63: Crisis Plans: What They Are and Why You Need One with Rob Burton

There is a crisis of confidence in companies out there that are no longer confident that they will be able to handle a crisis. There was a recent survey that found that there is a broad vulnerability gap between awareness of threats and preparation and compared to how to actually handle them. Today on the podcast, I'm speaking with Robert Burton, and he is a principal at PreparedX, and he manages a team of crisis management professionals. So he supports supports clients in their crisis, emergency, security and business continuity plans. When there's an event on the horizon, he is going to speak about the different types of crisis planning that you can have. And he's also a founder of the International Crisis Management Conference. So he has heard firsthand from speakers about how they manage crises at their companies, including me. That's where I first met him. So take a listen today to Robert Burton. If you work for an organization or you run an organization that knows right now that they are not ready for a crisis. Hello, Rob. Thank you for joining me on the podcast today.

Well, thank you, Ronnie. It's great to hear from you again.

Yeah. And you and I first met when I spoke, you put on an amazing conference, the International Crisis Management Conference. I attended it last May in Newport, Rhode Island. And you brought together a collection of such interesting people not only to speak about crisis preparedness and crisis management, but also all of your participants in the room. I found one were people from just a smattering of different organizations that you wouldn't traditionally think would need a crisis plan, but really, at the end of the day, almost every organization does. Wouldn't you agree?

Well, for sure, yes. And I appreciate you mentioning the conference. We put that on every year and that was our fourth one. We have typically done them in Boston, but we brought it to Rhode island this year and we'll be doing it again in the spring next year. So thanks for mentioning that. But yes, as it relates to plans, you're. But we're surprised every year the type of individuals that come together and the organizations that they represent. And it's a wide breadth of different individuals from different sectors and all kinds of weird and wonderful businesses that you've never even thought of. Certainly when you start to think about the strawberry producers in California and they're concerned about protecting their, you know, business and their assets and, you know, protecting their business from a crisis standpoint, you start to think, well, if the strawberry farmers are concerned about them about that, then certainly Fortune 500 should be. And they certainly are.

Oh, they absolutely are. And I remember sitting next to someone at lunch and thinking, to myself, I would never suspect that this company would need a crisis manager. And sure enough, not a few months later, there we are, front page New York Times Network news, they were in a full crisis. So I thought, what timing that that person ended up at your conference.

Sure, sure, yeah. And I think, you know, that's a great segue into, you know, the needs for a crisis plan and, you know, the traditional way of looking at crisis planning. I've been in this business now for some 15, 16 years. The traditional way was to, you know, create a plan for, you know, as many scenarios that we can consider. Many the common scenarios as an organization, there may be four, there may be six, there may be 10. But typically there's only a few that we're really concerned about. So there would be a specific plan for each of those. But in today's world that we live in, and as you know from your podcast here and the work that you do within this, specifically the crisis communication field, now we can get hit with any type of event at any time, any type of crisis at any time. So we've got to be flexible. So in terms of planning, an organization needs to have a set of tools and resources to be able to respond quickly to any event. And we certainly don't advocate being specific, having specific plans, although there are some instances where they're advisable, but cyber being one of them. And that's a separate team within the organization. But as it relates to just general crisis management response, you need to be flexible.

And Rob, you had mentioned your experience and I couldn't go a step further in the podcast without mentioning you have a, you have a British lilt to your accent. So what is your experience that brings you to crisis management in the US?

Yes, so it was really interesting. I was in the military back in the UK for 13 years. My last four years was with Special Forces. And then I'd spent some time doing contracting work around the world helping organizations face various risks and do the physical protection side of people and assets. And then I moved to the states some 17 years ago now and really adapted those skills to helping organizations prepare for a myriad of events. So a lot of what we, a lot of my experience from the military, a lot of the discipline, the operational experience, how we coordinate and communicate the discipline around that and really helping the boardroom, helping, helping the crisis, corporate crisis management team really become organized and keep that discipline. So bring a lot of those military type skills, but you know, to a corporate focus within that environment. So that's kind of the thousand Foot view from where I come from.

Right. Right. Now, when you say 17 years ago, was there a timestamp around 911 that brought you into this industry or at least this country?

