2.2 Guidelines to develop a crisis and issue management strategy

Within the broader context of a strategic communications framework, it is critical to remember that sometimes things go wrong. All statistical organizations encounter challenging issues and sudden crises. The purpose of crisis and issue management is to mitigate the damage that adverse events may trigger by ensuring that statistical organizations are well prepared to respond to problems publicly, in a timely and appropriate manner. Sometimes the immediate task might simply be quieting a sudden uproar. Other times, it might be the more laborious work of re-establishing trust.

Though it may be hard to remember in the middle of a high-stress crisis or troublesome issue, adverse events also provide an opportunity for a statistical organization to reinforce its brand and demonstrate the organization’s commitment to integrity and transparency in concrete and visible terms. Challenging events can originate within the statistical organization, or externally.

Internal issues could include

statistical issues—estimation errors, methodological shortcomings
corporate issues—corruption, conflict of interest, incompetence, unwise public statement by an employee (especially on social media)
continuity issues—system failures (e.g., website down)
security issues—confidentiality breaches.

External issues could include

reputational attacks—allegations of bias, distortion and fake news
political interference (real or perceived)—premature disclosure of data by political actors, pressure to change or reschedule releases, and national or international political instability
continuity issues—severe weather events, cyber-attacks, and violence in or near the worksite
statistical issues—stakeholders challenging data (e.g., affected groups disagree with organization’s estimates).

Many of these events will require coordinated responses from multiple areas within the statistical organization. Staff in information technology, statistical methods, administration, security, etc. may have significant roles to play. In some circumstances, a business continuity team may be assigned overall responsibility. In all cases, however, corporate communications will be vital.

2.2.1 Crisis and issue management principles

At the heart of crisis and issue management lies the brand that the statistical organization has crafted (see section 1.1 Branding). Effective crisis and issue management builds on the institutional values the brand embodies (taking advantage of the organization’s reputation for integrity and accuracy) and works to reinforce or re-establish that brand by demonstrating the organization’s commitment to transparency and accountability, even under trying circumstances.

Consistent with general communications principles, during an adverse event, a statistical organization should

communicate facts as quickly as possible
provide updates as circumstances change
ensure the safety of its community and the continued operation of essential services to its stakeholders.

The statistical organization should convey what it knows in a timely fashion, using multiple forms of media. It should not speculate. Providing factual information is especially important in the first minutes and hours of a crisis. The goal is to be transparent, accountable and accessible to all stakeholders, while respecting legal and privacy obligations.

Back to top

2.2.2 Crisis or issue?

Not every adverse event is a crisis. Understanding the difference been a crisis and an issue is essential to the development of an appropriate and effective response.

Figure 6 Crisis/issue Matrix

The two primary considerations to assess whether an adverse event constitutes a crisis or an issue are the level of immediacy and the threat level. Some communications experts recommend decision matrices with many more considerations. Regardless of the specific methodology chosen, distinguishing issues from crises will always require a degree of sound professional judgment. Therefore, in the crisis/issue matrix above, some cells have a gradient shading to indicate that decisions are not always clear-cut. For example, an adverse event that takes place in real time with a medium threat to the organization might be considered a crisis in some circumstances, and an issue in others.

A crisis can be identified when an adverse event is currently taking place or will take place in the immediate future, and when the risk is severe or the level of attention paid by outside actors is high. A crisis is characterized by a threat to an organization’s long-term reputation. Crises have the potential to disable or interrupt an organization’s operations. Crises may include injury, illness or death, and typically garner high levels of attention in the traditional media, on social media and in the political establishment.

Examples of crises could include

leak of data before the announced release date (either accidental or deliberate)
delay in issuing high-attention indicators past the announced release date
significant error in data that have been cited by a public official and detected after release
employee misconduct (arrest or public blunder)
high-profile cyber attack
prominent figure attacks the integrity or accuracy of statistical organization.

