Crisis Management in a Code Orange World

By Shari Lifland

Ian Mitroff has a message for America's corporations and government agencies: wake up, change your ways and prepare for the inevitable, before it's too late. In his new book, Why Some Companies Emerge Stronger and Better from a Crisis—7 Essential Lessons for Surviving Disaster (AMACOM, 2005), he warns, “America's organizations and institutions are in dire trouble on every conceivable front: physically, intellectually, morally and spiritually…In short, America's organizations and institutions are in crisis, big time. In fact, they are under attack as never before.”

Dr. Mitroff, a professor in both the Marshall school of Business and the Annenberg School for Communications at the University of Southern California, is known as the “Father of Crisis Management.” His previous works include Managing Crises Before They Happen, The Essential Guide to Managing Crisis and A Spiritual Audit of Corporate America. AMA's Shari Lifland recently sat down with Dr. Mitroff to learn about his views on where American institutions stand today in terms of crisis preparedness (and why) and what steps remain to take us into a safe, productive future.

Surely today most American companies must have crisis management plans in place. How effective are they?

What most companies are doing is still low level. It's not crisis management; it's more business continuity—which is probably the easiest thing to sell—backup facilities and things like that. These things are pretty concrete; people can see them, put numbers on them. Actual comprehensive crisis management, that is, thinking systemically, is still not the norm. Companies like to prepare for specific threats. They like to use risk analysis, ranking risk by the probability times the consequence. Well, that eliminates something like a 9-11, because although it's high consequence, it's low probability. In contrast, true crisis management identifies at least one low probability, high consequence event for planning. We're still far from having the right kind of mindset to do this stuff.

You wrote an article for AMA in 2004 entitled “Lessons from 9-11: Are Companies Better Prepared Today?” After interviewing hundreds of high-level executives nationwide, you asked, “What have companies learned since 9-11?” Your answer, sadly, was, “Not much.” This belief is echoed in your new book. If the extremeness of 9-11 didn't force business leaders to “get it,” what's it going to take?

Well that's a good question. And the thing may be—and I hate to say it—that some organizations just may not be capable of learning. You cannot do crisis management independently of being a learning organization. If an organization can't learn, it can't adapt, and the world deals with it harshly. They may literally have to undergo a disaster—whether it's a Value Jet or whatever—to actually change.

The problem is not lack of knowledge. We know best practices. We even have the data to show, as I have in the book, how companies that are proactive make more money, experience fewer crises, and so on. But just presenting logical arguments and evidence doesn't work. So there must be something else operating that keeps rational data from getting through—whether it's fear, greed, denial, etc. These are formidable barriers.

The bottom line about crisis management is that it has to be viewed as a competitive change—as part of the management skills people need to run a large complex organization successfully. It makes companies more profitable and less prone to crisis. The good news is that there are companies out there who do get it. The bad news is that it's still a very small percentage of companies.

What about our government agencies? Why do you think they missed the signals of the disaster that befell our country under their watch?

One key fact is that Al Qaeda is a 21st -century organization. And our government agencies are mostly 19th or 20th century bureaucracies at best. The FBI was designed to find the gangsters of the 1930s and the CIA the “spooks” of the '50s and '60s. That's not the world anymore. The FBI and CIA lack the capability to pass along information within their organizations, let alone between the two. Al Qaeda, in contrast, is a modern organization. It's very efficient and clever. If one part of the organization is shut down, it doesn't destroy the whole. Our bureaucracies weren't designed to deal with it.

If you read The 9-11 Report, literally every page shows the failure of organizations to cope with the present. The infrastructure could not respond; it couldn't pick up the early warning signals, even though they were there. People could have imagined these scenarios—they weren't that far fetched. It's called the failure of success. The government agencies failed because they experienced limited success for a long time. People who did try to read the warning signals were kicked out, ignored or punished in some way. So the system was very effective, as most organizations are, in protecting the old ways.

I don't believe it's hopeless, but the institutions of the past aren't adequate to deal with the problems of the present. Obviously we can't redesign them all overnight; it's a formidable task.

In your book you write that the number of crises is growing rapidly—the number of events over the last 2 years has exceeded that of any previous period in the last 20 years. Is there an explanation for this increase in unfortunate events?

There are two reasons. First of all, because of the vulnerability, complexity and interconnectivity of our systems, and secondly, because there is a growing inability to keep secrets, thanks to the vigilance of the news media. Years ago, normal accidents were confined to perhaps one industry at a time. As companies get bigger, the repercussions are bigger if something bad happens. As the recent East Coast power outage showed, everything's connected now. The outage affected ATMs, water purification systems, and so on. Everything is tied together. Then on top of that you add the abnormal, the extremes like Al Qaeda, where people want to intentionally inject evil. To respond effectively you have to manage the entire system.

