Crisis management and emergency response guidance

Hello friends,

I already have a comprehensive standalone Product Recall procedure and I’ve also put together a comprehensive site security procedure. I’m happy with these.

Where I’m struggling a little is on crisis management / emergency response procedures – firstly are they one and the same thing?

Also looking for some guidance on what should be included in crisis management / emergency response procedures – an index or list of contents would help.

By the way I posted this topic in food defence, but is that correct?

Thanks,
Simon

Hi Simon,

I'd say IMO emergency response procedures would be a part of your crisis management policy/procedures. Emergency response would define what needs to be done in a prescribed order and who would need to be contacted for various crisis issues such as a fire in the plant, a natural disaster plan, breach of security (ex. unauthorized person(s) in the facility), suspected product tampering, ect. You'd need to have contact info for medical assistance, law enforcement agencies, regulatory agencies (FDA, USDA, etc), legal representative(s), etc.

A well documented mock crisis excersise with a designated crisis management team would be wise. A public spokesman for dealing with the media is a good idea, as well as who would be responsible to contact the proper regulatory authorities in case a recall or product withdrawal is necessary. I hope my response isn't overly obvious.

Cheers,
esquef

Hi Simon,
What worked for us was that Management and the food safety team brainstormed to list possible emergency situations like storms, bioterrorism, sabotage, labor strikes etc. , contact numbers and possible action to limited the effect on food safety. Your recall procedure and site security can then be linked to the emergency procedure as this has direct impact on the emergency response.

Hope this is helpful.
Leonie

Hi Simon,

There are (predictably) a wide variety of opinions on the appropriate construction of a (food) Crisis Management (CM) “Module”. Many interpret the function within the context of a “Business Continuity” Protocol. Many also concentrate on the linkage to a Product Recall activity. Similarly there are a number of definitions of a “Crisis”.

The texts below illustrate the permutations. Most are fairly quick to scan through.

h01 - 10301393.pdf   56.22KB   922 downloads
(Canadian viewpoint)

h02 - GMA_SupplyChain2.pdf   347.94KB   799 downloads
(One of their impressive FS series)

h03 - Crisis Management-1.pdf   229.07KB   1492 downloads
(overview of CM)

h04 - Food safety crisis management and consumer communication.pdf   4.74MB   1270 downloads
(wide scope, pictorial intensive)

h05 - 2000-Guidance-General-1.pdf   1.33MB   866 downloads
(SQF2000 guidance material, see 4.1.6)

h06 - CRFA.pdf   256.91KB   995 downloads
(several ready-to-implement generic procedures/forms included, inc. mock recall)

Many related threads exist on the forum, some useful-looking ones I noticed are given below in chronological order although the last one contains some of the most thought-provoking content IMO –

http://www.ifsqn.com...dpost__p__34837
(2010) (2 valuable attachments)

http://www.ifsqn.com...dpost__p__24308
(no links / attachments)

http://www.ifsqn.com...dpost__p__19917
(1 attachment)

http://www.ifsqn.com...ndpost__p__8694
(1 link but it’s down)(#5 seems perceptive)

http://www.ifsqn.com...ndpost__p__5172
(old but excellent discussion of concepts IMO)

Charles

The following is a brief listing of possible contents:

· Introduction (Policy Statement , Using this document , Plan Management System, Document Distribution, Access to Documents, Key Assumptions)

· Incident Management Plan (Local Incident Management Plan Scope and Objectives, Plan Overview , Plan Invocation Procedure, Incident Management Phase, Rendezvous Points,

Incident Management Team, Command Centre, Incident Management Team Leader)

· Local Business Continuity Plan (Crisis Management Phase: Responsibility of Crisis Management Team)

· Business Continuity Plan (Crisis Management Phase: Responsibility Crisis Management Team, Crisis Management Team, Command Centre)

· Business Continuity Plan

· Product recall

· Appendices -including Contact Database (Crisis Management Team – Contact Details, Incident Management Teams - Contact Details, External Contact List).



Cannot really go into detail due to confidentiality agreements, but hope this can give a guideline of possible formatting.

Regards

Hey you guys are wonderful this is quite a useful place. Thanks for all the great advice and a special mention to Charles, thanks for pulling all of that together. WOW!

Anyway I think I understand it now.

The Crisis Management System is the umbrella and underneath you have your:

- Site security procedures
- Emergency response plan
- Product recall and withdrawal procedure
- Business continuity plan

All of this should be:

- Planned
- Use a multi-disciplinary team approach
- Regularly tested
- Trained out
- Reviewed
- Improved

That’s where I’ve got to.

Thanks,
Simon

Hi Simon,

I had a long conversation with our BRC auditor over coffee after the closing meeting of our last audit, about crisis management. Specifically, the practicalities of the plan. Our conversation came about as I mentioned that while testing our recall/withdrawal response I telephoned her certification body to confirm our contact for reporting a recall and was passed around several departments, so despite it being a requirement of BRC to inform them of a recall they didn't really know what to do when I tried to. Anyhow, she mentioned that if she were feeling picky she may seek to confirm that any contingency contacts were 'live' and able to offer the service required. The next day I dug around in our various contingency plans and found a couple of companies who we said we would use for services who either didn't exist any more or couldn't actually do what we needed. In the real world, no problem, just call someone else. But might have caused a problem with a picky auditor. I also remember being audited once by the TM from a multinational customer and having it pointed out that our emergency contact for them had not worked at the company for several years. Whoops.

