Preparing for evil.

Abstract

How can you plan for every crisis that might occur, even for ones you can't imagine? The task seems so daunting and so limitless that many firms don't even start. In fact, as the authors' 20 years of research shows, three out of four Fortune 500 companies are prepared to handle only the types of calamities they've already suffered, and not even all of those. That's unfortunate because the research also shows that crisis-prepared companies fare better financially, have stronger reputations, and ultimately stay in business longer than their crisis prone counterparts. Crisis-prepared companies use a systematic approach to focus their efforts. In addition to planning for natural disasters, they divide man-made calamities into two sorts--accidental or "normal" ones, like the Exxon Valdez oil spill, and deliberate or "abnormal" ones, like product tampering. Then they take steps to broaden their thinking about such potential crises. They consider threats that would be common in other industries, for instance. And they seek input from outsiders such as investigative journalists and even reformed criminals. But if these companies think broadly about possible threats, they think narrowly about implementation. Each year, smart companies focus their resources and attention on a few facilities picked at random, just as airlines conduct detailed security checks on just a few passengers for each flight. That reduces the probability of an attack on the entire organization even as it allows the business to migrate steadily to a higher level of crisis readiness. Crisis-prepared companies know that disasters cannot be managed through cost-benefit analyses. It is precisely because the effects of a disaster cannot be predicted or controlled that smart companies focus their efforts on preventing crises rather than containing them after the fact.