The fire cycle: “The action-cycle of a fire from birth to death follows a certain pattern. The fire itself may vary in proportion from insignificance to conflagration, but regardless of its proportions, origin, propagation or rate of progression, the cycle or pattern of controlling it includes these phases:
1. the period between discovery and the transmittal of the alarm or alerting of the fire forces;
2. the period between receipt of alarm by the fire service and arrival of firemen at the scene of the fire; and, finally,
3. the period between arrival on the fire ground and final extinguishment of the fire itself.
It is important to fire fighting to make sure that the right things happen during each phase and that each step takes as little time as possible. For the first phase, that means having fire detection equipment in place and working properly that produces a signal that will be noticed and conveyed to the fire forces. In the second phase, the fire fighters need to be organized to respond appropriately to the alarm. And the third phase includes the process of diagnosing the situation and taking the necessary steps to put out the fire.
That is a good process model for risk managers to contemplate. Ask yourself and your staff:
- This is about the attitude and preparedness of company staff to accept that there may be a problem. How long will it be before we know when an actual crisis hits the company? How do our alarms work? Are they all in functioning order? Or will those closest to the problems delay notifying you of a potential problem? Sometimes with fires and company crises, an alarm sounds and it is immediately turned off. The presumption is that everything is normal and the alarm must be malfunctioning. Or perhaps that the alarm is correct, but that it it calibrated to be too sensitive and there is not a significant problem. As risk manager, you should urge everyone to err on the side of reporting every possible situation. Better to have some extra responses than to have events, like fires, rage completely out of control before calling for help.
- This is about the preparedness of risk management staff to begin to respond to a crisis. One problem that many risk management programs face is that their main task seems to be measuring and reporting risk positions. If that is what people believe is their primary function, then the risk management function will not attract any action oriented people. If that is the case in your firm, then you as risk manager need to determine who are the best people to recruit as responders and build a rapport with them in advance of the next crisis so that when it happens, you can mobilize their help. If the risk staff is all people who excel at measuring, then you also need to define their roles in an emergency – and have them practice those roles. No matter what, you do not want to find out who will freeze in a crisis during the first major crisis of your tenure. And freezing (rather than panic) is by far the most common reaction. You need to find those few people whose reaction to a crisis is to go into a totally focuses active survival mode.
- This is about being able to properly diagnose a crisis and to execute the needed actions. Fire Fighters need to determine the source of the blaze, wind conditions, evacuation status and many other things to make their plan for fighting the fire. They usually need to form that plan quickly, mobilize and execute the plan effectively, making both the planned actions and the unplanned modifications happen as well as can be done. Risk managers need to perform similar steps. They need to understand the source of the problem, the conditions around the problem that are outside of the firm and the continuing involvement of company employees, customers and others. While risk managers usually do not have to form their plan in minutes as fire fighters must, they do have to do so quickly. Especially when there are reputational issues involved, swift and sure initial actions can make the world of difference. And execution is key. Getting this right means that the risk manager needs to know in advance of a crisis, what sorts of actions can be taken in a crisis and that the company staff has the ability to execute. There is no sense planning to take actions that require the physical prowess of Navy Seals if your staff are a bunch of ordinary office workers. And recognizing the limitations of the rest of the world is important also. If your crisis effects many others, they may not be able to provide the help from outside that you may have planned on. If the crisis is unique to you, you need to recognize that some will question getting involved in something that they do not understand but that may create large risks for their organizations.