You recommend that every organization hire a Chief Crisis Officer. Since this is a fairly new area of expertise, what background/qualifications does the job require? Where does the position fit into an org chart?

No one really knows. It's a paradox that you want to hire somebody who can manage crisis for an organization, but it can't become just another bureaucratic silo function. What I am proposing is that somebody has to understand the systemic nature of crisis. Crisis management shouldn't be in a department all of its own, but rather made up of a team of people from throughout the company—people from public affairs, security, the executive office and CEO, etc. If it were up to me, there would be a crisis management team managing the company as a whole. It wouldn't just be managing crises.

I don't just fault corporate executives. Business schools are part of the problem. Most business school faculty are very narrowly educated, along very technical lines. Graduates may know finance or marketing, but they don't know much about ethics or organizational behavior. We're in an age of transition where conventional organizations are being greatly challenged. It has to start with a change in business education.

Is there any crisis for which one cannot prepare?

Not really. When I say prepare, that doesn't mean a crisis is preventable. Take earthquake. Eventually, perhaps 500 years from now, all of Los Angeles will have been rebuilt so that all the buildings can withstand an earthquake. So they'll be able to restrict the damage and save lives, even though they won't be able to prevent the quake from happening.

There are various categories of crisis. You can prepare for at least one example in each category. The crisis won't happen exactly as you've prepared, but that's irrelevant, because you will have thought about the unthinkable and you will be able to cope better.

Talk a bit about the psychological effects of crisis. What can individuals and institutions do to better deal with the human elements involved in a difficult situation?

When the World Trade Center buildings collapsed, it was not only the physical structures that fell, but also our assumptions and our beliefs. The entire system collapsed—and most people don't understand that. They can see the buildings collapse; they can't see the assumptions collapse. And that feeling lingers on.

If you don't talk about your feelings within 24 hours of a crisis, you'll just shut down. So what should we do—give all employees trauma counseling? Well, maybe it's not a bad idea. You never know how individuals are going to react. Why does the military send people to basic training? Because you can't just take somebody off the street, send them out there and expect them physically or emotionally to deal with things.

Events in business can also be so traumatic that people need to prepare. But business people don't have the background for it. Harvard is the only business school that has a professor who is a trained psychoanalyst. And I just find that outrageous. We need to teach business students how to deal with the complexities and irrationalities of human beings. If we were all rational, we'd have figured out by now how to solve some big problems—the conflict in the Middle East, Northern Ireland, and so on.

Many companies (AMA included) held professionally moderated counseling sessions after 9-11. But in the more than 3 1/2 years since then, most companies haven't done more than distribute a list of emergency phone numbers to employees. Is this typical?

Yes, that is typical. I'm sure employees would like someone to ask them, “What's happened with you since 9-11? How are you feeling? Do you ever have dreams or nightmares about 9-11? What worries and concerns do you have?” Just talking about it will help.

On a personal note, how do you apply CM principles in your own life?

It's kind of like being a psychiatrist in that you're trained with a kind of clinical detachment. When any of these crises happen, I process it through a different framework. I say, “Well, here's another example of denial or why an organization was not prepared. Of course, after 9-11 I was numb for a week just like everybody else. I'm not completely dispassionate, but I understand what's going on and why, so I am able to analyze it in a different way.

Do people call you fatalistic?

The ultimate fatalism would be if we had no recommendations on how to improve things. But I'm not saying that at all. I'm saying, “We now know why these events happen and we can tell people what steps they can take that are effective.” The data show that by being proactive and realistic, you become better and stronger. I'm actually more angry than fatalistic. I call it realistic. Sure, reality is painful. But somebody has to tell it like it is.

For more information about Why Some Companies Emerge Stronger and Better from a Crisis and AMACOM's extensive catalog of other business titles, click here.

If you'd like to explore this topic further, consider these AMA seminars:

• Disaster Recovery Planning: Insuring Business Continuity
• Developing Leaders at All Levels: Fostering Initiative and Accountability

AMA On-site: Every one of AMA's 170+ public seminars can be delivered on-site. This flexible, money-saving option allows you to train ten or more people, when and where you choose, at a low cost per participant.

Author Bio: Shari Lifland manages content for AMA's Members-only Website and is Associate Editor of AMA's print journal, MWorld.