Organizations inevitably face crises, but few are well prepared to deal with them. The following elements summarize the findings of research and experience about what it takes to respond effectively in crisis situations. The accompanying table is a tool for evaluating the adequacy of your organization's crisis management plans.

Effective crisis management plans include the following ten elements:

1. A representative set of planning scenarios. It's essential to create a set of crisis scenarios that serve to guide planning. This need not be an exhaustive list of everything that could happen, but it should represent a broad range of potential emergency situations that the organization could plausibly face. Examples include: shooter on site, epidemic, bomb threat, major fire, major external terrorist attack, major economic dislocation, infrastructure failure (power grid outage coupled with extreme heat, loss of the Web or telephone lines, disruption in the water supply).

2. A flexible set of response modules. Leaders should be able to pull combinations of pre-set response "modules" off the shelf. Modularizing the elements of a crisis management plan provides the organization with flexibility to deal with unexpected scenarios or combinations of scenarios.
This is important because real crises rarely directly match planning scenarios. If response options aren't flexible and modularized, novel events or combinations of events can yield ineffective or "brittle" responses. Response modules might include: facility lockdown, police or fire response, evacuation, isolation (preventing people from entering facilities), medical containment (response to significant epidemic), grief management, as well as external communication to media and other external constituencies.

3. A plan that matches response modules to scenarios. This is the core plan that links each of the planning scenarios to the response modules that will be immediately activated. For example, a "shooter on site" event triggers an immediate facility lockdown plus a police response plus preset communication protocols to convene the crisis-response team and warn staff.
Leaders should be able to pull combinations of pre-set response "modules" off the shelf.
— Michael Watkins

4. A designated chain of command. One finding of research on crisis management is that decentralized organizations, which are so good at helping promote innovation in normal times, prove to be woefully inadequate in times of crisis. Crisis demands a rapid centralized response and this, in turn, requires a very clear line of command and the ability to shift into what the military term "war fighting mode" rapidly. Otherwise the organization responds incoherently. This means creating a centralized parallel organization, in which the leader has a designated deputy and they, too, have a backup who would take command if the others were unavailable or disabled. It also means having a core crisis management team of perhaps five or six people who function as the leader's staff in the parallel crisis-management organization.

5. Preset activation protocols. Preset signals for activating and coordinating the various response modules in the event of a crisis situation. There have to be clear triggers to move the organization from "normal" to "war-fighting" mode as well as to activate specific response modules. There also have to be "all clear" signals that shift the organization back to its normal operating mode.

6. A command post and backup. This should be a location that can be rapidly converted to be used by the crisis management team. Requirements include the ability to rapidly connect many lines of communication, to have access to external media (TV coverage), to provide access to crisis management plans, etc. In addition, there should be a backup command post located off-site in the event that evacuation is necessary. This could be located at a home or other location, so long as the necessary bandwidth for communication and other resources is put in place so that set-up can be swift.

7. Clear communication channels. Easily activated channels for reaching people on site and outside. For example, use of internal speakers and TV monitors to make announcements. A shooter on site, for example, triggers facility lockdown and police response but also rapid announcement that everyone should stay where they are, lock doors, hide, etc. To the extent possible there should be redundancy in these channels including backups that are not linked to the telephone system or the Web. Messages should be composed in advance. There also should be mechanisms for rapidly locating key staff (e.g. "check in" Web pages, phone-in lines).

8. Backup resources. Critical resource stocks to be tapped if necessary. Examples include backup power generation/gas supplies, modest reserves of food and water, and medical supplies. Agreements should also be negotiated with external agencies to provide specific resources in time of crisis, for example augmented private security.
The best plans are worthless if they exist only on paper. There needs to be regular, at least biannual, exercises.
— Michael Watkins

9. Regular simulation exercises. The best plans are worthless if they exist only on paper. There needs to be regular, at least biannual, exercises conducted by the crisis management team, and regular testing of channels, inventorying of resources, and the like. These tests should be done regularly, but not scheduled in order to test speed of response.

10. Disciplined post-crisis review. Each crisis provides an opportunity for organizational learning to occur and plans to be revised. But this learning only occurs if the mechanisms are in place to make it happen. A post-crisis review should be conducted by the crisis management team after each significant event. The guiding questions should be: What went well and what went poorly? What are the key lessons learned? What changes do we need to make to our organization, procedures, and support resources?

Assessing your crisis management plans
Use the following table to assess your organization's plans to respond to a crisis and to create a plan of action to address deficiencies.

Source: Michael Watkins link