So, ramble over, but my point is to keep an eye on the detail especially as the plan will probably go unused (fingers crossed) for year after year

Excellent point, Cranberry. Particularly hard to keep contact names and numbers of those in larger retailers as they seem to burn out and leave every six months or so.

We broke our Crisis Management plan up into 4 scenarios. A Type A scenario considered the corrective or alterative actions we could take if manufacturing was disrupted for 2 days (for example a machinery breakdown, loss of utilities etc). Type B covers 2-5 days (flooding, minor structural damage etc.) Type C covers one week (severe structural) and Type D covers all events longer (demolition of site, zombie attacks). When I worked previously with frozen vegetables we held a good deal of bulk product off-site, so we could increase the timeframes considerably.

I consider this part of my quality manual to be the jewel in the crown of our food safety systems, and have never had a non-conformance raised over it in any company I have worked for. I even used it to avoid having to write up an anti-H1N1 procedure for a major customer (told them it was already covered as a potential Type C and they accepted it). BUT................. it's actually fairly useless to be honest. I think any customer who honestly believes that we could simply move production to a rival's processing area after an unfortunate Emmerdale Farm-esque plane crash and produce an identical product that would conform to the product specification would be naive in the extreme, and possibly it is the opaque nature of this clause that leads so many auditors to brush over it and view it to a certain extent as a box-ticking exercise. "I'll be honest with you, Mr. Tesco, if this placed burned down tomorrow the next time you'd see our product would realistically be 6-8 months" would be the more truthful response unless you were working with a multi-site company. This would be right up there with having a clause in your Organisational Structure that neither you nor your nominated deputy would ever eat the same meal in a resteraurant for fear of multiple food poinsoning.

To be honest, the most important part of crisis management in my opinion is practice. When something happens, you want your management team to be used to thinking laterally and coming up with alternatives in a progressive brainstorming fashion rather than smoking heavily whilst looking pale. I've also found it to be a good teamworking exercise and a good chance to see how the team cope when pushed with unlikely events. It has also proven to be a good audit of the aspects of our quality management systems Simon mentioned above, such as site security.

And for the record, zombie attacks - we load all raw ingredients into trucks, secure the site as best we can (though we accept looters may pose a significant problem), move all staff to the local greyhound stadium (good security, has its own water supply and a large enclosed grassy area where we could grow vegetables to survive) and sit it out. 28 days later when it's all over, return to plant, carry out complete clean down (not sure how the EPA would react to us burning dead zombies, but we would have to consider it if our waste service supplier was not as well prepared as we were) and use the diesel from our trucks to power the generator and get the line moving. All in all, I have invested approximately half a million euro of my Company's money into this particular contingency plan. I would advise all responsible Quality Managers to do likewise. Unfortunately this has left us with insufficient funds for things like spare belts, resulting in a sharp increase in Type A scenarios, but I think you have to look at things from the worst case scenario to get the broader picture.

Simon,

I have used the District of Columbia Department of Health Emergency Guidancefor Retail Food Establishments June 2008 as a template for my crisismanagement/business continuity plans. It is very detailed and covers all mostall potential emergency situations. It also met requirements for SQF 2000 level2 crisis management/business continuity audit requirement. It is accessible through web searchengines.

Dear Simon,

It’s an interesting topic . A few more comments on yr OP regarding difference between crisis management (CM), emergency response (ER), business continuity plan (BCP).

FWIW, SQF seems (it’s not 100% clear) to place the BCP at the top of the tree with “Crisis Management” elements below and Emergency Response not present as a specific component.

I saw these "definitions" in the general sphere –

Crisis vs Emergency

(1) There is a difference between an emergency and a crisis. An “emergency” is defined as a sudden, unexpected event requiring immediate action to protect people, the environment or property. Examples include fires, natural disasters, or chemical spills. Emergencies are handled by “first responders” such as fire departments and Freescale Emergency Response Teams.

A “crisis” is much broader event, with a larger impact. It may be sudden and unexpected, or it may develop over a period of time. A crisis is defined as an event which, if not handled in an appropriate manner, may have a major negative impact on the company’s profitability or reputation. Examples include major emergencies, human resource issues, ethical issues, product safety issues, civil unrest or third-party attacks. Crisis events typically require actions by multiple departments, communications to employees and other stakeholders, and a response to both the short-term and long-term impacts of an event

(2) Understanding the difference between emergency and crisis is a critical factor in managing both. Defining the exact difference in a generic sense is not easy because a crisis for a small organization may be appropriately handled as an emergency for a larger one. Each organization should have its own criteria for defining when an emergency might become a crisis, and the transition from emergency response to crisis incident management is one of the more hazardous elements in management.

