See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/254864017

An Introduction to Crisis Management

Article · August 2012

CITATION READS
1 30,878

1 author:

Haris Hamidovic
Independent Researcher - Information Security
101 PUBLICATIONS   32 CITATIONS   

SEE PROFILE

All content following this page was uploaded by Haris Hamidovic on 04 June 2014.

The user has requested enhancement of the downloaded file.

Journal Online

An Introduction to Crisis Management

Haris Hamidovic, CIA,
ISMS IA, ITIL, IT Project+,
is chief information security
officer at Microcredit
Foundation EKI Sarajevo, “Businesses operate in an increasingly risky include direct intervention and decisive strategic
Bosnia and Herzegovina. Prior environment.”1 As an illustration, research shows leadership that cannot be preconceived. They
to his current assignment, that more than 60 percent of small and medium- may even include strategic repositioning of
Hamidovic served as IT sized enterprises (SMEs) in Switzerland and in the organization as a whole, and for that
specialist in the North Atlantic the European Union (EU) experience some form reason, crisis management is the domain of top
Treaty Organization-led of disaster.2 management.8 Organizational change is about
Stabilization Force in Bosnia Creating and maintaining a business making alterations to the organization’s purpose,
and Herzegovina. He is the continuity plan increases awareness of threats, culture, structure and processes in response to
author of five books and more prepares the organization for potential disruption seen or anticipated changes in the environment,
than 70 articles for business and helps ensure that the organization has the which can be especially significant during a crisis.
and IT-related publications. resources and information needed to deal with Strategic management of change is all about
Hamidovic is a certified IT such emergencies.3 identifying and embedding in the organization
expert appointed by the For setting up and managing an effective those changes that will ensure the long-term
Federal Ministry of Justice business continuity management system, an survival of the organization.9
of Bosnia and Herzegovina organization needs to define a risk assessment Publicly Available Specification (PAS)
and the Federal Ministry of process that will enable it to understand the 200:2011 Crisis management. Guidance and
Physical Planning of Bosnia threats and vulnerabilities of its critical activities good practice, recently published by the British
and Herzegovina. He is a and supporting resources. It is necessary to assess Standards Institution, is a practical guide to
doctoral candidate in critical the impact that would arise if an identified threat establishing good practice on crisis management.
information infrastructure became an incident and caused a It provides guidance to help organizations of any
protection at the Dzemal business disruption.4 size or sector develop and implement a crisis
Bijedic University, in Mostar, For each of its critical activities, an management capability. This article introduces
Bosnia and Herzegovina. organization should determine potential loss some of this guide’s recommendations.
mitigation and risk treatments that:5
• Reduce the likelihood of a disruption Defining Crises
• Shorten the period of disruption PAS 200:2011 defines a crisis as an “inherently
• Limit the impact of a disruption on its key abnormal, unstable and complex situation that
products and services represents a threat to the strategic objectives,
Nevertheless, one should bear in mind that reputation or existence of an organization.”10
risk events are about the future, which cannot “Crises are not synonymous with incidents,
be predicted. Regardless of the time spent, one and it is argued that their management presents
simply cannot identify all risk in advance. The special challenges that require different
best one can do is to make educated guesses approaches.” PAS 200:2011 clarifies that
preparing for the most likely happenings that will “incidents are said to have ‘structure’ because
make the biggest impact on the organization.6 they are produced by identifiable and assessable
Risk that is not identified, or at least not risks and present themselves in fairly predictable
identified with the scale and intensity it presents, ways.” Furthermore, “as with the majority
can produce a crisis. Crises may also be the product of risks that concern business continuity
of an unforeseen combination of interdependent management (BCM) planning, even the most
risk. They develop in unpredictable ways, and the challenging and serious incidents generally lend
response usually requires genuinely creative, as themselves to preprepared responses.”11
opposed to prepared, solutions.7 Crises could stem from an incident, but not
The roles of strategic management are necessarily.12 Some suggest that one can “assume
amplified during a crisis. They are likely to that a crisis is reached when the organization

