”

To be effective, crisis management must be embedded into the corporations management System

Crisis Management gained more corporate focus as we moved into a new millennium.

• Conversion to 2000 in IT

•The events of September 11th

Crisis by type in the 1990’s (source - Institute of Crisis Management)

•65% sudden

•35% Smouldering

The Link Between BCP and Crisis Management

Source Journal of Communication Management vol 7, 4 349

Risk Identification

Risk Evaluation

Minor LossSevere Loss

Pre-loss Loss Post loss

Crisis Management Plan

Business Continuity Plan

Business Recovery Plan

•Transfer

•Prevention

Retain?

Crisis

Disaster

Emergency

Another area of crisis response , made

necessary by the attacks on Sept 11th is

managing the human element of a crisis.

Indeed managing the public, family and

employee communication is an

increasingly important component of

contingency planning.

• The airlines had procedures in place to deal with next of kin but, the companies in the world trade centre had very few.

• Major airlines have established processes and ongoing training programmes.

• When an incident occurs, airlines immediately activate their passenger information call centres and mobilise despatch teams to provide support at the accident site.

• Singapore airlines established its next of kin buddying system in 1992

Reputation ManagementIn a crisis, reputation management best practise

consists of

•Preparedness

•Robust yet flexible strategy throughout

•Transparency

•Integrity and honesty

•Two way communication with stakeholders

•Sensitivity

•Ownership and Responsibility

Image - jaso hawkes photography.com

Dragonair

2002 embarked on a FAST programme

Since Sept 11th = all major industries have expanded their family support programmes.

The management of next of kin is often linked with enhanced security procedures.

Image - jaso hawkes photography.com

Workshops to train leaders

Often scenario based to enable CMT’s to experience the difference between consensus based and command and control styles of management

Taught to work with stakeholder issues too / risk mapping procedures

Image - jaso hawkes photography.com

Examples of Aviation Risk Exposures

•Damage to wide body aircraft - (valued at $200,000,000 per aircraft - up to $300,000,000 with new generation aircraft)

• Injury to passengers, meeters and greeters (settled in UK in excess of £6m for a single life) multiply this by thousands in a terminal and losses could run in to billions.

•Fire risk - if recovery plans are not sufficient - could you rely on insurance £ to re-establish your business?

•Terrorism

• construction issues - I.e. financial performance / failure of contractors / gap in contractors programmes / revenue losses through delay.

Image - jaso hawkes photography.com

Conclusion

Organisations that are serious about embedding crisis management into the overall corporate

strategy have done the following things:

Ongoing risk assessments

Sound and tested processes

Training and practice

A strategic approach