Incident Management Planning Process
Pre-Planning
In order to be able to respond effectively and efficiently to an adverse situation, an organisation requires pre-planning. Any organisation taking the view that it can agree what to do post-incident is putting its businesses at risk of serious disruption.
Effort needs to be put into:
- Defining post incident roles and responsibilities i.e. who will do what to respond to the incident
- Creating a clear and concise escalation process to enable the correct corporate response to be activated quickly
- Making people aware of what to do to protect themselves and others first, and then the business
- Determining practical, cost-justified recovery strategies for resources required to support critical activities – covering people, premises, technology, information and supplies – and taking account of stakeholder expectations
- Developing the incident management plan
- Considering the communications plan for dealing with stakeholders, including the media.
Managing Information Effectively
It is not simply enough to take a senior team from the organisation, provide them with a plan and expect them to respond appropriately to the adverse situation which has arisen. Most senior managers are very good at problem solving. After all it is what they do on a day-to-day basis. However incident management requires more than simple problem solving techniques.
Rather a formal decision making process should be used to provide structure and ensure that the various factors are taken into account before reaching decisions regarding strategies to adopt. A large amount of incoming information has to be handled efficiently and effectively, assimilated and then used to determine the facts of the situation and the implications for the organisation, the negative impacts over a time line, the coping strategies available and the actions required to implement the chosen strategies.
The value to be gained by regularly encouraging the organisation’s Incident Management Team (or equivalent) to rehearse their response to an evolving scenario cannot be underestimated. Often, managers who are highly competent in the business as usual situation, cope much less well with crisis management or incident management scenarios.
Rehearse, Exercise, Test
All plans and response teams must be subjected to exercising, otherwise we cannot be sure that we will have the appropriate response to an incident.
There are a number of types of exercise, including structured walkthroughs of plans, drills, functional tests and live plays. However the desktop type of exercise is commonly used to take response teams through the thought process of responding to an adverse situation and is in the form of a facilitated session with the Incident Management Team being asked to respond in theory to a specific scenario provided by the exercise facilitator. The desktop exercise, correctly facilitated, improves awareness, increases confidence, validates response plans, strategies and roles and responsibilities and provides a level of assurance that the organisation’s business continuity capability is fit for purpose.
How can Teed help?
Teed can help you by developing, facilitating and reporting on business continuity exercises, including technical IT tests, or we can simply help you to develop an appropriate exercise programme for your organisation.
In addition to simple awareness presentations, Teed can also provide more formal training – both for those expected to facilitate exercises, akin to a “train the trainer” approach, and also for Incident Management Teams where we include training in our tried and tested decision making and information management processes.
Relevant case studies of our Incident Management projects can be accessed in the 'You May be Interested' menu.