Incident Management Plan Risk Assessments

While typically a function of the crisis response team (CRT), it can in some instances be useful for the incident response team (IRT) to indicate how a crisis event may impact the company from a grassroots perspective. This will feed immediate concerns and information from the source of the event, to supplement the data response materials forwarded during the initial stages of a crisis event. A basic IMP risk assessment of how the event may affect the company can prove useful to support risk mitigation at all levels at the early stages of a crisis. Such assessments may include:

Immediate Concerns

• Is there an immediate risk to personnel?

• Is there an immediate risk to the company's reputation?

• What risks are presented to resources or facilities?

• Is there a risk to third parties?

• How long before any of these risks occur—how much time is there?

Situation

• What is the cause or motive of the risk event?

• Is it likely to get worse?

• Are other (different) threats likely to occur?

• What happened, where, and when?

• What effects are to be expected in the best case, likely case, and worst case?

Complicating Factors

• What legal implications are there?

• What media interest has been shown?

• What environmental factors will hamper the resolution of the problem?

The IMP risk assessment should not be confused with the responsibilities of the crisis response team and specialist responders, who should conduct more comprehensive risk assessments and evaluations during and following the crisis. The IMP risk assessment is a tool designed to provide a local perspective of the problems and impacts likely to occur that might fall outside of normal reporting formats within the IMP. While not a component of the IMP, the company should also link risk assessments to any recovery plans so that when the situation has sufficiently stabilized the company can begin to plan the resumption of normal operations.

Incident Management Plan Cover Letter

For those companies that have no current IMP in place, it is important to advise personnel as to the rationale behind the creation of such a plan in order to avoid rumors and speculation, or at worst concern or fear within a workforce when such plans are developed or distributed. The following list provides a sample of some elements that might be included within such a cover letter:

• Rationale.: In order to ensure the protection of our employees working and traveling worldwide, the company has approved the development of an IMP. The purpose of this plan is to enable personnel to respond in an organized and professional way to any incident that threatens the lives or health of the company's employees, or adversely affects its operations.

• Context.: We have no reason to believe that the company or its employees are at any greater risk than other companies working in our industry, or in similar parts of the world. However, given political uncertainties around the world and the increasingly international nature of our business, we believe it is only prudent that we should seek to be as prepared as we can be.

• Value.: The IMP is a functional element of the company's Business Continuity Management Plan, supporting local managers and first responders in understanding the nature of common risk types, as well as providing clear and pragmatic response guidelines to assist them in bringing control to a crisis event. The IMP is the first step in dealing with an issue, and bridges the response gap as the crisis response teams mobilize. The IMP is designed to deal with a range of incidents, whether they involve personnel or facilities or are associated with political unrest, natural disaster, medical emergency, criminal act, or otherwise.

• Definition.: The IMP responsibility extends to any unexpected event that may have a significant impact on the company or its employees, or the community in which it operates, including political and security risks, medical emergencies, natural disasters, accidents, or any other event that might threaten the health and well‐being of personnel, damage the reputation of the company, or cause impediments to business operations.

• Utilization.: The IMP has elements by which to provide a brief insight into the types of risks the company and its employees may face, as well as pragmatic response guidelines and data call formats to support first responders and local managers in gathering accurate information and managing the first steps of an emergency. Each incident will require a tailored approach, although notification of designated incident and crisis response managers should occur as quickly as possible. The IMP is not designed to restrict sensible responses, but rather to act as a tool to support effective management.

• Training.: The IMP will be supported with training for selected managers. Additional training may be provided for those exposed to new operating environments, or who may form an element of an incident management or crisis response team. This will be determined on a case‐by‐case basis.

• Crisis Management.: Personnel should be aware that a detailed Business Continuity Management Plan is in place, and that the IMP forms a functional response component of this plan. Designated and experienced crisis managers will take control of an incident at the earliest opportunity, and all appropriate emergency response organizations will be incorporated within response plans, as well as leveraged during an incident itself.

The IMP introduction or cover letter should seek to allay any fears or concerns while placing the IMP into a broader context and crisis management framework. The author may be the CEO or a selected representative, and the recipients may be limited to incident and crisis response personnel, or the letter may be open to the entire organization.