willistowerswatson.com
1
Not If, WhenCrisis Communications PlanningOctober 26, 2017
© 2017 Willis Towers Watson. All rights reserved.
willistowerswatson.com
2
Erica A. Swerdlow, Chief Executive OfficerWye CommunicationsErica Swerdlow is the Chief Executive Officer of Wye Communications, a Stagwell Company. She is responsible for leading a communications agency focused on expert integration and operations between client and agency. Erica’s experience includes managing corporate reputation, crisis preparedness, brand marketing and media relations.
2© 2017 Willis Towers Watson. All rights reserved. Proprietary and Confidential. For Willis Towers Watson and Willis Towers Watson client use only.
willistowerswatson.com
3
Why Crisis Communications Planning?
Company and personal reputation is at stake Get it right the first time Response is difficult without a plan Other parts of the business need to continue working effectively Leadership matters during a crisis May help contain an issue before it is a communications crisis Employees make mistakes because they don’t know what to do No comment is not an option
A crisis never happens at a convenient time
willistowerswatson.com
4
An Issue Can Become a Crisis Quickly
Proliferation of phones and social media Social media can go viral immediately More “news” outlets… Scoop before facts A culture of us and them
willistowerswatson.com
5
At Least 8 Dead At Florida Nursing Home After Irma
The home’s administrator, Jorge Carballo, said in a statement that the transformer connected to the air-conditioning system had experienced a “prolonged power failure,” prompting the staff to contact Florida Power & Light. While waiting for a fix, he said, they set up mobile cooling units and fans and tried to make sure residents were hydrated and comfortable.
We are devastated by these losses,” he said.
“We are fully cooperating with all authorities and regulators to assess
what went wrong. ”
“
willistowerswatson.com
6
Positive Outcome from Hurricane Harvey Nursing Home Photo Gone Viral
willistowerswatson.com
7
willistowerswatson.com
8
willistowerswatson.com
9
Crisis Scenarios
Employee related event Sexual abuse Natural disaster (hurricane, tornado, wildfire, flood, etc.) Elopement with injury or death Survey that results in a community closure or significant sanctions Cybersecurity or significant privacy breech Communicable disease outbreak resulting in large numbers of residents
and/or employee illness Notorious lawsuits Active shooting
willistowerswatson.com
10
Crisis Preparedness Assessment Vulnerabilities assessment Benchmark opinion research Review of plans and capabilities
against best practices Traditional/social media analysis Actionable recommendations
Strategically empowered entity Optimal structure for the
organization Immediate training if needed
Blueprint for action, including decision-making structure, action steps, toolkit Issues tracking and effective management Scenario-specific examples Traditional and digital formats
Crisis simulation(s) to test plan, team against real-world scenarios Crisis training for key staff from
“gatekeepers” to spokespersons
Adjust plan, structure and tools as needed
Regularly-scheduled review of planning materials Annual crisis simulations 1
2
3
4
5
6Continually Review & Update
Identify Vulnerabilities
Designate Crisis Team
Create Crisis Plan
Test the Structure
Fine-Tune the Plan
willistowerswatson.com
11
Audit
Vulnerabilities Assessment and Risk Maps Review: Current processes, including internal/external communication processes, organization
structure and relevant external support Parent company plan Past media visibility (positive/negative) Policies, processes and capabilities for managing digital/social media, e.g.:̵ Existing social media polices for corporate activity and employees̵ Existing social media platforms̵ Assessment of current ability to use digital media to manage crises
Determine new potential scenarios including those unique to your facility Identify and prioritize reputational threats facing the company/industry Provide: “Gap analysis” of existing crisis capabilities against best practices Specific recommendations for crisis plan, content tools, systems and procedures to
ensure your ability to respond effectively to media and all stakeholders in a crisis
willistowerswatson.com
12
Assessment tools to determine actions for severity and escalation points
Low High
Lim
ited
Bro
adSc
ope
Level of Stakeholder
Impact
LEVEL 1 – MINIMAL IMPACTIssue generates limited reactions from stakeholders. Often it will not significantly disrupt operations, create questions about Facility’s reputation or affect its relationship with stakeholders. Example: Patient wandered off and was unaccounted for for 4 hours, but was safely found and returned.
LEVEL 3 – MODERATE IMPACTHigh impact, but limited in scope. The number of customers affected is not incredibly large [thresholds to be determined] but the accusation could grow and be shared with local media, and social media coverage is possible.Example: One case of sexual abuse has come to the surface from a family.
LEVEL 2 – LOW IMPACTIssues typically covered by national media outlets. However, this event may have a low impact on Facility’s stakeholder groups. Events of this nature have the likelihood to escalate to a higher impact situation based on the response of external stakeholders.
Example: Senior living facility negative survey results brought to the attention of local broadcast station
LEVEL 4 – HIGH IMPACTHigh impact situations with the most significant effect on Facility’s reputation, valuation and operations. These crises are covered by media outlets and social media channels. The events deeply affect some or all of the bank’s stakeholders and they expect Facility to respond. Example: Two more people have died from Legionnaires’ disease at a retirement community, bringing total deaths to four and those sickened to 35. It is the largest Legionnaire’s outbreak in Franklin County in recent memory.