If the crisis requires a response by the statistical organization, that response needs to be immediate. The organization’s top leadership will need to be aware of the situation and be involved in decision making. Finally, a full response to a crisis typically involves multiple bodies, including a variety of specialists within the statistical organization, and outside actors such as media, stakeholders and partners.

An issue, by contrast, can be identified when an adverse event can reasonably be anticipated in the future, or the threat level and attention level are moderate. When addressing an issue, the statistical organization’s staff often have adequate time to assess the situation, understand the problem, and consider multiple solutions before selecting and implementing an approach to reduce the negative impact. All or most critical operations can continue as normal. No injury, illness or death has occurred.

Examples of issues could include

embarrassing misprint in a published news release
delay in issuing a low-attention indicator past the announced release date
government closure due to a delay in passing a budget.

Depending on the nature of the issue, the organization’s top leadership may need to be aware of the situation and be involved in decision making. In other cases, issue management can be delegated to middle or even front-line management. Again, a full response to an issue may involve multiple specialists within the statistical organization as well as outside actors.

The purpose of issue management is to identify potential problems early, and to implement strategies that will resolve the issue in a manner that produces a positive (or at least neutral) outcome for the organization. Effective issue management greatly reduces the likelihood that a situation will evolve into a crisis. Conversely, an inadequate response to an issue increases the likelihood of a subsequent crisis. There are no guarantees; therefore, all issue management strategies must include careful monitoring of any ongoing situation to recognize when a tipping point into a crisis may occur.

In many ways, strategic issue management is structurally similar to crisis management in that it follows the same general sequence of steps. However, there may be more flexibility in developing a response to an issue since there is more time to weigh options, consult with stakeholders, and decide on appropriate and effective mitigation procedures.

The following section will first address crisis management in a communications context, and then will discuss how issue management differs

Back to top

Examples of crises could include

leak of data before the announced release date (either accidental or deliberate)
delay in issuing high-attention indicators past the announced release date
significant error in data that have been cited by a public official and detected after release
employee misconduct (arrest or public blunder)
high-profile cyber attack
prominent figure attacks the integrity or accuracy of statistical organization.

Examples of issues could include

embarrassing misprint in a published news release
delay in issuing a low-attention indicator past the announced release date
government closure due to a delay in passing a budget.

2.2.3 Crisis management

There is no universal process for managing crises. Different external environments and internal cultures will lead to different approaches. Figure 7 demonstrates a crisis management process that uses a strategic, planned and controlled approach. Individual statistical organizations might start here and modify steps as required, or they may read it for ideas but design their own procedures from scratch.

Figure 7 Crisis communications process example

Back to top

Phase 1—Advance planning

The purpose of advance planning is to assign responsibilities, define procedures, prepare draft responses (standby statements) to be used during a crisis, and obtain organization-level buy-in before any adverse event takes place.

Advance planning begins with establishing the organizational infrastructure necessary to respond rapidly with full organizational authority. The first, foundational step is to establish a crisis communications team composed of senior management, and to delegate broad institutional authority to the team. The crisis communications team is the central element in any crisis communications plan. The team determines and enacts the communications tactics best suited to the crisis situation, and must have the appropriate authority to act on behalf of the organization with little or no further consultation. An explicit assignment of responsibilities makes this possible.

Examples of crisis communications roles

The Executive Oversight Board strategically plans the crisis communications policy.
The Crisis Communications Team (CCT) determines and enacts the communications tactics best suited to the crisis situation. Additional members may be called upon when deemed necessary by the core CCT.

· The management in charge of the area that is involved in the crisis resolves the situation and keeps the CCT informed. The Senior Executive for the affected program joins the CCT for the duration of the crisis.

Examples of team membership

The team will consist of senior management officials. At a minimum, the core team will include

• Head of statistical organization

• Deputy Head of statistical organization

• Director of Public Affairs

• Senior Executive for Communications

• Senior Executive for Administration

• Additional members that may be called upon when deemed necessary by the core CCT.

