Boards are “poor” at preparing for crisis, according to an expert taking part in a special Board Agenda webinar produced in association with Diligent.

James McAlister, a director of specialist consultancy Crisis Prepared, added that it is impossible to plan for a specific crisis, but companies can define a “methodology” for dealing with crises.

He said a methodology would include definitions so boards could understand whether they were dealing with an “incident”, a “crisis” or a “business disruption” event.

“The board have been historically poor at preparing for crisis because a lot of them think its down to the operational, the tactical, aspects of the organisation to deal with.

“And it is—the problems are never solved at a strategic level, they’re solved tactically and operationally throughout the organisation.

“The board, or top management… have got to switch on to the fact that they can’t get away from the accountability and the responsibility of organisational resilience or a crisis.

“A lot of the time it starts with: What does the organisation define as a crisis or an incident, or business continuity disruption or a disaster?

“For me understanding what they actually dealing with, not by name but by definition, and who will be dealing with it, at what level and their roles and responsibilities are, is by far the best way to prepare for these kinds of events.”

‘What, how… and why’

Henry Jiang, chief information security officer and cybersecurity expert at Diligent, also stressed the importance of understanding and categorising what kind of event is faced by an organisation.

What an executive or non-executive may consider a “crisis” from their board position may be different to operational staff, who will view it as an incident to be resolved. Failure to understand the scale of a threat could lead to its own problems.

“Resilience means different things to different people,” he said, “but fundamentally, it is the ability to handle a crisis.”

He adds: “For me as a practitioner, it is the ‘what’ and ‘how’. At the board level it’s the ‘why’.

“A lot of people think that is easy, a crisis, but you really need to identify and categorise crises, because mishandling crisis is, itself, a crisis.”

Carolyn Clarke, chief executive of the Brave Consultancy, experts on navigating risk, said boards should be focused on the fallout from crisis incidents. An event will have implications for customers or relationships with critical people or organisations.

“Boards and senior executives have got to think through the outcomes of the incident and then have plans to respond,” said Clarke.

She also stressed the importance of strong and prompt communications as a critical part of crisis response.

“It’s really important to have thought through the whole engagement communications piece. It’s one aspect but it’s the critical aspect.

“If you look in particular at a crisis that happens quickly, the thing that causes most damage —and this is where the board and executives can do damage, if not do good—is if that communications message is ill thought-through.”

Watch the Road to Resiliency webinar here.