Walking and chewing gum at the same time. My grandmother used to say that to my brothers and me while we were growing up. To be honest, I had no idea what she was trying to tell me, and in hindsight my incomprehension reinforced the point she was making, and it wasn’t until much later that I realized just what the idiom meant. As an aside, for those unfamiliar with the statement, being characterized as unable to walk and chew gum at the same time is not flattering, and nothing to be proud of. It is meant to describe one’s inability to take on more than one task, one project, one process, one idea or goal at the same time. It characterizes inflexibility as much as one’s ineptness.

The simple reality is that designing crisis management and risk mitigation strategies and shelving them is not enough to solve problems. It is like being unable to walk and chew gum at the same time. Please, do not misunderstand me. Creating effective risk management and crisis preparedness strategies have incredible value and are the first step (after a proper and dutiful risk assessment) to building operational resilience. They also provide executive leadership or senior management with peace of mind, in terms of mitigating operational disruption in times of crisis. I often liken risk mitigation strategies and contingency planning as akin to installing fire alarms or fire extinguishers, First Aid kits, Automated External Defibrillators (AEDs), and/or wearing bullet proof or life vests. They all possess unactualized value until deployed. Often times, risk mitigation and crisis preparedness plans are regarded as a “break glass in case of emergency” actions. So, the question becomes how do we go from crisis readiness and preparation to effective implementation?

Mark Twain, a great American satirist and writer said, “It usually takes me two or three days to prepare an impromptu speech.” The use of risk mitigation and management measures could be easily viewed similarly. Ideally, preparedness and readiness entail more than simple memorialization in corporate policies. Effectiveness is born from integration, that place where policy and practice meet.

Today, the global marketplace faces challenges of unrivaled proportion, and its solutions are often impaired by strategic and logistical missteps during the implementation phase. It is like walking and chewing gum at the same time… seems simple enough. During the implementation of any plan there are unexpected challenges and incidental complications that will arise. Without fail. Take for example the encouraging news related to the (COVID-19) vaccine trials and the impending regulatory approvals. Once evaluated as safe and effective by requisite authorities, the vaccine can be dispensed for public consumption. However, it is not that simple. The logistics surrounding planned strategies are just as important as the idea and the “road map” itself. These same logistical considerations contribute materially to the success or failure of great strategies. I would propose that each risk mitigation strategy and crisis management response must be viewed as incomplete without a sound logistical/tactical action plan. Consider the following to help ensure success:

1. Risk management strategies and crisis management action plans must be developed with a complete understanding of available resources necessary to facilitate each strategy. In other words, take the time to understand how you are going to implement a proper risk management or crisis readiness strategy while developing it and assign requisite support/resources to ensure better implementation. Do not create strategies in a vacuum. Use a “360-degree view” to develop implementable strategies, taking into account all potentially affected aspects of the business. Benjamin Franklin, a founding father of the United States, said “Failing to plan is planning to fail” and this is never more true than when we discuss implementing strategies.

2. Risk management structures must assign very specific roles and responsibilities to ensure proper oversight during implementation exercises. Similar to Chief Compliance Officers who oversee, review, report, and modify compliance controls, Risk Management Officers/Chief Risk Officers must take ownership of all risk and crisis response actions. Moreover, in a risk management or crisis response plan, each business unit chief or head has a role to play. Identifying roles and responsibilities during a crisis or problem is not the preferred method and will lead to a myriad of problems.

3. All risk management strategies must be reviewed periodically and updated as needed to foster a smooth transition. Do not create risk management and crisis response strategies to leave them sitting on the shelf gathering dust. This is one of the critical mistakes made by companies, agencies, and firms alike. Risk management strategy and crisis response protocols created… CHECK! It is a bear trap and do not do it. Risk management and crisis response strategies are living organisms that rely on the host to feed, prune, and foster them. Taking time, periodically (once a quarter or year or bi-annually) to review your plans will serve to protect your strategic plan and prevent inefficiency. “Break glass, in case of emergency” is not the way to play. Put your strategies in the “ready” position long before they are needed, and care for them periodically. No genie in the bottle here.

4. All changes made to risk management strategies must be effectively communicated to relevant employees to ensure effective implementation. Imagine there is a fire, but your co-worker didn’t tell you how to escape the building successfully, thus causing you, and others, to get lost and/or trapped in the fire. Communication is critical before, during, and after the crisis. There is a reason why baseball players, when a ball is “popped up” yell “I got it” “I got it” before making a play. It is to ensure that team members know what the situation is, how it’s going to be handled, and who is responsible to make the play. In most crisis situations, communication, is not just important, it is essential. During the implementation of risk management or crisis response strategies, poor or vague communication will most certainly compound planning flaws. The reality is most people don’t embrace change, and even more panic under crisis conditions, which further elevates the role of planning and effective communication.

So, let me reiterate and wrap up this way. For most people, times of crisis are uncomfortable, scary, and stress filled. However, for some, crisis, and the chaos born from it, are embraced, and overcome gracefully. Based on experience, people perform measurably better when trained and taught properly. Implementing risk mitigation and crisis response plans do not work well when done “on the fly.” Successful implementation, like Mark Twain said about impromptu speeches, works best when rehearsed and practiced.

Transitioning from plan to reality is a carefully orchestrated endeavor that requires tremendous “buy-in” from senior leadership. It also requires methodical and meticulous planning, the assigning of dedicated resources and talent to the strategy; diligent review and upkeep of proposed strategies; and corporate-wide communication to ensure everyone is working from the same play book. Finally, it is my belief (and experience) that wearing a bullet proof vest is hot, sweaty, and heavy but a damn fine solution to protecting your life when under fire. The trick is understanding when to put it on and take it off. That is why law enforcement and soldiers alike wear them despite the circumstances. It is better to sweat than bleed. Risk management and crisis response strategies do not work with a “break glass in case of emergency” mindset. The simple truth is that they are far more effective when they are at the ready position rather than on the shelf.

This is the second in a series of pieces on risk management and contingency planning.