Leading through Crisis: Calm, capable, and confident

Episode #82 Leading through Crisis: Calm, capable, and confident

Hey there, and welcome to Episode #82 of the No Bullshit Leadersh!p podcast. This week’s episode, “Leading Through Crisis: Calm, Capable, and Confident”. As the world’s been immersed in COVID-19 panic, and the opaque implementation of remedial measures over the proceeding weeks, we’re all seeing how leaders lead – both good and bad. Well, today’s episode doesn’t focus on the coronavirus, for two reasons. Firstly, because there’s already more information in the public domain than anyone could possibly hope to sensibly digest. And secondly, the responses to COVID-19 are changing by the hour, and whatever I record in the next 20 minutes or so will be hopelessly out of date by the time this episode goes to air. Now I’m recording this on a lazy Sunday afternoon in Brisbane, Australia, 15th of March, 2020 and you’ll be listening to it sometime after Wednesday, the 25th of March. Who knows what will happen in the next 10 days.

But as a general rule, always remember when you feel as though the world is ending, this too shall pass. Now what I do want to achieve in this episode is to open your eyes to the wide world of crisis management. This is a core part of every leader’s repertoire. If you master this, you’ll be able to lead your stakeholders through the uncertainties that invariably present when the sh!t hits the fan. So we’ll start by examining what actually constitutes a crisis. I’ll give some examples of the typical types of crises you may be likely to face. We’ll take a quick look at a discipline called ‘business continuity planning’, and I’m going to finish with seven tips for leading through a crisis and we’ll have a free downloadable on the Your CEO Mentor website with the seven tips there. So, let’s get into it!

‘Crisis’ is any event that is severely disruptive to an organisation and its stakeholders. These events are most often unanticipated, and they’re almost always unwelcome. But a crisis can be relatively small, so for example, a telecommunications failure that results in loss of service your customers for a couple of hours, or it can be extraordinarily large, and some crises are so significant they can bring down a whole organisation. So for example, a number of US airlines went into bankruptcy and never emerged following the terrorist attacks of September 11, 2001. A crisis can be internal within the bounds of your organisation – so for example, an internal failure of systems or processes that cause loss of timeline or productivity issues inside the business when manual workarounds are required – or it can be of widespread global significance. Well, okay, I guess I should mention coronavirus as a reasonably good example of a global crisis.

But a crisis can be largely within your control to remediate and return to normal – so, for example, loss of one of your work sites to fire – or it can require many other stakeholders to be involved in the solution and the path forward. So for example, if you had an unfortunate death of an employee in a work related accident, this can result in regulators, police, forensic investigators, and many others needing to be involved. But regardless of the type of crisis, they all have three common elements. The first is that they are largely unexpected. The second is they present an imminent threat, which needs to be dealt with in some way. And the third is that they require time critical decision making. Now there are really two distinct elements to crisis management in my head. Let’s call them pre-crisis and post-crisis.

Now, most importantly, pre-crisis is all about what we call risk management and this is how to minimise the chance of a crisis actually occurring. Now, the discipline of risk management has been around for a really, really long time and most of you will have been exposed to it. Basically what it does is it enables you to imagine what could possibly go wrong. These are what we call risks. And they’re then rated based on the likelihood of the risk occurring and the consequence if it actually did occur, thereby giving you a graphical representation and a quantification of what that risk actually is. So based on some sort of scale of likelihood and consequence, we can then develop remedial actions or mitigation strategies. The post-crisis piece though is what we call business continuity planning. So what do we roll into play when various scenarios occur under a crisis. And remember that some crises are almost completely unforeseeable. So I’m not sure there are too many organisations that had contingency plans for the current virus outbreak. But both risk management planning and business continuity planning require you to work through what we call ‘worst case scenarios’ and to imagine a whole bunch of really horrible things happening, while at the same time, working out how to implement structured solutions to those problems.

