I mentioned in an earlier post that I don’t necessarily subscribe to the view that crisis plans need to be heavily documented in the form of runbooks or procedural artefacts. In this posting I would like to explore that in a little more detail.

It is certainly not the case that I think there should be no procedural documentation, or even detailed documentation, as long as it is in the right place and appropriate to the people requiring it. That said, i think the default approach to any implementation of crisis, incident or disaster recovery plans leads to a vast amount of needless writing. Having been involved in a programme to simply document what a particular team does with over thirty documents being created from scratch I can testify to the futility of that approach.  Hence I propose the two tier approach to writing these plans up.

Tier two documentation is that which is required by the functional team; in the case of disaster recovery it is the detailed documentation of how to fail over applications and services. With crisis management it may be evacuations plans, roles and responsibilities of fire wardens, and with incident management it might be an escalation and first fix path of procedures.  This is important, because in many of these cases the people involved in the ground are often in twenty four hour shift patterns and early in their career, or even volunteers (fire wardens etc.), and through no implicit fault of their own have less incentive to fully memorise or become proficient in activities that might never happen on their shift. They need to have a reference document, a thing they can refer to when their pulse is pounding and their heart pumping in the middle of a crisis. I should know, I was that soldier in my first job out of university!

However, there is a group of people that simply can’t be told to have documentation available to hand when the time comes, or even to memorise the roles and responsibilities; the senior leadership who actually make many of the critical decisions during a crisis. What is required here is ability to Communicate and Collaborate very quickly (optimally within just a few minutes of the crisis being recognised), and then have the capabilities at hand to establish rigourous Command & Control. This approach applied to most organisations (except perhaps the behemoths like IBM or TCS where different segments of the organisation could operate like this where the input of most if not all of the C level execs is required

These execs need to be involved in crisis no matter what the subject because what they are good at is synthesizing information from a variety of sources and being able to make decisions quickly, effectively and in the best interests of the company and its people.

Some pre-requisites to this approach though:

1. A recognised approach to define the severity of a crisis prior to declaration.
2. A mechanism of simultaneously contacting multiple people through redundant channels in a matter of seconds of a crisis being declared.
3. A series of very simple yet effective steps for the crisis team to follow.
4. The ability to manage a “crisis room” either real or virtual at no notice.
5. The recognition that a crisis is by its very nature flexible, and therefore understanding you will not know all the facts from the outset (the “fog of war” effect).

I will investigate this in more detail in a later article, but for the time being, the main question anyone should ask themselves when prparing crisi plans is “how can i simplify this further?”.