Crisis and Risk Management

Most weeks bring disruptions. A supplier ships late, a system goes down for an hour, a key colleague resigns. Your team handles these with the tools it already has. Occasionally one of them is different. It threatens people, money, reputation or the organisation's ability to function, and the normal playbook stops working.

Leaders who handle crises well are rarely the ones with the best speeches. They noticed early and moved the issue to the right level before it grew. This chapter builds that habit. You will learn which consequences turn a disruption into a crisis, how to choose which scenarios to prepare for, and how to turn vague worry into clear escalation triggers.

Every organisation absorbs disruption, and the people closest to it usually handle it well. A crisis is different in kind, not just in size. Its consequences outrun the authority, resources and time the team normally has, so someone with wider authority has to take charge.

A simple test looks at consequences rather than at how alarming the event feels. Ask four questions.

One answer pointing the wrong way usually means a hard week, not a crisis. Two or more, especially harm combined with lost control, means the issue belongs with leadership now. Noise, anger and embarrassment are not consequences. A furious client email can feel like a crisis, while a quiet data anomaly turns out to be the real one.

In a 1976 study of three major disasters, the sociologist Barry Turner found that warning signs built up unnoticed during what he called an incubation period, until a precipitating event set them off [2]. That precipitating event is the crisis. It is often not the underlying cause.">trigger event, and it is rarely the cause. Look for the preconditions behind it: thin stock, a single supplier, an overloaded team, a known fault left unfixed.

Suppose Emma manages patient services at a private hospital in Chennai. Pharmacy tells her a delivery of a common antibiotic will arrive two days late. On its own, that is routine. Then she learns the same supplier holds the backup stock, and the partner hospital they borrow from uses that supplier too. Harm: patients could miss treatment. Reach: three wards depend on the drug. Control: the contract sits with central procurement. Time: every day of delay shrinks the options. Emma calls the medical director that afternoon instead of waiting for the weekly meeting. The delay never changed. Her reading of the consequences did.

Two mistakes are common. Judging by emotion, so loud problems rise and quiet ones do not. And waiting for certainty, by which time the cheapest options have gone.

No team can prepare for everything. A risk register can run to dozens of lines, each with an owner arguing it deserves attention. Scenario planning only works if you pick a small number of scenarios worth rehearsing properly. That choice is a leadership decision with real trade-offs. Time spent on one scenario is time not spent on another.

Governments face the same choice at scale. The UK National Risk Register 2023 covers 89 risks and assesses each one on likelihood and impact [3]. For every risk it describes a reasonable worst-case scenario. That is not the most likely outcome but the worst plausible version, once highly unlikely variations are set aside. Use the same discipline. Plan for a version of the event that is serious but credible.

A useful way to sort competing risks asks two questions. How bad would the consequences be? How uncertain are you about how the event would unfold? Each combination calls for different work.

Likelihood still matters, but handle it with care. Rare events with severe consequences are exactly the ones organisations underprepare for, because they look unlikely on paper.

Suppose Daniel is operations director at a mid-sized logistics firm in Rotterdam, and his register lists fourteen risks. Truck breakdowns and late customs paperwork are frequent but well understood, so they stay with depot managers. A warehouse fire is severe but predictable in shape, so he checks the evacuation procedure. Three risks are severe and hard to predict: ransomware on the routing system, a major customer's insolvency and a prolonged port strike. Those become his scenarios for the year. His finance colleague pushes for a currency scenario. Daniel keeps it on the watch list with a review in six months, so the trade-off is recorded, not ignored.

The usual errors are planning for last year's crisis, letting the most persuasive colleague set the agenda, and spreading effort so thin that nothing gets rehearsed. A short list you actually practise beats a long one you only document.

Most crises send messages before they arrive. The messages are faint, scattered across teams and easy to explain away. An crisis scenario may be starting, ideally visible before harm occurs.">early warning signal is something you can observe that suggests a scenario is starting. An escalation trigger is a pre-agreed point at which that signal obliges someone to act, with no debate about whether it is serious enough.

A worry such as "customers seem unhappy" cannot be watched. A signal can. Good signals are specific, measured by someone who will notice a change, and tied to a scenario you have already chosen. Mix leading signals, which move before harm occurs, with lagging ones, which confirm harm already done. Complaint volume is lagging. A rise in failed system checks is leading.

Write each trigger as a sentence: if this is observed, this person is told within this time, and they decide whether to activate the crisis team. The international standard ISO 22361:2022 frames crisis management as a capability that top management builds in advance, covering leadership, decision-making and communication [1]. Clear triggers let that capability switch on early rather than late.

Suppose Sophie heads customer operations at an electricity distributor in Lagos. Her chosen scenario is a prolonged failure at a main substation. She agrees three triggers with the network control lead. If supply stays off for more than an agreed number of customers for, say, fifteen minutes, the duty manager calls her. If two or more district offices report the same customer complaint in one morning, she hears by midday. If a fast-growing social media thread links the company to a fire or an injury, communications alert her at once. One Tuesday the first two are met within an hour. Sophie convenes the response group before the press calls, and customers get an accurate message instead of silence.

Watch for three mistakes. Triggers so vague that everyone can argue they were not met. Relying only on lagging data, which tells you about harm after it lands. Sending every signal to the most senior person, who then drowns and misses the one that matters. In daily work, good triggers save the most expensive resource in a crisis: the first hours.