ISACA JOURNAL Volume 5, 2012 1

 moves beyond its abilities to contain the task demands of crises are situations in which organized industrial activities
the ‘event’ and it escalates still further beyond the limits of are the source of major damage to human life and natural and
contingency plans.”13 (See figure 1.) social environments.”17
From a different perspective, PAS 200:2011 suggests a
Figure 1—Crisis Emergence crisis typology of sudden and smoldering crises. Sudden
crises “are characterized by their immediate onset. They tend
Severity of
Consequences to be unanticipated and escalate very quickly, often as a result
Point of Inflection at of a severe triggering event or incident that may be out of the
Crisis Emergence
Limits of
organization’s control,”18 while smoldering crises are those for
Contingency which the “common feature is that impact on the organization
Planing Crisis Generated
and its stakeholders grows, sometimes undetected, over a
Contingency Plans
Mobilized Problem Space period of time, whilst indicators of potential crisis are possibly
Initiating missed, denied, ignored or misunderstood.”19
Trigger
Areas of It is generally accepted in the literature of crisis
Mitigation
Rapid management that most crises are of the smoldering type. This
Emergence and Potential
Escalation for Crisis makes a good case for developing a facility for systematic
Contained
Initial Phase of Escalation examination of potential threats, opportunities and future
developments, which may have the potential to create new
Timeline of Events risk or change the character of risk already identified, so that
potential and emerging threats may be identified, assessed and
Source: Kwong Weng Yap; “Managing Ahead of Crises: Rising Towards a
Model of Adaptability,” SCARR Conference: Managing the Social Impacts of mitigated as early as possible.20
Change From a Risk Perspective, Beijing, China, 15-17 April 2009
Crisis Management Capability
Because crises are not synonymous with incidents, PAS 200:2011 is very clear that it is not prescriptive about
PAS 200:2011 explains that crisis management is very solutions. There are no checklists and nor should there be, as
different from incident management: “[Crises] develop good practice in crisis preparedness is something that each
in unpredictable ways, and the response usually requires organization needs to develop within the unique context of
genuinely creative, as opposed to preprepared solutions. that organization. PAS 200:2011 provides a framework within
Indeed, it is argued that preprepared solutions (of the sort which a company can do this thinking. In particular, PAS
designed to deal with more predictable and structured 200:2011 provides “the four basic requirements of capability:”21
incidents) are unlikely to work in complex and ill-structured • An intellectual requirement, which includes the ability to
crises. They may, in fact, be counterproductive.”14 analyze situations, set strategy, determine options, make
As crisis management is about making major strategic decisions and evaluate their impact. It also includes the
decisions in abnormal, unstable and complex situations, shared concepts that underpin the discipline of
a lengthy and complicated manual of the sort familiar to crisis management.
incident managers would be more of a hindrance than a help. • An organizational requirement, which includes the
The crisis management plan “is not a guide as to what to do structures and processes needed to translate decisions into
next in a given situation” but rather a framework in which action and review their impact
good decisions can be taken.15 • A cultural requirement, which reflects the willingness of
staff to share and support the top managers’ intentions
Crisis Typology and policies
Due to the limitless types of crises,16 for better analysis, • A logistic requirement, which reflects the ability to support
these can be divided into two main categories: industrial solutions by applying the right resources in the right place,
and natural crises. “It is necessity to make this distinction as at the right time
natural crises are created by acts of nature, whereas industrial

2 ISACA JOURNAL Volume 5, 2012

Crisis Warnings information security and incident management activities.
Before they occur, the majority of crises sends a trail of early Organizations should actively learn from crises that
warning signals, which announce the possibility that a crisis affected the organization or other organizations.
will take place;22 these signals are sometimes very weak or Furthermore, recovery from crisis should be seen
hard to detect. The following are some limitations of the as an opportunity to regenerate, restructure or realign
crisis warnings:23 an organization. The essence of recovery should not be
• Weak or subtle signals necessarily a return to previous normality. It may mean
• Sources of crisis signals not viewed as credible moving toward a model of business and organizational
• Signals or threats embedded in routine messages structures that represent a new normality.
• Risk/threat messages systematically distorted
• Signals not reaching the appropriate persons Endnotes
Companies, similar to individuals, try to deny their 1 British Standards Institution, Business continuity
weaknesses. The reasons why organizations do not engage in a management and risk management. The role of standards,
proper crisis management are often:24 2011
• Denial—Organizations deny that they might be vulnerable Dawes, Terry; Wolfgang Mahr; Business Continuity for
2

