Not If, When - Willis Towers Watson...and dates of birth may be affected Minimal media coverage (i.e., local or online) Minimal social media coverage (i.e. lower circulation blogs,

willistowerswatson.com

1

Not If, WhenCrisis Communications PlanningOctober 26, 2017

© 2017 Willis Towers Watson. All rights reserved.


2

Erica A. Swerdlow, Chief Executive OfficerWye CommunicationsErica Swerdlow is the Chief Executive Officer of Wye Communications, a Stagwell Company. She is responsible for leading a communications agency focused on expert integration and operations between client and agency. Erica’s experience includes managing corporate reputation, crisis preparedness, brand marketing and media relations.

2© 2017 Willis Towers Watson. All rights reserved. Proprietary and Confidential. For Willis Towers Watson and Willis Towers Watson client use only.


3

Why Crisis Communications Planning?

Company and personal reputation is at stake Get it right the first time Response is difficult without a plan Other parts of the business need to continue working effectively Leadership matters during a crisis May help contain an issue before it is a communications crisis Employees make mistakes because they don’t know what to do No comment is not an option

A crisis never happens at a convenient time


4

An Issue Can Become a Crisis Quickly

Proliferation of phones and social media Social media can go viral immediately More “news” outlets… Scoop before facts A culture of us and them


5

At Least 8 Dead At Florida Nursing Home After Irma

The home’s administrator, Jorge Carballo, said in a statement that the transformer connected to the air-conditioning system had experienced a “prolonged power failure,” prompting the staff to contact Florida Power & Light. While waiting for a fix, he said, they set up mobile cooling units and fans and tried to make sure residents were hydrated and comfortable.

We are devastated by these losses,” he said.

“We are fully cooperating with all authorities and regulators to assess

what went wrong. ”

“


6

Positive Outcome from Hurricane Harvey Nursing Home Photo Gone Viral


7


8


9

Crisis Scenarios

Employee related event Sexual abuse Natural disaster (hurricane, tornado, wildfire, flood, etc.) Elopement with injury or death Survey that results in a community closure or significant sanctions Cybersecurity or significant privacy breech Communicable disease outbreak resulting in large numbers of residents

and/or employee illness Notorious lawsuits Active shooting


10

Crisis Preparedness Assessment Vulnerabilities assessment Benchmark opinion research Review of plans and capabilities

against best practices Traditional/social media analysis Actionable recommendations

Strategically empowered entity Optimal structure for the

organization Immediate training if needed

Blueprint for action, including decision-making structure, action steps, toolkit Issues tracking and effective management Scenario-specific examples Traditional and digital formats

Crisis simulation(s) to test plan, team against real-world scenarios Crisis training for key staff from

“gatekeepers” to spokespersons

Adjust plan, structure and tools as needed

Regularly-scheduled review of planning materials Annual crisis simulations 1

2

3

4

5

6Continually Review & Update

Identify Vulnerabilities

Designate Crisis Team

Create Crisis Plan

Test the Structure

Fine-Tune the Plan


11

Audit

Vulnerabilities Assessment and Risk Maps Review: Current processes, including internal/external communication processes, organization

structure and relevant external support Parent company plan Past media visibility (positive/negative) Policies, processes and capabilities for managing digital/social media, e.g.:̵ Existing social media polices for corporate activity and employees̵ Existing social media platforms̵ Assessment of current ability to use digital media to manage crises

Determine new potential scenarios including those unique to your facility Identify and prioritize reputational threats facing the company/industry Provide: “Gap analysis” of existing crisis capabilities against best practices Specific recommendations for crisis plan, content tools, systems and procedures to

ensure your ability to respond effectively to media and all stakeholders in a crisis


12

Assessment tools to determine actions for severity and escalation points

Low High

Lim

ited

Bro

adSc

ope

Level of Stakeholder

Impact

LEVEL 1 – MINIMAL IMPACTIssue generates limited reactions from stakeholders. Often it will not significantly disrupt operations, create questions about Facility’s reputation or affect its relationship with stakeholders. Example: Patient wandered off and was unaccounted for for 4 hours, but was safely found and returned.

LEVEL 3 – MODERATE IMPACTHigh impact, but limited in scope. The number of customers affected is not incredibly large [thresholds to be determined] but the accusation could grow and be shared with local media, and social media coverage is possible.Example: One case of sexual abuse has come to the surface from a family.

LEVEL 2 – LOW IMPACTIssues typically covered by national media outlets. However, this event may have a low impact on Facility’s stakeholder groups. Events of this nature have the likelihood to escalate to a higher impact situation based on the response of external stakeholders.

Example: Senior living facility negative survey results brought to the attention of local broadcast station

LEVEL 4 – HIGH IMPACTHigh impact situations with the most significant effect on Facility’s reputation, valuation and operations. These crises are covered by media outlets and social media channels. The events deeply affect some or all of the bank’s stakeholders and they expect Facility to respond. Example: Two more people have died from Legionnaires’ disease at a retirement community, bringing total deaths to four and those sickened to 35. It is the largest Legionnaire’s outbreak in Franklin County in recent memory.