Yeah, it's quite interesting you say that. Yeah. And there was some new rules. It was just right around, just after 911 when I moved here. But shortly afterwards there was an International Ship Port Facility security code, which I know you're familiar with the ISPS code. And so after I moved here, it was very shortly after, literally months after, we did a lot of work within the port space, helping ports and shipping companies prepare for the new, which was brought on after 9 11, the new security rules within or regulations within the space. And so we start to do a lot of work and helping ports and port facilities and shipping companies, even large private yachts as well, that had to adhere to these new regulations. And a big part of that as well was preparing the employees of the port or the staff within the port or on these ships, preparing them for various security scenarios. And so we did some exercises early on in that space and through those exercises, and there was a lot of companies doing security at the time, different security services. There's a lot more to the regulation than just the drills and exercises. But we found, we did that really well and found there was a kind of a niche, not just in that space but in other spaces as well, to kind of focus on just doing exercises as a core business. Now we do other things outside of that. But we found that there was a big gap where organizations were either not running them or they were not running.

Very well, or I might even add that they're not quite clear what they need. So recently I was approached by a company working with a company in the petroleum sector. And they came to me about a training and they wanted me to do crisis management training, which was very specific. Wasn't until we got on the call that this, this client realized they needed a tabletop exercise. So they got lost in the language between what a workshop was and a tabletop was. And it happened on the phone call. So of course I immediately think, well, I know someone that does a tabletop exercise, so I was thinking of you. But Rob, explain the different types of exercise, because people think about crisis plans. They think of, oh, it's just a plan, what to do if something happens. But the exercises are quite different in the resources that you provide. Could you explain them?

I can, yes. And there are, you know, you can, you can certainly find a lot of information online. I know the Department of Homeland Security or certainly fema Now, I think the last time I looked, they have 10 different types of exercises that they explain and the differences between them. But. And they can be, you can get quite.

What are the common ones? What are the common ones that a business would need?

Yeah, we break that down to about four or five. The first one is a tabletop exercise, which, you know, is a really, you know, the easiest one put together. We literally sit around the table and we discuss a problem that we may be faced with as an organization and we walk through the various stages of how we deal with that. So, you know, limited amount of resources, you know, you can do them, you know, over a couple of hours or you can spend the day doing them, depending on how much time you have. So that's the easiest one to put put together. The next one is a functional exercise, a little bit more advanced. So this is where typically an organization has done a number of tabletops and they wanted to take it to the next level. So functional is where we have a team sat in their own environment and we have another team sat in their own environment where they're working together. So you may have a team at a port facility, for instance, and then you may have a team at the port authority that may be coordinating with the facility, discussing an issue. So we're using resources in terms of our communications, we're actually connecting via phones. We're using our plans and we're validating how we're going to coordinate through an issue. So a little bit more advanced in terms of putting together, but again, typically a step up from the tabletop, the next one is a full scale exercise where from top to bottom, we may have a team again at one of our locations around the world. And it may just be an office building that's got a fire or maybe some kind of event that's going on, a protest in Hong Kong, for instance, that's impacting us. And so then that scales up. So how do we activate the next team? The next team may be a region team in Singapore. We activate that team, that team comes together. And then back at headquarters in New York, for instance, we may have to activate the senior leadership team as the issue becomes larger in terms of the scenario. And so you've got all those teams activated, lines of communication going between the two or three or the three different teams. You may then be sending messages to the board. There may be a briefing for the board to keep the board up to speed with what's going on in the scenario. And so more complicated in terms of Multiple teams from top to bottom being coordinated through a simul exercise. And again, typically known as a full scale exercise because you're validating from top to bottom.

Okay. And what would you call a corporate war game?

Yeah, we put those in the bracket of more strategic focused, smaller game where we're focused on the board or the senior leadership team. And we're really strategizing on some complex, very detailed issues that we may be faced with. So less about how we come together as a team and deal with the common issues that we may have to deal with, but more about a very challenging issue that we want to figure out, how we would get through. So that's typically more strategic focus, less time, so two, three hours, but with a very narrow focus on dealing with a specific challenge that we want to look at.

Right. Okay. Now Rob, you had mentioned the Hong Kong protest. When those stories were happening recently, my crisis management brain immediately went to the airport where it was chaos, Chaos ensued. Now it made me wonder, did that airport have some type of crisis plan that would help them organize a protest that happens in an airport? And I. And then recently in the news, as you and I record this, the Hard Rock Cafe in New Orleans, it's under construction, it collapsed. There's two fatalities. So many of these incidents that happen, they are the unknown unknowns that are very difficult to prepare for. Do you allow room in these plans for the unknown unknowns?