The normal structural activities common to all teams must take place, such as collecting and distributing contact information, establishing ground rules (e.g., quorum and decision-making process) and determining expected team communication vehicles (e.g., teleconferences or in-person meetings). These activities have particular significance in the context of this team since they need to take into account the possibility that a crisis will not schedule itself conveniently during regular working hours when all team members are present at their desks.

In addition, the team should allocate specific roles to team members. These roles and responsibilities may change depending on circumstances, but approaching a crisis with default predetermined assignments simplifies and streamlines the response.

Finally, if any crisis communications team members would benefit from additional training on their roles and duties, then that training—including periodic refresher training for all team members—must be arranged.

Establishing the organizational infrastructure also includes developing and fostering a good early-warning system. This starts with implementing a solid environmental monitoring program, where both traditional media and social media are tracked continuously in as close to real time as is feasible.

Embedding threat identification within the organizational structure can fill gaps that media monitoring does not cover. This means instituting a corporate culture where staff at all levels are on alert for potential threats and adverse events, know how seriously the organization treats such threats, and are aware of both the importance and the procedures for reporting events up the organizational ladder to senior management. This is critical to recognizing internally triggered events before they become part of a public conversation. Although staff may be reluctant to acknowledge problems or to bring problems to the attention of their superiors, communicating and frequently reinforcing an institutional message of “no surprises” is key.

To strengthen the early-warning system for externally triggered events, it is also useful to develop relationships with outside stakeholder networks so that they are also encouraged to recognize adverse events and threats that might affect the statistical organization, and so they know whom to notify.

The second stage of crisis management advance planning involves thinking ahead to potential threats and preparing optimal reactions. This activity can be broken into seven steps.

Back to top

Step 1 Review lessons learned from prior experiences

All statistical organizations have experience responding to adverse events, whether a formal crisis management plan has been in effect or not. The starting point for future planning involves reviewing effective past responses, missteps that hampered previous responses, and how previous responses could have been improved.

Crisis management plans should also be reviewed and refreshed on a regular basis, and always in the aftermath of a completed crisis.

Step 2 Identify likely crises

Based on past experience and on an assessment of the current technological, social, and political climate, generate a list of potential adverse events that the statistical organization may face in the future. Try to include as many reasonable crisis situations as possible without being diverted into outlandish or low-probability events.

There is overlap here between crisis and issue management, on the one hand, and risk management on the other.[1] In particular, the risk management assessment process includes identification, analysis and measurement, and weighting (i.e., prioritizing risks). Risk identification can feed into communications planning by pinpointing some of the more likely issues and crises, though it cannot be expected to identify all the threats a crisis communications plan should address. Crisis and issue management, in turn, can feed into risk analysis and weighting by specifying measures that can be taken to mitigate problems when they arise.

Step 3 Define key audiences

Understanding the audiences and stakeholders that a statistical organization may need to reach when responding to an adverse event depends, in large part, on the nature of the event. There are many potential audiences that will want information during and following an incident, and each has its own information needs. The challenge is to identify the most significant set of stakeholders for a given situation, and to anticipate the type of information that can and should be provided to them.

For a statistical organization, potential audiences might include

data users
respondents
teachers and students
journalists (conventional and new media)
other government agencies
political appointees

Audiences are not just passive recipients of information; they may also be key allies in implementing constructive responses to adverse events. Just like external stakeholder networks can assist a statistical organization in threat identification, they can also be helpful defending a besieged organization, and can sometimes make statements that would be inappropriate for the organization to make itself. Expressions of support from external stakeholders may have a higher level of credibility within their networks than the same statements issued by the statistical organization.

Step 4 Plan scenarios

Once a list of potential crises and the key audiences associated with each one has been developed, it is time to plan effective communications responses. Planned responses need to include

What will be communicated?
When will it be communicated?
How will it be communicated?
Who will do the communicating?

Among other considerations, the preferred communication channels need to be specified. Should the organization’s response be in the form of a press conference, a news advisory, a website post, a tweet, or some combination of these?

