Following a framework for crisis response planning that engages management as well as the board can create significant political capital for internal audit, not to mention better prepare the company for crises that may arise.
Multipurpose framework. The head of internal audit at a major government contractor said in a recent NeuGroup meeting that his company uses the  National Fire Protection Association 1600 Standard on Continuity, Emergency and Crisis Management . He described it as a âfairly transferableâ framework that can be used across a variety of scenarios, from fire drills to much more complex and resource-intensive corporate initiatives. Most members participating in the meeting were unfamiliar with the NFPA document and listened raptly as the IA chief describe the benefits.
The member noted that the companyâs risk committee chairman had required adopting the framework and given the nature of the companyâs business, most of its provisions were already in place. What not to do. The member said a fascinating outcome of crisis response planning is understanding better what executives are not supposed to do or say, âparticularly for the C-suite, where itâs not uncommon to have lots of type A personalities.â The exercise clarifies what each executiveâs role is and emphasizes letting the crisis manager inform them about developments so they can better determine their next steps.
By promoting understanding of the various scenarios and analyzing what to report versus what to disclose, the requirements and the cadence of reporting, âWe really challenged management to think about that, and it was very helpful,â he said.
Muscle memory. âEvery time we went through the exercise, whether [for a major initiative], or for cyber, or an inside threat, weâd learn something new, or ask questions we hadnât thought to ask before,â the member said. The future will always bring situations that canât be anticipated, and he recounted a few humorous ones. âThereâs always something you donât think about, but the more you do it, it builds muscle memory,â he said.
Political capital. The member noted that facilitating these conversations in his capacity as IA was highly rewarding. âIt engaged management at different levels and created political capital that has paid dividends in so many different areas for IA,â he said.