Now, particularly on the risk management side, this creates the need for astute decision making in terms of how to mitigate a risk, and then how much time, energy, and money to spend in order to reduce the risk to a more acceptable level. These mitigation techniques – which are just basically proactive actions – can reduce both the likelihood of something occurring and the consequence of that is experienced when it does occur. Crisis management is a little less creative an exercise than risk management. It’s enacted when something’s already happened, so you can no longer avoid it. The question then becomes, “How do I lead through this for best effect?”, and this is where we’re going to spend the rest of the episode. Every organisation, no matter how small, has to think about risk and crisis management – you just need to make sure that your effort is fit for purpose.

Let’s look at some examples of crises that you may be familiar with and some others that perhaps you won’t. There are some pretty large and publicly visible crises that we can use to inform how we would respond in the future to any crisis that faces us. So the first one I want to talk about briefly is the Deepwater Horizon oil well explosion in the Gulf of Mexico almost 10 years ago. Around 5 million barrels of oil discharged in the Gulf of Mexico once the well failed. 11 people were killed and many more injured, but the cost to British Petroleum, the owner of the well, was in order of $65 billion, once all was said and done with remediation, compensation and fines. Countless billions of dollars were lost in tourism, unemployment, and commercial revenues. BP shares lost almost half their value in the ensuring three month period. It had high global visibility and high impact, so news footage of seabirds covered in thick oil sludge are shocking and impactful, but it had a massive impact on communities in the environment and it was an incredible financial impact on the owners.

When we look at how the leaders of these companies responded to the incident, though, it’s amazing to see how poorly this was actually done for something at such a grand scale. For a start, the speed and effectiveness of the recovery was hampered by deliberate misinformation coming out of BP and Transocean. Criminal charges were even laid for coverups and the obstruction of justice. And I’m sure that Tony Hayward, the CEO of BP at the time wishes he could take back the words from his press conference where he said, “No one wants this to be over more than me, I’d like my life back.” That got a really, really big run in the global media, as you might imagine. Another example is the range of criminal data theft crises, hacker intrusions and system breaches that go on on a regular basis. So in 2005 and one of the early ones, a company called Card System Solutions, that processes pretty much all the major credit cards, had 40 million customer records hacked and stolen.

The Philippines Electoral Commission in 2016 had 55 million voter records compromised and stolen. Now, arguably this could be used to shape who’s in political power in that country, and it’s not a good look when the Philippines has historically had to deal with electoral fraud in the past. My favourite though, is a company called Ashley Madison that was hacked in 2015. Hackers stole all of its customer data – all 32 million subscriber records – and threatened to release them publicly. So what, you say? Well, Ashley Madison is a website service that facilitates extra-marital affairs. So you’d imagine that breach of privacy could be a little tricky. Anyhow released the information they did, and the site still is going strong today. So supply and demand, right? Go figure.

Now I’ve had a few notable crises that are quite close to my heart from my career. So it started with the unsolicited takeover of MIM, the ASX 50 listed mining company, when I was Chief Information Officer. This required swift and immediate response to keep systems running through extreme pressure, uncertainty, and change events. But the potential crisis was internal only, and we never really mounted a crisis team to handle it. The next significant one for me was when I was at Aurizon – and this happened just after we’d listed on the Australian Stock Exchange – but weather and storm events caused widespread flooding in central Queensland, that cutoff supply lines between the coal mines and the ports for weeks and in some cases even months. Now, this was at the height of the commodity price boom, so our customers, the coal miners, were selling both thermal and metallurgical coal for two to three times the normal contract price. So you can imagine how the severe damage to the infrastructure and the disruption to the supply chain caused them so much grief. Now, I led the response to this, initially as acting Chief Executive as I was at the time and then, as head of the flood recovery ask force, and this was full crisis mode, trust me.

As Chief Executive of CS energy, there were a number of ‘crises’, if we can call them that. None of them actually ended up in having a crisis situation called and falling into crisis mode. They were more the slow burn types of crises that require ongoing management. The first of these was a significant coal supply issue between a mine and one of our power stations that threatened the ongoing viability of that power station asset. Now this affected much more broadly than just us. It was market supply and price, and it pushed CS energy to significant financial losses, which could have been fatal. We also had to deal with the customer backlash of rising electricity prices and the impact of those on market dynamics in businesses. Now that got really public really, really quickly and also very, very political. So dealing with that on a day-to-day basis was pretty tricky.