to threats of imminent crisis and, thus, decide that no SMEs, BRaC-2020/Terry Dawes Consulting, 2011
measure is to be taken. 3 Ibid.
• Disavowal—Organizations recognize that a crisis will affect 4 British Standards Institution, BS 25999-2:2007
the organization, but its impact is considered to be too Specification for business continuity management, 2007
small to be taken into consideration; in other words, 5
Ibid.
the magnitude and importance of the crisis are 6 Hubbard, Larry; “Skip the Numbers: Assessing Risk Is Not
significantly diminished. a Math Game!,” New Perspective, February 2009
• Grandiosity—Organizations presume that “we are so big British Standards Institution, PAS 200:2011 Crisis
7

and powerful that we will be protected from the crisis.” management. Guidance and good practice, 2011
• Idealization—Organizations consider that crises do not 8 Ibid.
happen to good organizations, thus ignoring all existing 9 National Defense University, “Strategic Leadership and
signals of crisis. Decision Making,” www.au.af.mil/au/awc/awcgate/ndu/
• Intellectualization—Organizations minimize the probability strat-ldr-dm/pt4ch19.html
of occurrence of a crisis. 10 Op cit, British Standards Institution, PAS 200:2011
• Compartmentalization—The organization believes that 11 Ibid.
if a crisis should affect the company, it will affect only 12 The potential origins of crises are diverse. For example,
some departments. they may be externally generated by changes in the
business, political or social environment within which the
Conclusion organization operates, or derived from breaches (perceived
Too few organizations take crisis management into account. or actual) of standards of probity, ethics or corporate
The capability to manage crises should not be seen as responsibility. (PAS 200:2011)

“
something that can simply 13 Smith, D.; D. Elliot; Key Readings in Crisis Management,
be developed as and when Routledge Publishers, USA, 2006, referenced in Yap, Kwong
Too few organizations
needed. The development Weng, “Managing Ahead of Crises: Rising Towards a Model
take crisis management of the crisis management

”
of Adaptability,” Pointer Monograph No. 7, 2009
into account. capability requires a 14 Regester Larkin; RL Assessment of PAS 200, 2011
systematic approach. 15 Ibid.
In developing the crisis management capability, there will 16 Cretu, Paula Madalina; Jonathan Puentes Alvarez;
be many opportunities for synergy with ordinary business Managing Organizational Crises in the Light of Political
management processes, business continuity arrangements, Unrest, Linköping University, 2010

ISACA JOURNAL Volume 5, 2012 3

 17 Smith, D.; D. Elliot; Key Readings in Crisis Management:
Systems and Structures for Prevention and Recovery,
1st Edition, Routledge Publishers, 2006, referenced
in Cretu, Paula Madalina; Jonathan Puentes Alvarez;
Managing Organizational Crises in the Light of Political
Unrest, Linköping University, 2010
Op cit, British Standards Institution, PAS 200:2011
18

19 Ibid.
20 Ibid.
21 Ibid.
22 Mitroff, I. I.; G. Anagnos; Managing Crises Before They
Happen: What Every Executive and Manager Needs to
Know About Crisis Management, American Management
Association, 2001, referenced in Cretu, Paula Madalina;
Jonathan Puentes Alvarez; Managing Organizational Crises
in the Light of Political Unrest, Linköping University, 2010
23 Seeger, M. W.; T. L. Sellnow; R. R. Ulmer; Communication
and Organizational Crisis, Preager Publishers, 2003,
referenced in Cretu, Paula Madalina; Jonathan Puentes
Alvarez, Managing Organizational Crises in the Light of
Political Unrest, Linköping University, 2010
24 Op cit, Mitroff

The ISACA Journal is published by ISACA. Membership in the association, a voluntary organization serving IT governance professionals, entitles one to receive an annual subscription
to the ISACA Journal.

Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and/or the IT Governance
Institute® and their committees, and from opinions endorsed by authors’ employers, or the editors of this Journal. ISACA Journal does not attest to the originality of authors’ content.

© 2012 ISACA. All rights reserved.

Instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. For other copying, reprint or republication, permission must be obtained in
writing from the association. Where necessary, permission is granted by the copyright owners for those registered with the Copyright Clearance Center (CCC), 27 Congress St.,
Salem, MA 01970, to photocopy articles owned by ISACA, for a flat fee of US $2.50 per article plus 25¢ per page. Send payment to the CCC stating the ISSN (1526-7407), date,
volume, and first and last page number of each article. Copying for other than personal use or internal reference, or of articles or columns not owned by the association without
express permission of the association or the copyright owner is expressly prohibited.

www.isaca.org

4 ISACA JOURNAL Volume 5, 2012

View publication stats