Now is a good time to review existing incident response and crisis management plans to ensure they are up to date and capable of responding to the unique and unprecedented challenges posed by COVID-19. If they are not current, they should be brought up to date. If they do not exist, they should be brought into existence.
We examine five key ingredients of an effective incident response and crisis management plan below.
1. Clearly define the threshold for a major incident: Effective incident response and crisis management plans clearly define the circumstances in which a “major incident" or a “crisis" should be declared and the formal incident response process activated. Most organisations are likely to have plans which specifically identify pandemics or similar events as warranting the activation of a crisis management plan. Others may define major incidents in broader terms including by reference to customer impact, health and safety, civil defence issues, reputational damage or threats to security.
Existing plans should be reviewed to ensure that the triggers for a major incident or crisis reflect the anticipated disruption of COVID-19. This will vary according to each organisation. The impacts of supply chain and labour shortages on critical business functions are obvious consequences to consider. However, thought should also be given to the potential vulnerabilities that responding to those impacts could create. For example, an increased reliance on remote working could place unprecedented burdens on IT systems and render them more vulnerable to a potential breach.
2. Confirm the incident response team: Major incidents require a senior cross-functional team from across the organisation, as well as external experts. This ensures that the appropriate expertise and necessary authority is available to make immediate decisions. Key members of any crisis management team include the crisis lead, senior business heads, in-house legal, corporate communications, IT, risk, external PR professionals and external legal counsel. The names and contact details of all proposed crisis management team members should be recorded in a readily accessible location. Back up contacts should be provided in case the primary contact is unavailable or sick or the incident persists over a longer period of time.
Every member should be aware of their role on the crisis management team and alive to the likelihood of a major incident being called. Contact details of key additional stakeholders and support personnel (external and internal) should also be maintained.
3. Don't forget legal risks: Assessing and responding to the immediate business implications of a COVID-19 related incident might be the immediate focus of the incident response team. However, legal issues will need relatively rapid attention. Employment law, health and safety obligations, contractual arrangements, financial issues, insurance cover, and directors' duties and disclosure obligations will be key legal considerations.
See more information on these important issues in our separate piece 'COVID-19: 5 key legal issues on your agenda'. Internal and external counsel can assist with these issues and advise on how privilege can best be maintained.
4. Publicise the plan: All employees need to be aware of the incident response plan and their responsibilities in implementing it. Employees should be informed of the matters that require immediate escalation and the persons in their reporting line or organisation to who such matters should be escalated. Immediate escalation of potentially significant issues maximises the possibility of a major incident or crisis being identified and the incident response process being activated in a timely way.
5. Adapt for the long haul: The life-cycle of a COVID-19 related incident may be longer than most major incidents or crises. Crisis and incident management processes may need to be adapted to reflect the extended time period over which business as usual processes might need to be suspended. For example, an ongoing review process (designed to identify system and process improvements) could be built into the incident response. That way organisational lessons can be immediately identified and improvements made as the crisis response unfolds rather than waiting for a post-crisis review for any meaningful improvements to be made.
At Bell Gully, we have the experience and expertise to assist with all aspects of developing and implementing a crisis management plan, including providing urgent legal advice on issues arising when the plan is triggered.
If you have any questions about the matters raised in this article please get in touch with the contacts listed, or your usual Bell Gully adviser.
To view our other COVID-19 related publications, click here.
To receive all Bell Gully's updates on COVID-19 you can subscribe here.
Disclaimer: This publication is necessarily brief and general in nature. You should seek professional advice before taking any action in relation to the matters dealt with in this publication.