We had a near multiple-fatality in an industrial incident at one of our power stations. It was a Samarco-style failure in one of our internal walls of a waste facility, but it didn’t result in any external impact because there were no fatalities. Through all of these, I’ve needed a well thought out plan, a surplus of good people around me, decisive action and communication, and very cool heads under pressure to navigate our way through these. Oh yeah, and of course a little bit of luck. But the bottom line – no one is immune. Universities and colleges, defence forces, financial institutions, social media platforms. Each of these breaches presents a potentially organisation-defining event where lack of trust can lead to erosion of the brand and ultimately destruction of economic value.

Let’s talk quickly about business continuity planning. Rule number one of crisis management: You can’t change something that has happened. What you can do is minimise damage and maximise your organization’s reputation through how you handle the crisis and lead your way through it. Now, this requires really good planning in advance. You get back to understanding your risks, and working out what the appropriate mitigation actions might be. But business continuity plans have to be in place for what might be considered common occurrences or foreseeable events. So I want to run through a few of these for you. Loss of a physical premises. How and where do people work if one of your buildings is lost? What technology is required to support this? And do you need certain critical business enablers to be housed on a different location to a particular office so that it’s available if something goes wrong? Do you have an alternate physical location that people can work from?

Loss of data. Think about the backup and recovery regime for the data that’s critical to your organization’s running. This is a pretty well worn discipline in the IT and systems world called ‘disaster recovery planning’. Loss of systems. Do you require manual workarounds if systems go down? How quickly can systems be re-established after an outage, and how much data loss would you experience? Which systems are the most critical to have backup and running quickly, and how long can your business survive without them? Loss of key personnel. There was a tragic accident when a charter plane went down in 2010 in the Democratic Republic of the Congo, crashing with prominent mining businessman Ken Talbot onboard. Now included in the 11 people killed in that accident was the whole board of Sundance Resources, its managing director and its company secretary. Many companies have travel policies now to prevent significant loss of key personnel simultaneously. And this is part of risk management.

There’s loss of supply chain control. And a good example of that is when the Australian live export beef market took a hit back in 2011. It went into lockdown after a government ban on exports to Indonesia was put into effect, and that was felt for many years afterwards. There’s loss of product quality or reliability. So we’ve seen tampering and poisoning events that required product recalls. And then there’s loss of communications. So running facilities in remote locations requires contingency plans for loss of communications. It was only 15 years ago that losses in the millions of dollars could be experienced when a farmer on a property in Outback Queensland inadvertently severed a fibre optic cable with a backhoe, cutting remote operations from centralised systems. And this just gives you a good idea of the type of events that we should reasonably be able to anticipate and to create business continuity plans for. But there’s one thing I know. Once you finished developing your comprehensive business continuity plans, you need to know that they’re not going to work. It’s almost impossible to create a robust, real world plan from a desktop exercise. So this is why it’s so important that any plan you develop, you test it thoroughly. Until you’ve tested the plans by running mock simulations of certain events, the BCPs will be at best a helpful guide for your thinking, if anything does go wrong.

Let’s just wrap this up with seven tips for leading through a crisis. As a leader in a crisis, your the one that people look to for reassurance. For this reason, you have to be confident in how you do a few things. How you communicate, how you make decisions, and how you deploy resources. And all of this is time sensitive when you’re in a crisis. You don’t have the luxury of ruminating or procrastinating as many of you can do in your day-to-day work. So number one, stem the bleeding. Think of it like an emergency room in a hospital. While you’re doing triage, you have to make sure that the patient is stabilised and doesn’t bleed out. So whatever the scenario, your first obligation is to ensure that the event is not ongoing, and the impacts have been fully contained.

Years ago, working at Aurizon, I remember a train derailment around that that happened in North Queensland. Now any derailment is a pretty serious event. In this case, the driver survived and they weren’t even too badly injured. But as they got out of the cabin of that wrecked train, they were understandably dazed, and they found the locomotive had come to rest next to a nest of Coastal Taipans, one of Australia’s most venomous snakes. So the very first thing about the recovery exercise was to deal with the exigent threat of encounters between snakes and recovery crews. Make sure you contain the event.