Planning needs to be as realistic as possible, taking into account that the early stages of a crisis are typically filled with a great deal of uncertainty, and possibly with incorrect information within both the statistical organization and the public coverage.

There are situations where the best response by a statistical organization is not to issue any communications at all. However, when the organization determines that communication is in the best interest of the organization and its stakeholders, the communication needs to be rapid, honest and reliable. Often this translates to an initial statement (e.g., “We are assessing the situation and will report when we know more”), followed by further detail once the situation is better understood.

Planning also needs to account for the fact that, when other institutions become involved in an adverse event, the required coordination between organizations often delays effective responses and communications. This may be especially true when law enforcement or other branches of the judicial system are engaged.

Statistical organization employees can be different from external stakeholders in terms of their information needs and the channels available for reaching them. Therefore, it can be beneficial to include specific examples of internal stakeholder outreach in scenario planning.

In addition to developing scenarios for specific situations, it can be useful to develop a generic scenario that lays out a sequence of steps that can be referred to when completely unanticipated situations arise. This generic scenario will be fairly vague, but can serve as a helpful starting point to manage crises that take a statistical organization by surprise.

Scenario planning is best done as a group, including the members of the crisis communications team and others with insight into past successes and failures.

Step 5 Prepare standby statements (could be included in Step 4)

Some statistical organizations have procedures in place that require that public statements go through one or more levels of review and approval (often including a legal department) before they can be issued. The higher the visibility of a communication, the more stringent the review and approval process tends to be. This can impose substantial delays on communications, during which, in the event of a swiftly unfolding crisis, the opportunity to mitigate damage can be diminished or effectively eliminated.

Standby statements are draft communications templates that address a particular type of problem and include placeholders for specific detail.

Standby statements are written, reviewed and approved in advance. Therefore, when an organization is responding to a crisis under time pressure, details can be inserted and the statement can be issued quickly.

Standby statements provide an opportunity for the statistical organization to explicitly reference its brand by embedding key messages. This must be approached delicately so as not to generate offence or ridicule, but can be effective when done well.

[1] See https://statswiki.unece.org/display/GORM/Risk+Management for additional details.

Back to top

Example of a standby statement

At (X:00 PM/AM date), the Statistical Organization announced that data from the (date and name) news release that was scheduled for release on (time and date) were inadvertently released from the website. The release can be found here: (link).

Step 6 Conduct simulation exercises

A plan is only useful if it can be executed properly. Testing the crisis communications plan is critical for two reasons:

Testing uncovers shortcomings, gaps and inefficiencies in the plan.
Testing prepares participants to successfully perform the activities their role requires.

Generating an actual crisis for testing purposes is risky, so a simulation exercise is required. Tabletop exercises have proven useful in evaluating and practising crisis communications plans.

A tabletop exercise is an activity where the crisis communications team, led by a facilitator, gathers to walk through simulated emergency situations. Members of the crisis communications team review and discuss the actions they would take in response to a particular scenario, testing the crisis plan in an informal, low-stress environment. The tabletop exercise clarifies roles and responsibilities, can identify additional personnel who would need to be pulled in as the crisis evolves, and can identify additional mitigation and preparedness needs. Tabletop exercises also work as a reminder of small but important details, such as alternate assembly points and whose responsibility it is to contact political appointees if the organization head and deputy are both unreachable.

Tabletop exercises are never completely realistic, and therefore cannot provide a comprehensive test of operational capability. They are, however, low cost and relatively easy to conduct, and as such can be repeated on a regular basis.

Any deficiencies in the plan uncovered by the tabletop exercise should be corrected.

Step 7 Be prepared

Crises are inevitable. Statistical organizations must integrate that understanding into their organizational culture and prepare rigorously. This includes practising responses until they become ingrained. To be successful, advance planning needs to integrate lessons learned from previous crises, be comprehensive and detailed, and ensure buy-in from the highest level of the statistical organization.