Yeah, I think that's what a plan should be. So I know we touched on, you know, the plannings early on, but you know what, the way we look at plans now is essentially a set of tools that allow the team to come together, activate the team, get themselves organized in those first few minutes, and really allow them to stay organized throughout the the event. So it's less about very specific to those scenarios because even though that may be a scenario that the airport has looked at in Hong Kong, they may not have gone into that much detail. They probably have because they were concerned about it. But it may be one of the scenarios that they've run. Now, will they have a 20 page document detailing what they would do in that event? Well, no, because I wouldn't imagine they would because it could go in so many different ways in terms of how the protests are unfolds. Right. You know, the collapse of a building, you know, in Louisiana, it could go in so many different ways in terms of how the event eventually, you know, unfolds. So I think it's, you know, in this day and age, we're seeing more plans that are resources and tools that allow the team to come together and remain organized. And one of those tools, one of those assets within the team is a crisis coordinator that manages that and really allows the team to make decisions, to go off, collect information, come back and continue to work through the event throughout the life cycle of the emergency. So one of those tools is the master events list. So that is basically an overview of what's going on. It's the facts, what we know and the decisions that were made throughout the event. So we're logging the time and date that these things happened and it allows the team to really remain on track in terms of their focus. There are other tools as well, which I'm happy to go through, but essentially the plan in this day and age is less about 100 page document which will never get reviewed or will never get looked at during the event. It's more about, okay, we can activate the team. Who's responsible for that? How do we bring that first step? Get the team together. Okay, the team's together within minutes now, seconds even in some cases. Okay, what's the first step that we need to do now? We need information. How do we do? So it's just really about those steps in those first moments. And then it's main, it's building situational awareness, maintaining situational awareness throughout again, the lifecycle of the crisis or the event.

And you mentioned the crisis coordinator. It sounds as if the crisis coordinator in essential role is the one that can bring it all together so you can be organized to manage the crisis. Correct?

That's exactly it. That's somebody you know. And again, they don't have to be a crisis management expert at all. It's somebody who has general understanding about all areas of the organization. It's somebody that is organized themselves. Right. So I know in the past we've mentioned in our own podcasts and trainings that we've done that somebody maybe with project management background, somebody who can crack the whip and understands, has a bit of leadership about them as well, but they understand how to bring the team together, remain organized, keep on track and document various things as you go through the event. So, yes, certainly an essential role and again, a backup as well. So we always think about the main role. But what if he or she is on a flight or the crisis coordinator is not there that day? So who's the backup that can step in and obviously be trained and ready to go as well? Because many of these roles within the crisis team, people think, well, I'm the lead and I'll always be there. Well, that's not the case. You need someone to be competent as a backup for your specific role.

So having a plan, being organized, having a point person like a crisis coordinator or a similar role or will give what it sounds like a leadership peace of mind. So do you have examples of where you have seen the transformation? Working with a company or an organization that did not have a plan and then you worked with them, you gave them a plan and then something happened and they went into that incident more prepared and have more peace of mind. Is there some transformation story that you could share?

Sure, yeah, I'd be happy to do that. I won't go into specifics just because NDAs with all our customers, I'm not mentioning the industry. So it's a mining client of ours and this is probably about three or four years ago and they already had a plan. And again, most of these plans that we see are either kind of a skeleton plan or the plans that have not been validated. And that's a big part of planning as well, is validating these plans. And so that's why the exercise, the simulation exercises that you conduct are essential to validating the plans. And so it helps you build on that plan, it helps you refine the plan. Sometimes plans are just not looked at every year and so they get outdated fairly quickly. So this one particular client, we had been there to do a tabletop exercise and we had been in the room for about six, I think it was a six hour session. Great exercise. Following their procedures and protocols in terms of how they coordinate. It was a drill where we had trap miners underground. We were working with the leadership above ground. And again it was a tabletop, so it was just simulated. There was no trap miners underground, but it was just simulated that there were. And we had exactly where they were trapped underground, how many people they accounted for. And we were walking through the drill and this is a serious event for them. It's one of their events that they're really concerned about. Well, probably about three, four, five months later, I forget exactly what it was. This scenario actually happened and they had a fire on the ground. They followed the procedures underground. The miners went to the various locations and locked themselves down. They have about 36 hours worth of air in these locations. So it's a big issue in terms of making sure that they can get them out in time. Well above ground there was less chaos. So the feedback we got because of the drill of your conduct of leadership, they were organized, they came together, there was less frantic running around like headless chickens as I call it. And there was more discipline, there was a calmness about it, there was better communication because of it. And I remember getting a great email from the customer basic. I mean it was a couple of days after the event saying that thanks to these drills, this team felt that they were better organized to deal with the event. So. So it's always great to get validation back from the customers and obviously ultimately help them respond to a real event based on the simulations that we conducted some months earlier.