Assessment tools to determine severity and escalation points

Incident evaluation factors could include: Type of incident Scope of incident (number

affected, breadth of impact) Media and social coverage

and potential for reputation impact

Regulatory response and elected official involvement

Litigation


13

Impact Criteria Potential Communications Vehicles Key Considerations

Level One - Minimal Impact Less than [# TBD] customers’ data

affected, little system/website impact Potential economic impact to Facility

less than $X [TBD]. No personally identifiable information

affected Minimal or no media/social coverage

Media holding statement Internal communications as

needed Possible customer letter or

email

Is the incident “public” and/or does it have the likelihood to escalate?

Is a response needed for our stakeholders? Is there pressure from certain stakeholder groups for a

response? Are there misperceptions that could escalate the issue and

damage Facility’s reputation? Are notices to consumers and regulators legally required? In what time frame and with what criteria?

Level Two - Low Impact [RANGE TBD] customers’ data stolen

or affected, low system/website impact Economic impact to Facility between

$[RANGE TBD] Personally identifiable information

including addresses, phone numbers and dates of birth may be affected

Minimal media coverage (i.e., local or online)

Minimal social media coverage (i.e. lower circulation blogs, Twitter posts from handles with low follower engagement, fewer than [THRESHOLD TBD] posts on Facility’s Facebook page

Customer letter or email Media holding statement Customer call scripts Possible news release Reactive social media

messaging Employee communication Investor relations holding

statement Overall messages and

Q&A

Is the incident “public” and/or does it have the likelihood to escalate?

Is a response needed for our stakeholders? Is there pressure from certain stakeholder groups for a

response? Are there misperceptions that could escalate the issue and

damage Facility’s reputation? Do customer-facing employees need additional support to

handle inquiries? Are notices to consumers and regulators legally required? If law enforcement is involved, do they have a viewpoint on

whether or how to go public?


14

Create Crisis Communications Plan

Crisis management team and infrastructure Key company messages Crisis management policies, procedures and guidelines – including traditional and digital

media and communications with all stakeholder audiences Stakeholder inventory Useful templates

Scenario-specific action plans Hard-copy and digital versions of plans


15

Crisis Management Steering Committee (CMSC)

The CMSC anticipates, prepares for and helps manage the company's response during a crisis.

Members of the group include leaders from Human Resources, Compliance, Information Security, Law & Regulation, Administration & Real Estate, ATO and Enterprise Risk & Return.

Objectives of the Crisis Management Steering Committee: Maintain a single point of communication to senior leadership Direct and coordinate proactive measures to ensure a consistent ability to respond Keep up organizational awareness of crisis preparedness and actions through ongoing

communication and training programs Promote business and technology recovery preparedness Establish processes that integrate activities across the enterprise Protect and enhance reputation across stakeholders Share organizational learnings from incidents and response


16

Logistics

Identify logistics: dedicated conference line and war room Online and offline tools and applications to easily reference information, whether

networks are accessible or not Audience matrix with methods to reach each, including channel owners for the

communication vehicles. Such as… Who controls Facility’s social media properties? Who manages the employee intranet? Who sends all-employee email messages? How does the organization communicate with customers?

Template messaging and protocols for multiple crisis scenarios Develop full set of templates, including placeholders Develop “dark site” online that can be turned on, if needed Include questions to consider when developing specific incident response


17

To Whom

Think about your target audiences and the basic resources you’ll need. In the event of a disaster, ready.gov lists potential audiences you might want to reach:

Residents Survivors affected by the incident and their families Employees and their families News media Community – especially people living near the facility Company management, directors and investors Government elected officials, regulators and other authorities Vendors


18

Media Communications Sample Statement (Cybersecurity Breach Scenario)This holding statement is intended to be issued once a significant cybersecurity breach is detected, even if details of the situation are still largely unknown. It gives the basic facts about the breach and demonstrates that the Facility is actively dealing with the incident.

Protecting the privacy of our residents’ is the Facility’s top priority. We are aggressively investigating the scope and severity of a security breach that we believe has compromised resident information.

We are taking all possible steps to determine the impact of this incident and contain it. We will be in very close contact with our residents, their families and other interested parties as this unfolds to provide the timeliest information and deliver security solutions as fast as possible.

We regret any inconvenience or anxiety this situation may cause our residents.


19

Practice and Partner

Conduct Crisis Response Drill Put communications structure to the test Draft realistic scenario, roll play tabletop exercise with media inquiries, social

media issues Can be coordinated with legal firm, IT security firm or other third parties as part of

larger drill

Have Experienced Incident Response Team on Call Experienced crisis communicators available for counsel on topics ranging from

small issues to large crises Peace of mind knowing that Facility is a significant client at Wyecomm

19


20

During a Crisis, Ensure You…

Demonstrate true, unquestionable care and concern Be informative, address and answer, to the most extent possible, the

key concerns of your stakeholders Communicate consistently across all channels, stakeholder groups and

regions Communicate in plain English, not

using corporate or legal talk Comply with appropriate

jurisdictional laws and regulations


21


Thank You!

CONTACTErica Swerdlow

[email protected]

Documents

Not If, When - Willis Towers Watson...and dates of birth may be affected Minimal media coverage (i.e., local or online) Minimal social media coverage (i.e. lower circulation blogs,