In the above type of scenarios, BC is typically not on top and may even be regarded as within the Crisis Management Plan, eg see this (other) forum conversation -

(3) Looking for differences between crisis & emergency
What are the differences between a crisis management plan and an emergency response plan? It seems that both can be used interchangeably. Please advise. Thank you.
Jack

Looking for differences between crisis & emergency
An Emergency Response plan is designed to address response orientated issues such as: life, health, safety, evacuation, floor warden, emergency notification, etc. Consider it an OSHA type of plan required for any organization having 11 or more individuals.

A Crisis Management Plan is more comprehensive in nature in that it is a singular plan that addresses: response, recovery, and resumption of business. It could be considered more akin to a Business Continuity Plan or a Continuity of Operations Plan.
Norm Koehler

Looking for differences between crisis & emergency
To Norm's fine definition, I would add that crisis management is often typically an executive level activity, particularly in cases where the reputation of the enterprise, as perceived by its marketplace and stockholders, may be at issue. At this level, the people directly accountable for the enterprise can gather, weigh the issues at hand, and make the necessary, and often tough strategic and tactical decisions. Crisis is not a time for buck-passing.
grewjac

Looking for differences between crisis & emergency
It doesn't really matter what each of US thinks the difference is, it matters what your organization thinks. Try though we might, we don't have a standard on this stuff so every company, agency, etc. has defined them differently.

Tess

Looking for differences between crisis & emergency
> Tess:

Your reply brings up an aspect I hadn't considered: the variability in roles we play as practitioners. I am a contingency planning consultant, currently on contract to a large client. They have me here because they perceive their need for my knowledge is temporary, and that's how they funded it. In this role, I can assert my position as "resident expert" and establish what the definitions are, to the extent they haven't been defined by my client already.

For an in-house practitioner, the freedom to define the terminology is dependent upon the employer's willingness to let him/her be the "resident expert." (BTW, this is where having a certification, though not selling your wares, has merit.)

All that said, in either circumstance, I will always attempt to persuade the adoption of DRII/DRJ definitions, the premise being that deriving benefit from "best practices" and lessons learned is made easier if a "common language" is used. When you read many articles in business continuity, the misuse of terminology is, at once, confusing and irritating, and makes the task of applying the practices being expounded upon more difficult.
grewjac

Looking for differences between crisis & emergency
Unfortunately, in my experience at least, that's exactly what happens. The company has the wording of the last "expert", and that may or may not match with what is currently in vogue. That last expert might be 3 consultants back, might be the guy who is now the manager of something else, etc. so the ability to shift the name may just not be a battle that can be won. On the other hand, in a lot of companies they may not care one bit what you call it since managment isn't engaged anyway.

Ah, the joys of our jobs eh?
Tess

Sources
(1) h07 - Freescale Crisis Management Plan.pdf   154.81KB   709 downloads
(2) h08 - Crisis Management - Relational model PRR.pdf   114.43KB   661 downloads
(3) http://www.drj.com/f...c.php?f=7&t=173

I guess the reality is that there are so many hierarchies / permutations in use, it’s really just a personal choice.

PS - BTW, as you may well know, there is a British Standard for Business Continuity Plan (BS 25999) and also a new (2011) PAS 200 document for Crisis Management. Plus one book on Crisis Management specifically oriented to Food (Colin Doeg).

PPS an example of the (SQF 2000) contents list for a BCP which included the CM function within it is here - http://www.ifsqn.com...dpost__p__43237

Charles

@Sheah Quay. Great advice liberally sprinkled with hilarity.

Thanks a lot Charles for all of the super references, I have drafted something for now that will navigate an outright nonconformity, but there sure is lot's of great information I can use to refine the procedures over time.

Thanks again,
Simon

Hi Simon

We got caught on this at our last BRC Rev 6 audit. While we had all the above we didn't have names, addresses and contact details of the companies that all of our various products, intermediates etc would be diverted to in the event of a localised emergency.

HTH Dairy

Excellent point, Cranberry. Particularly hard to keep contact names and numbers of those in larger retailers as they seem to burn out and leave every six months or so.

I think any customer who honestly believes that we could simply move production to a rival's processing area after an unfortunate Emmerdale Farm-esque plane crash and produce an identical product that would conform to the product specification would be naive in the extreme, and possibly it is the opaque nature of this clause that leads so many auditors to brush over it and view it to a certain extent as a box-ticking exercise.

I always makes me laugh when I write, or see written, that we would use a competitors site to make product to ensure continuity. Especially in some of the industries I have found myself in. I included it in the plan for the last company I worked in knowing full well that the 2 MDs hated each other (as one used to work for the other before being fired and setting up his own company producing the same product). I remember him saying to me that he would never set foot in the company again, let a lone send our recipes and materials over there. When I told him they probably had something similar in their plan he went a funny shade of purple and muttered something about [rival MD] can shove it up.......

Largely box ticking in my opinion in terms of the themes- If the electric goes out of course you get a jenny in to power the fridges- but as Shea Quay notes, if the factory was struck by a soap opera style calamity the retailers would be looking elsewhere for their product pretty sharpish as we'd be unable to provide it.