And a mine rescue, I mean, of course there was the Chilean mine rescue from almost a decade ago, but yet that is a story you will always hear pop up that they could be in a coal mine. Every once in a while you'll hear that. So it does speak to this idea of organizations planning for any type of crisis. And I know a lot of clients think it's just a big company that will need it, but that's not true. You would say there are a lot of mid sized and small companies that need to plan for a crisis, correct?

Yeah, I think as you know through social media and traditional media we hear about all kinds of events that are happening to all kinds of different businesses now. And I think again, just think about reputation as an investor of a small to medium sized business. You want to know that the organization that you've invested in is as strong as possible as more and more of these smaller to mid sized businesses get exposed because they weren't prepared and some event impacts them and it does get out on. And again, it may be local, it could be a local business, but still, if you're in a local community serving that community and the word gets out there that there's some issue with the business because they didn't have a crisis plan or the issue pops up in the media and then they have to try and deal with that from a reputational standpoint. So I think the more that happens again locally, regionally and globally, I think the more that small and medium sized businesses realize that they have to do something in terms of crisis planning. And that's certainly what we see at the International Crisis Management Conference. As you mentioned at the beginning, all kinds of small business owners coming, trying to find out and figure out what they're to do crisis planning.

And Rob, you do an excellent job of getting the word out about the importance of crisis planning. You're very active on social media yourself. I follow you on LinkedIn and you put videos up, which I love seeing. You have a whiteboard Wednesday where you explain some, you know some basic goal that you want to achieve or some needs surrounding crisis planning. So I definitely encourage my listeners to follow you on LinkedIn and to look up Preparedex. Consider you just really a premier crisis management planning firm. You cover it from A to Z.

Well, we really appreciate that, Molly. I know loved working with you at the conference and hopefully we'll get to work some more. Yeah, I just have a passion for these simulation exercises and crisis planning in general. And it continues through the feedback that we get from our customers, the enjoyment we get sometimes, and it's quite embarrassing being Brit. Sometimes these sessions will end and they'll be. The team that's been through the session will start clapping. I'm hoping they're clapping themselves, but they're also thankful and we'll get thanked. People will walk up to us afterwards. I mean, remember again, the same client actually, but in a different part of the world, the mining client. This one gentleman has been in the industry for 37 years. And these are hardcore miners who have spent a lot of time on the ground but moved up into managerial roles. And, you know, he came up to me, said, I've been this business 37 years, the business has been through three changes in ownership and this is the best training I've ever had. And that for me was just like, you know, I said, that's what makes it all worthwhile to me. If you've got somebody who's been in that field for that long who comes up and thanks you in that way, it just makes me want to wake up in the morning and carry on doing what we do.

And I believe that having been in a room and seen the people and watching every word that you say and you put together such a. Such a good event and a critical event that is so helpful. So many times people sit in a conference and their eyes glaze over, but your conference really brought some hardcore tactics and strategies that companies can use. So, Rob, I want to thank you so much for taking the time to speak with me and talking about the importance of simulation exercises, crisis management planning. Of course, you have your company Preparadex and then also the International Crisis Management Conference, which pops up once a year. So, Rob, thank you for taking the time to join me.

No problem. Thanks again, Malik.

I want to thank my guest, Rob Burton, for joining me today to speak about how to build confidence and resiliency when it comes to managing a crisis. You can find more information about Rob's company, preparedx.com on his website. Thanks for joining me today. We'll speak to you next week on the Confident Communications podcast. Bye for. Sam.