Phase 2—Executing the plan

The purpose of the execution phase is to efficiently and effectively manage a live crisis. When an adverse event has been detected and reported, the communications manager must

quickly gather as much information available
alert senior management
launch the crisis communications team.

Typically, the first report of an adverse event does not include complete information. It can take hours, sometimes even days, for the full scope and impact of an event to be known. It may take even longer for the cause to be reliably identified.

The communications manager will need to make a rapid judgment call: based on preliminary, incomplete and possibly inconsistent information, is the situation sufficiently grave to launch the crisis communications team? Perhaps the greatest pitfall to avoid at this stage is being too thorough in investigating the situation, thereby losing valuable time. Once launched, the crisis communications team can follow a sequence of steps.

Step 1 Assess the situation

The preliminary information the team receives is probably incomplete and possibly inconsistent. Nevertheless, the crisis communications team needs to evaluate the information on hand and determine whether to treat the situation as a crisis. If not, the matter can be referred to other parties for issue management or program-level follow-up.

If the situation is a crisis, the team should continue.

Step 2 Consult the crisis communications plan

The crisis communications team will find the scenario in the crisis communications plan that either addresses the existing situation or is close enough to the existing situation that it can be used as a model, or they will use the generic scenario. The selected scenario will provide guidance on whether an active or reactive communications strategy is desirable, or if no communication at all is preferred.

Step 3 Confirm or tailor plan elements

Since few, if any, actual crises will conform exactly to the scenarios detailed in the crisis communications plan, the chosen response during initial planning needs to be reviewed. The crisis communications team must either affirm that the plan should be executed as originally envisioned, or modify elements of the plan to better suit the specific event.

The elements that must be confirmed or tailored include

key audiences
response strategy/sequence
standby statements
communication channels.

Step 4 Implement the strategy

At this point, the crisis communications team has a detailed roadmap of actions to take and should implement the chosen strategy with the agreed-upon modifications.

The key to a successful crisis management execution phase is an efficient and effective process with timely decision making.

Phase 3—Evaluation

The final stage, after the crisis has been weathered, is to follow up on any promises made during the event (such as providing more information or being available for an interview), and to evaluate the effectiveness of the completed communication process.

The review process should occur promptly to ensure that the lessons learned are fresh and comprehensive. The evaluation results should trigger a review of the crisis communications plan to improve future responses.

2.2.4 Issue management

Strategic issue management is similar to crisis management in basic structure, and follows the same general sequence of activities. Since the immediacy of an issue may be less than that of a crisis, there is often more flexibility to develop and implement a response, including time to collect additional information, weigh options, consult with experts and stakeholders, decide on appropriate and effective mitigating procedures, and refine the strategy as the situation unfolds.

Some issues can be highly time-sensitive. For these situations, it is recommended to follow the more thorough steps outlined in crisis management.

Back to top

Figure 8 Process for issue management/communications

Back to top

Phase 1—Preparation

Issue management shares the early-warning infrastructure with crisis management.

A statistical organization only needs one environmental monitoring program to track traditional media and social media. Any disquieting activity that might result in an adverse situation should be reported to the communications manager, who can pass the information on to either the crisis communications team or other officials at the organization or project level for issue management.

Issue management shares the embedded threat identification within the organizational structure and the relationships with external stakeholder networks. Therefore, all parties are encouraged to recognize adverse events and threats that might affect the statistical organization, and they know whom to notify.

Like crisis management, issue management benefits from advance planning. However, this planning does not need to be as rigorous or detailed as crisis preparation planning.

It is a good practice for management and senior staff working either at the project level or at the organizational level to meet periodically and discuss known risks and how they might turn into issues. Appropriate responses to potential issues should also be considered at this time, especially in the context of which organizational units might be involved in crafting effective mitigation strategies. Risks, potential issues and potential responses should be documented, at least informally.

Finally, just like in crisis management, organizational preparedness to face both predictable and unexpected issues is likely to lead to better outcomes.