Number two, declare a crisis, or don’t. But there’s gotta be a really clear decision point. And this requires some shrewd judgemental, although sometimes it’s more obvious than others. Have a clear decision point as to whether you go into crisis mode, which requires new roles to be established, new accountabilities, new decision making processes, and forums and so forth, or whether you deal with it through the normal business as usual structures and accountabilities that your organisation already has in place. Now this can be trickier than it sounds. Once you go into crisis mode, you also have to remember that there has to be a stand down criteria, for when the baton is handed back to the BAU team, many of whom are of course part of the crisis team as well. So standing up a crisis team, and then standing it down is key to your thinking as a leader.

Number three, activate business continuity plans and establish a ‘war room’. So go to the plans and clearly establish the necessary accountabilities. The most senior person might not be the person who leads the recovery efforts. So, at CS Energy, we didn’t ever declare a formal crisis, but even if we had, I wouldn’t have been the one who led the recovery planning personally. I would have been kept outside of the loop, because I had a different role to play. So, I had to handle a media requirements that arose, I had to communicate and deal with our major stakeholders and I had to be the escalation point for major decisions that had whole-of-company impact. I couldn’t do that if I was too immersed in the issues.

Number four, know your stakeholders and the impacts of the crisis on them. Most businesses should have a stakeholder management plan of sorts. The stakeholders can include anyone from employees, customers to community groups, suppliers, board members, regulators. The list goes on and on. Thinking back to the example of the 2011 floods, one of the key stakeholders we had was the Australian Securities Exchange, because as a listed company, we had to continuously disclose our financial position, that may have affected the price of shares that were being traded. But we had to communicate with customers about likely dates for reopening the damage infrastructure in different parts of the network. We had to communicate with staff about expectations around safe work and the inherent risks in the recovery operations. The list just goes on.

Number five, open communication channels – but not too soon. One of the common elements of a well handled crisis is that the leader who is the face of the crisis – whether it’s a medical expert, a CEO, a politician – communicates clearly and early. But don’t communicate if you have nothing to say. There’s nothing worse than seeing someone standing in front of a camera looking like a Muppet. Equally read the play on expectations for feeding the void of information. The more public, the more considered your response and the more critical your regular communication updates are, but tailor all your communications to the targeted stakeholder group that you’re addressing.

Number six, consult and engage openly. So you need to seek the advice of experts and listen to what they tell you, but, don’t let them have decision making accountability. I love a legal opinion as much as the next person, but I don’t always follow it. Lawyers are, by their nature, risk averse and conservative. That’s what we pay them for, but consider a whole range of things when you look at their advice. Consider historic implications. Always balance expert advice from one source with the myriad other factors from your full range of stakeholder groups and advisors.

Finally, number seven, set the decision making tempo. As with most decisions in a crisis, you need to choose speed over accuracy every day and twice on Sundays. Knowing how to make fast decisions that are also sound and rational is something that you shouldn’t wait for a crisis before learning how to do. Leading through crisis requires forethought and planning. Don’t wait until a crisis hits before you put your mind to this. More importantly, if you don’t have the foundational leadership capabilities that have been built in the good times, you won’t have them to rely upon when the crisis hits. You will need resilience. You will need to display grace under pressure. You will need the ability to communicate clearly and succinctly, and you’ll need to be able to create a culture of accountability and performance. From where we stand today with the unfolding global response to the pandemic, maybe some of you already feel it’s a little bit late, but when the next crisis hits, make sure you’ve done everything you can to prepare yourself and to be the type of leader who can move into crisis mode calmly, capably, and confidently.

Alright. So that brings us to the end of Episode 82, thanks so much for joining us. And remember at your CEO mentor, our purpose is to improve the of leaders globally. So please take a few moments to rate and review the podcast as this enables us to change the world of work. I’m going to look forward to next week’s episode – which I will do one day – “Being Right Isn’t Everything”. So until then, I know you’ll take every opportunity you can to be a No Bullsh!t Leader.