Assessment tools to determine severity and escalation points
Incident evaluation factors could include: Type of incident Scope of incident (number
affected, breadth of impact) Media and social coverage
and potential for reputation impact
Regulatory response and elected official involvement
Litigation
willistowerswatson.com
13
Impact Criteria Potential Communications Vehicles Key Considerations
Level One - Minimal Impact Less than [# TBD] customers’ data
affected, little system/website impact Potential economic impact to Facility
less than $X [TBD]. No personally identifiable information
affected Minimal or no media/social coverage
Media holding statement Internal communications as
needed Possible customer letter or
Is the incident “public” and/or does it have the likelihood to escalate?
Is a response needed for our stakeholders? Is there pressure from certain stakeholder groups for a
response? Are there misperceptions that could escalate the issue and
damage Facility’s reputation? Are notices to consumers and regulators legally required? In what time frame and with what criteria?
Level Two - Low Impact [RANGE TBD] customers’ data stolen
or affected, low system/website impact Economic impact to Facility between
$[RANGE TBD] Personally identifiable information
including addresses, phone numbers and dates of birth may be affected
Minimal media coverage (i.e., local or online)
Minimal social media coverage (i.e. lower circulation blogs, Twitter posts from handles with low follower engagement, fewer than [THRESHOLD TBD] posts on Facility’s Facebook page
Customer letter or email Media holding statement Customer call scripts Possible news release Reactive social media
messaging Employee communication Investor relations holding
statement Overall messages and
Q&A
Is the incident “public” and/or does it have the likelihood to escalate?
Is a response needed for our stakeholders? Is there pressure from certain stakeholder groups for a
response? Are there misperceptions that could escalate the issue and
damage Facility’s reputation? Do customer-facing employees need additional support to
handle inquiries? Are notices to consumers and regulators legally required? If law enforcement is involved, do they have a viewpoint on
whether or how to go public?
willistowerswatson.com
14
Create Crisis Communications Plan
Crisis management team and infrastructure Key company messages Crisis management policies, procedures and guidelines – including traditional and digital
media and communications with all stakeholder audiences Stakeholder inventory Useful templates
Scenario-specific action plans Hard-copy and digital versions of plans
willistowerswatson.com
15
Crisis Management Steering Committee (CMSC)
The CMSC anticipates, prepares for and helps manage the company's response during a crisis.
Members of the group include leaders from Human Resources, Compliance, Information Security, Law & Regulation, Administration & Real Estate, ATO and Enterprise Risk & Return.
Objectives of the Crisis Management Steering Committee: Maintain a single point of communication to senior leadership Direct and coordinate proactive measures to ensure a consistent ability to respond Keep up organizational awareness of crisis preparedness and actions through ongoing
communication and training programs Promote business and technology recovery preparedness Establish processes that integrate activities across the enterprise Protect and enhance reputation across stakeholders Share organizational learnings from incidents and response
willistowerswatson.com
16
Logistics
Identify logistics: dedicated conference line and war room Online and offline tools and applications to easily reference information, whether
networks are accessible or not Audience matrix with methods to reach each, including channel owners for the
communication vehicles. Such as… Who controls Facility’s social media properties? Who manages the employee intranet? Who sends all-employee email messages? How does the organization communicate with customers?
Template messaging and protocols for multiple crisis scenarios Develop full set of templates, including placeholders Develop “dark site” online that can be turned on, if needed Include questions to consider when developing specific incident response
willistowerswatson.com
17
To Whom
Think about your target audiences and the basic resources you’ll need. In the event of a disaster, ready.gov lists potential audiences you might want to reach:
Residents Survivors affected by the incident and their families Employees and their families News media Community – especially people living near the facility Company management, directors and investors Government elected officials, regulators and other authorities Vendors
willistowerswatson.com
18
Media Communications Sample Statement (Cybersecurity Breach Scenario)This holding statement is intended to be issued once a significant cybersecurity breach is detected, even if details of the situation are still largely unknown. It gives the basic facts about the breach and demonstrates that the Facility is actively dealing with the incident.
Protecting the privacy of our residents’ is the Facility’s top priority. We are aggressively investigating the scope and severity of a security breach that we believe has compromised resident information.
We are taking all possible steps to determine the impact of this incident and contain it. We will be in very close contact with our residents, their families and other interested parties as this unfolds to provide the timeliest information and deliver security solutions as fast as possible.
We regret any inconvenience or anxiety this situation may cause our residents.
willistowerswatson.com
19
Practice and Partner
Conduct Crisis Response Drill Put communications structure to the test Draft realistic scenario, roll play tabletop exercise with media inquiries, social
media issues Can be coordinated with legal firm, IT security firm or other third parties as part of
larger drill
Have Experienced Incident Response Team on Call Experienced crisis communicators available for counsel on topics ranging from
small issues to large crises Peace of mind knowing that Facility is a significant client at Wyecomm
19
willistowerswatson.com
20
During a Crisis, Ensure You…
Demonstrate true, unquestionable care and concern Be informative, address and answer, to the most extent possible, the
key concerns of your stakeholders Communicate consistently across all channels, stakeholder groups and
regions Communicate in plain English, not
using corporate or legal talk Comply with appropriate
jurisdictional laws and regulations