Two aspects of BC/DR are Crisis Management and Incident Management. Many people use these two terms interchangeably, but this is like apples and oranges. Though closely related, they are different since each has a different purpose and objective and so should not be mixed up.
This term relates to the plans and actions taken to tackle a day’s disruption in activities, so as to return the business operation to its original state. The incident must be related to the operational aspect of the business and some part of it has been disrupted.
The disruption need not be a due to a disaster such as snowstorm, earthquake, flood, tornado etc., but is a disruption in a field of operations for reasons like computer glitches, viruses etc. Incident Management therefore focuses upon the impact caused by the disruption in terms of financial implications, customer goodwill etc. Incident Management will focus on how to restore the operations to the normal state. It will detail the response of the staff to the disruption and will coordinate the efforts of the Recovery Teams who are in charge of the recovery strategy.
Incident Management begins when a disruption in production/business activity is reported and it ends when the crisis has been successfully tackled and normal operations resume.
During a crisis scenario, the reputation of an organization may be adversely affected. A crisis may occur due to a variety of reasons, not necessarily due to an incident. It could be sparked off by rumors or even due to mishandling a customer’s complaint. In these days of social media, an irate customer can trash an organization with impunity. Customer goodwill can be lost quite easily.
On the other hand a crisis could also be triggered by an Incident. The prime focus should be for the organization to speak in one voice and not to give conflicting information. Therefore, procedures for Crisis Management, should be clearly defined.
Though Crisis Management and Incident Management are distinct and different, they have common bonds, so procedures and plans must be developed separately but should have the needed flexibility to be coalesced as one if need be. Both Crisis Management and Incident Management plans must have the following:
- Each plan must have its own clearly defined areas of responsibility. The responsibilities must match, but are separate, so that no one steps on another’s toes during its operation
- The protocol involved in invoking and setting in motion each plan should be clearly defined. Only the authorized person should set the plan in motion
- The role and responsibility of each person in both teams should be clearly defined
- If possible, both plans should be tested simultaneously. This will help all participants to clearly understand their role and responsibility as per the plan. The advantage of testing both plans together is that any problem or interference of the plans with each other will become apparent and can be corrected
- The entire staff in the organization should be educated so that they get to know the role and responsibility of each of these separate plans and teams. This will prevent confusion during a crisis and the entire organization will speak and act in unison and with only one voice
It may be a temptation for Management to merge both plans and teams since it will cost less in terms of cost and manpower, but sooner or later it could lead to confusion. If plans and teams are kept separate then proper planning, preparation and testing will be done, which leads to an efficient response to an incident or crisis or combination of both.