Crisis Management Policy
Framework for responding to and managing organizational crisis situations
Purpose
Establish standards and procedures for crisis communication, ensuring an effective, coordinated response to disruptions affecting critical operations, people, assets or reputation.
Objectives
- Systematic, consistent communication during crises.
- Crisis identification, communication management and documentation of lessons learned.
- Keep internal and external interested parties informed.
- Notify customers and regulators according to legal and contractual obligations.
- Share relevant crisis information with industry partners and authorities when appropriate.
Scope
Applies to all crises within the organization and to all communication phases, from identification to post-event review.
Definitions
- Crisis: A significant disruption that affects operations and creates potential legal, financial, political or media impacts.
- Crisis Management Team (CMT): Senior management responsible for the corporate response.
- Crisis Communication Team (CCT): Manages internal and external communication about the crisis.
Roles and Responsibilities
- Crisis Communication Lead: Coordinates internal and external communication and represents the organization.
- Human Resources: Employee safety and accountability.
- Legal and Regulatory: Review and approval of messages.
- Business Recovery Lead: Manages business impacts and BCM.
- Commercial/Financial Lead: Manages financial and strategic aspects.
- Safety and Recovery: On-site safety procedures.
- IT: Technology support and communication channels.
Crisis Response Plan (CRP)
- Defines key interested parties, roles, responsibilities and steps to contain, investigate and remediate the crisis.
- Categorization of crises by severity and impact to prioritize resources.
- Documentation and recording of all crises.
Crisis Communication Process
- Alert: Notification to the Communication Lead within 15 min; the CCT is activated.
- Assessment: Information gathering and incident classification.
- Activation: Contact with affected areas, internal updates, and development and approval of messages by key leaders.
- Post-Mortem: Review of the response, lessons learned and update of the CRP.
Escalation
A clear escalation path with defined criteria and owners for major crises.
Coordination and Information Sharing
- Procedures for coordinating with external parties (authorities, industry partners).
- Voluntary, secure information sharing, respecting privacy and regulations.
- Clear roles for external communication.
Lessons Learned
- Root cause analysis and corrective actions to prevent recurrence.
- Update of the CRP based on findings.
Documentation and Notification
- All phases documented and closed with the Communication Lead's approval.
- Prompt notification to customers and regulators according to legal and contractual obligations.
Testing and Training
- Regular exercises, including scenarios with external parties, to maintain preparedness and effectiveness.
Monitoring and Review
- Annual review by the CCT and management to ensure compliance with the Information Security Management System.
- Adjustments based on lessons learned and best practices.