Monitoring Crisis Management Programs

A Business Continuity Management Plan and its constituent elements should be considered a living entity, subject to growth and change. While the company may develop an all‐encompassing IMP to meet a wide spectrum of typical operating challenges, tailoring and updates of the IMP will often be required to ensure that the plan retains its accuracy and effectiveness for each operating activity and region. An intelligence‐driven policy will govern how the procedures are amended, adapted, or revised. The changing and evolving external socioeconomic and geopolitical influences should be used in concert with internal and external monitoring evaluations and validations, ensuring that security measures and crisis response arrangements reflect the current threats and that the potential for complacency within the company is minimized. Changing supporting structures or management elements should also be incorporated within aspects of the Business Continuity Management Plan and supporting components such as the IMP, reflecting fluctuating and evolving organizational structures, capabilities, and focuses (i.e., notably if stages within a project see significant differences in approach requirement).

An internal monitoring or assessment team can be used to test, evaluate, and exercise personnel in their responsibilities, ensuring that corporate policy is being effectively implemented at all levels, as well as identifying any areas for change or improvement. Enhancements should be collaboratively sought from both corporate and field levels. Such a monitoring team is also useful in the formal assessment of personnel, contributing to the evaluation of a crisis management structure as well as key individuals within it.

External monitoring teams allow a fresh and impartial validation on how well formulated and relevant the current security policies and plans are. They can also contribute in a consultancy role, offering suggestions to the executive management on policy amendments and alternative methods of implementing security arrangements. External monitoring can be through unannounced spot checks, exercises, or allocated assessment periods, and can be conducted concurrently with management exercises in the IMP's utilization.

External consultants may also be required to offer guidance on how to amend or adapt the Business Continuity Management Plan and IMP following a crisis incident. Many organizations, having successfully managed a crisis, slip into a state of complacency, believing that they now have the expertise to overcome any future crises (Ian I. Mitroff and Christine M. Pearson, Crisis Management: A Diagnostic Guide for Improving Your Organization's Crisis‐Preparedness, Jossey‐Bass, 1993, p. 23). Companies should seek to learn from a crisis event and improve their response policies, procedures, and mechanisms to better manage any subsequent crises.