Phase 2—As an issue unfolds

The initial threat assessment in issue management is similar to that in crisis management, and may involve many of the same people or groups. When an adverse event has been detected, reported to the communications manager and passed on to project or organizational management as a potential issue, that manager or group must evaluate the information and decide whether to treat the situation as an issue. If the event should be treated as an issue, a manager or management group should be assigned to follow up. Depending on the specifics of the situation, management could be mid-level or upper management.

The initial information the issue management group receives is probably incomplete and possibly inconsistent. Unlike with crisis management, the issue management group may have sufficient time to conduct further investigation before being forced to act. The better the issue management group understands the situation, the better they can react to it.

Also, the issue management group may have sufficient time to consult with colleagues within the statistical organization (especially those with special expertise or who have encountered similar situations in the past) and stakeholders outside the statistical organization.

From this point on, the process is conceptually almost identical to that of crisis management. The issue management group identifies key audiences, develops a strategy, drafts statements (in this case, final statements rather than standby statements), selects appropriate channels to distribute the message and implements their strategy. The biggest difference between issue management and crisis management is that there may be sufficient time to evaluate the success of the mitigation efforts while the issue is still active, and to fine-tune or revise the strategy based upon this ongoing assessment.

While mitigation efforts are being developed and communications strategies are being implemented, the issue management group must be mindful of the possibility than the issue could cross a boundary and become a crisis, in which case a crisis communications procedure would be required.

Phase 3—After the issue has been resolved

Similar to crisis management, the final stage after an issue is no longer active involves evaluating and documenting the effectiveness of the completed communications process.

This review should occur promptly to ensure that the lessons learned are fresh and comprehensive.

Back to top

Example of issue management

Offensive language in randomly selected barcodes

On Saturday, September 16, 2017, a journalist contacted the Australian Bureau of Statistics (ABS) to query a survey form barcode that included an offensive word. The codes used to generate the unique barcodes used an algorithm generating more than two quintillion combinations (2,000,000,000,000,000,000) of letters and numbers to generate highly secure barcodes. Within 40 minutes of the query, the ABS was able to identify that the code was authentic and issue a public statement acknowledging the issue, apologizing for not undertaking an offensive word check on the barcodes, and offering the opportunity for anyone affected to have their code/form replaced. Investigations were undertaken to confirm that this was a computer-generated code and that no human intervention had occurred.

The ABS ensured that all existing barcodes with offensive words were not issued. The story appeared in the media four days later (September 20).

There was only one reported issue of this type.

2.2.5 Communication and risk management

There is an important connection between crisis and issue management and risk management.[1] Effective communication is a critical component of both.

Information, communication and reporting comprise one of the five components of the 2017 Revised Enterprise Risk Management Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission.[2] Enterprise risk management requires a continual process of obtaining and sharing necessary information from both internal and external stakeholders, which flows up, down and across the organization.

Communication is an important tool for disseminating information and promoting awareness and understanding of risks and risk management decisions. To ensure that relevant information is collected, organized, synthesized and shared, statistical organizations should establish a communications approach that supports the enterprise risk management framework and facilitates the effective application of risk management.

Risk management is a broad process to prevent a risk from materializing and to reduce its consequences. A crisis communications plan is implemented when an event has already taken place and risk management has failed. Communications strategies and plans could be fundamental responses and controls to prevent a risk from occurring and to mitigate a risk’s impact and consequences.

Furthermore, a communications process itself can have risks that must be identified, assessed and managed. It could be useful to apply the risk management approach to communication planning to limit the inherent risks of the communication response, and to prevent communications from become an exacerbating factor that trigger further escalation of an issue or crisis

[1] See https://statswiki.unece.org/display/GORM/Risk+Management for additional details.

[2] See https://www.pwc.com/us/en/cfodirect/standard-setters/coso.html#coso-erm for additional details.

Back to top

Page tree

2.2 Guidelines to develop a crisis and issue management strategy