Incident Management Plan Risk Assessments

While typically a function of the crisis response team (CRT), it can in some instances be useful for the incident response team (IRT) to indicate how a crisis event may impact the company from a grassroots perspective. This will feed immediate concerns and information from the source of the event, to supplement the data response materials forwarded during the initial stages of a crisis event. A basic IMP risk assessment of how the event may affect the company can prove useful to support risk mitigation at all levels at the early stages of a crisis. Such assessments may include:

Immediate Concerns

• Is there an immediate risk to personnel?

• Is there an immediate risk to the company's reputation?

• What risks are presented to resources or facilities?

• Is there a risk to third parties?

• How long before any of these risks occur—how much time is there?

Situation

• What is the cause or motive of the risk event?

• Is it likely to get worse?

• Are other (different) threats likely to occur?

• What happened, where, and when?

• What effects are to be expected in the best case, likely case, and worst case?

Complicating Factors

• What legal implications are there?

• What media interest has been shown?

• What environmental factors will hamper the resolution of the problem?

The IMP risk assessment should not be confused with the responsibilities of the crisis response team and specialist responders, who should conduct more comprehensive risk assessments and evaluations during and following the crisis. The IMP risk assessment is a tool designed to provide a local perspective of the problems and impacts likely to occur that might fall outside of normal reporting formats within the IMP. While not a component of the IMP, the company should also link risk assessments to any recovery plans so that when the situation has sufficiently stabilized the company can begin to plan the resumption of normal operations.

Immediate Resource Mapping

While a function of the Business Continuity Management Plan, and in particular the resource and interface management plans, there can be value in providing a succinct resource mapping component to the IMP to ensure that managers are quickly directed to the most appropriate and reliable internal and external resources to help them to best manage a crisis event—especially at the local levels. Resource mapping should identify both usable and unavailable resource options so as to avoid time wasted pursuing those response groups that have been proven to be unreliable or unavailable during the contingency planning aspect of the risks management plan, as illustrated in Exhibit 1. Immediate resource mapping may cover a range of service areas, including but not limited to:

• Critical commercial support (utilities, power, medical, security, legal, etc.).

• Armed response or quick reaction forces.

• First line or surgical medical support.

• Medical evacuation support.

• Repatriation services.

• Emergency materials and resources.

• Transportation services (air, land, and maritime).

• Legal services.

• Explosives detection and clearance services.

• Kidnapping and ransom response services.

• Safe havens.

• Stress trauma support.

• Firefighting and emergency services.

• Security and guard services.

• Liaison and interpreter support.

Exhibit 1: Incident Management Plan Immediate Resource Mapping

Immediate resource mapping will also take into account the interface plan as well as the resource management plan, as they relate specifically to incident management. It is typically the crisis management elements that might mobilize the most significant resources to support the needs of a complex or large‐scale crisis, and the IMP may therefore require a scaled‐down version to enable the first stages of a crisis situation to be brought under control. Such simple reference guides may be placed onto an operations center wall, or within a simple flip chart as a reference document. They need to strike the right balance between providing sufficient guidance to reach the correct level of understanding and decision making versus providing so much data as to overwhelm and confuse incident managers.