Crises are the result of a management failure in the face of a potentially harmful event. They arise when control mechanisms do not work as intended, either because they are not fit for purpose, are overwhelmed, or due to error. Here are some examples of recent crises that show a variety of patterns but share these essential features.
Let's start with the Marriott Hotel data breach of 2018. This is now the most common type of incident companies have to deal with and can escalate very easily into a crisis situation if it leads to a loss of confidence in the organisation and its ability to protect critical information.
Here the incident arose out of the decision to acquire the Starwood hotel chain several years earlier. It was in the information management system belonging to the acquisition that the critical vulnerability lay, and where the breach first occurred, back in 2014. Risk controls failed to identify the problem until late in 2018. It was this failure over four years that generated the crisis situation, as it threatened a general loss of confidence in Marriott's ability to protect the privacy of its customers.
This kind of quick escalation from incident to crisis is not unusual in the case of data breaches, because often detection only takes place long after the event, indicating an earlier failure in defensive mechanisms. The incident, in other words, is not triggered by the loss of data, but by the detection of a system failure, and it is this failure that creates the crisis situation.
In other situations, a crisis may be initiated directly by management decision making, without any intermediate step. This was the case in the Volkswagen diesel emissions scandal, which is still unfolding at a continued financial and reputational cost to the car maker that is staggering.
In this case the critical decisions that lead to the scandal were taken at the very top of the organisation. One of the problems this creates is that often it is the same people in charge of the crisis response who caused it in the first place. This is one reason why crises are often so badly handled.
On the other hand, a crisis can emerge out of multiple failures as a situation spirals out of control. This was the case with the mercury spill near the gold mine of Yanacocha in Peru. This started out as a minor traffic accident but rapidly escalated as villagers collected the mercury and boiled it up in their kitchens in the hope of extracting gold from it. The result was mass poisoning, the blinding of several children, and a legal battle with a final settlement in the order of $500 million. Even worse, the company lost its social licence to develop a neighbouring site with estimated gold reserves of around $2 billion.
The important point is that it was the failure to recognise the potential harm arising out of what appeared to be a minor incident, and to contain the situation before it escalated, that formed the key component of this crisis. The mercury containers that fell off the truck could not be successfully retrieved, and this created a very dangerous set of circumstances calling for serious attention. This is the point of the exercise here, to assist senior managers in understanding how crises arise, in knowing what to look for inside their organisation, to be able to detect a threat in time to prevent its escalation into a crisis.
In some cases this is just not possible, the outcome is simply catastrophic, management are given no opportunity to respond once an incident has taken place. This happened to the air charter company whose aircraft crashed on take off in Yaroslavl. The flight was carrying Russia's championship winning ice hockey team, all of who died in the crash. The company was closed the next day by Presidential decree.
This is clearly the worst case scenario. However the company's directors had little to complain of, as the investigation into the crash uncovered a series of damning organisational failures in the way it operated. These included irregularities in medical examinations for aircrew, conversion training for pilots, and cockpit culture among others. The source of catastrophic risk, in other words, lay directly in the organisation's operations, and no amount of crisis management was going to help once these shortcomings were revealed in the tragic accident at Yaroslavl.
This article forms part of the Avoiding Catastrophe's training program in crisis management. If you would like to discuss the issues raised here, or our training, comment below or else contact editor@avoidingcatastrophe.com