Every organization has their own structure and process for making decisions, especially those concerning the spending of money. However, when faced with an unexpected outage or disaster, things can change, sometimes unpredictably. Normal management processes can be completely disrupted depending on the nature of the event and the availability of the normal decision makers. For example, on 9-11, I had the exalted title of Director, Disaster Recovery and Business Continuance for a major technology company. Soon after the event began to unfold I found out that the CEO and CFO were on vacation together with their families and no one knew where. With air travel stopped dead and cell coverage overloaded, they were completely out of touch and unable to direct efforts to respond to the crisis. Additionally, almost all of the other senior management team were visiting a potential acquisition in another state and they were off the table also. In effect, the Facilities Manager and I were the only senior managers available to lead the crisis management efforts, and we were huddled around a small black and white TV trying to find out what was going on in the world. We soldiered on and made financial and management decisions normally above our pay grades and received confirmation that they were the correct decisions several days later when management came back on line. Afterward, I thought of a couple of items that should be included in our planning efforts. They are:
Management Succession Plans. In order to provide for the unavailability of key decision makers in a crisis, either personal or corporate, every manager should have a written management succession plan. Key leaders should formally identify who exactly should take over for them in their absence and what special authorities should be granted to them. (Remember Al Haig declared he was in charge when President Reagan was shot until someone reminded him that’s not what the Constitution says.) I developed my methodology when I was called in to consult with a family-owned Southern California Bank to write a plan for their IT Director. The Board had only recently found out his hobby was flying small acrobatic planes and they were worried that, God forbid, he crashed, no one knew what exactly he was working on or how to manage his department in his absence. After assuring him the Board wasn’t looking to replace him, I was able to work with him to develop his first written job description, identify key staff who could assume most of his time-critical responsibilities, develop a written status report format and schedule, and improve his future planning documentation. I also interviewed him about his decision making methods and war gamed some scenarios to expose how he would likely respond if he were on duty. Lastly, I arranged for another senior manager to spend two days per month sitting with him getting up to speed on current state developments. In the end, the Board felt they had closed a major gap in their recovery planning efforts and used the methodology to create plans for other key roles as well.
Refined Tabletop Exercises. I am a firm believer in the usefulness of tabletop exercises in testing all facets of disaster recovery and business continuity plans. The exercise is a conference room based walkthrough of how a company will respond to an unexpected outage scenario revealed at the start of the exercise. The one wrinkle I always include is the unavailability of at least one key decision maker (or key technical guru). If the scenario is imagined correctly, their absence will be used to identify areas of expertise, tribal knowledge, or key decisions which are not documented or delegated and are sorely missed. In my experience, the following often comes up if the key decision maker is not available:
- Who has approval authority now for the emergency expenditures? (If the backup has a much lower limit, how does that get bumped up to cover the spend?)
- Who has authority to increase corporate credit card limits for the traveling recovery staff? (Do they even have corporate cards? If not, how do we expedite this?)
- Who else can authorize increased system access authority levels? (Who thinks through the security risks?)
- Who approves the PR statement that goes out? (Think about a canned statement with blanks to fill in with actual details so the word smiths don’t take 2 days to invent the wheel.)
- What do we say about casualties and injuries?
- Can we send the hourly staff home and still pay them for the day? (On 9-11 I used HR’s snow day policy to authorize this. I put on my Pirates of Penszance Admiral’s hat as the guy in charge and declared it was snowing outside!)
- Do we still pay people who can’t come in because of the disaster? (What is our normal policy and if we want to make an exception, do we have the authority to do that?)
- Who can authorize unexpected overtime?
- What are our legal and contractual obligations and can we get some mercy?
- Do we notify our customers yet, and do we have to report this to a regulating authority?
If the people who make these decisions, and more, aren’t available, is there a management succession plan in place which delegates the authority to make the call in their absence? Don’t worry if you uncover missing elements, that’s what the exercise is meant to do: expose gaps that can be remediated.
Conclusion. Without good management succession plans in place the chances are that good decisions will not be made or even thought about until it’s too late. As a father, I have seen the truth in the old saying, “One child, one brain. Two children, half a brain. Three children, no brain at all.” (In extreme pressure situations, some managers tend to revert to this in the middle of “groupthink”.) In order to avoid confusion, conflicting agendas, and the Al Haig Syndrome, make sure everyone knows how decisions will be made in an unexpected event with key decision makers absent. As usual, leave comments here or contact me directly. Happy decision making!
© Copyright and All Rights Reserved Howard M. Peace