Society members across industries responding to the latest Society/Deloitte Board Practices Quarterly: “Crisis management and the board” provided a snapshot of how companies are preparing for—and responding to—disruptive events. The results suggest that while crisis planning is now widely embedded across organizations, practices vary widely. The key takeaways below reflect primarily public company results; however, survey results are reported by company type (public/private) and size (public company market cap) in the Appendix of the report.
Commonly experienced crises—Brand or reputational incidents, data breach or cybersecurity incidents, and supply chain/geopolitical disruptions are among the most commonly experienced crises.
Existence of plan—Most respondents report having a formal crisis management plan in place, although the frequency of review and testing varies.
Planned vs. experienced crises—One notable theme is the gap between experience and preparation. Certain issues—particularly major litigation and regulatory investigations—are encountered by respondent companies fairly frequently but are less consistently incorporated into crisis plans.
Plan elements—The survey also highlights variation in the content of crisis plans. While core elements such as designated crisis teams and board communication and reporting protocols are common, more governance-focused practices—such as clearly delineating board and management responsibilities or conducting scenario planning/tabletop exercises—are less commonly included.
Board role—Board involvement follows a similar pattern. Many companies define when the board should be engaged in a crisis, but fewer report active board participation in preparedness activities such as tabletop exercises. That said, some respondents—particularly mid-cap companies—indicate that greater board involvement is under consideration.
Access additional resources on our Crisis Management page.
This post first appeared in the weekly Society Alert!