Last reviewed 15 February 2021

Mike Sopp looks at some of the changes organisations could make to improve resilience and crisis management.

Although the UK and the rest of the world is still very much in the midst of the Covid-19 pandemic, the introduction of vaccination programmes worldwide means there is the potential for some normality to return during 2021.

As organisations begin to recover from the pandemic and implement recovery plans, it is important that we take stock of how we managed the pandemic situation.

Research indicates many organisations would respond differently to any future pandemic, even where they had existing pandemic plans in place. As such, it is clear that we all need to learn lessons and adapt. This will ensure organisational resilience and good crisis management.

Crisis or incident?

Although many organisations have emergency and/or business continuity plans to manage foreseeable incidents, the Covid-19 pandemic, through its unprecedented scale and speed of spread, created a very real crisis for many organisations.

BS 11200:2014 Crisis Management. Guidance and Good Practice defines a crisis as an “abnormal and unstable situation that threatens the organisation’s strategic objectives, reputation or viability”.

Factors that differentiate a crisis from an incident include the fact that a crisis can:

  • create challenges that cannot be managed by prescriptive, pre-planned responses and procedures

  • emerge from incidents that have not been contained or escalate with immediate strategic consequences

  • affect an entire organisation and transcend boundaries (geographic and sectorial)

  • cause significant scrutiny from the media and stakeholders and impact on organisational reputation

  • create a high-sense of urgency

  • require long-term response periods.

Research undertaken by the Business Continuity Institute (BCI) found that the rapidity and scale of the pandemic “took many organisations by surprise” and that even those organisations with pandemic plans “did not really adjust to the broad impact and global nature of the coronavirus disruption”.

Only 1 in 14 respondents to a survey conducted by the BCI felt that their organisation was very well prepared to manage the pandemic, with 1 in 10 “believing it was badly prepared or worse”.

Based upon the above, it can be stated with some confidence that the Covid-19 pandemic falls within the definition of a crisis, based upon the impacts it is having/had on society, organisations and individuals. It is likely to be the most significant disruptive event many organisations have faced.

How to learn lessons

It is clear that lessons can be learnt from how organisations responded to the pandemic, particularly in respect of crisis management. The driver for this is to enable an organisation to respond in a different and/or better way and to improve its organisational resilience.

The need to learn lessons from a crisis is highlighted in BS 11200. It states that “learning from a crisis should result in change for the organisation, its people, plans and procedures that make it more resilient and better prepared for the future”.

Conversely, “not reflecting and acting on lessons not only allows latent problems and vulnerabilities to remain in an organisation, it also predisposes the organisation to future crises if it emerges that no action, or insufficient action, was taken in response to such problems in the past”.

According to BS 11200, learning lessons involves “capturing organisational learning” through thorough debriefs and extensive follow-up communication with all interested stakeholders.

Clearly, the subject matter for learning lessons is an important aspect. A good starting point would be to reflect on the elements that together create a robust crisis management framework.

In summary this would be as follows.

  • Anticipate: did we identify and/or have access to the warning signs of the pandemic and did we act upon them?

  • Assess: was there an understanding of the potential impacts of the pandemic on the organisation?

  • Prepare: did the organisation have the capability to manage the pandemic? Had we undertaken training and exercises?

  • Respond: was there effect and timely decision-making and communication to manage the pandemic?

  • Recovery: did we have a strategic approach at an early stage to recovery from the pandemic?

Within the above broad categories it is possible to develop a question set that is organisational specific. For example, in respect of being prepared, matters to review and learn lessons from could include:

  • if the organisation had a crisis management plan that linked to pandemic management plans

  • whether the crisis management team structure, composition, authorities, competency and resources were adequate

  • if the crisis management team was “situationally aware” and had access to relevant information to make decisions

  • whether the crisis management team was able to apply the appropriate leadership skills during the crisis

  • what training and exercising to stress test the response had been undertaken.

Responding to a crisis can be challenging but, as part of the learning lessons project, the decisions taken and the basis upon which they were made must be reviewed along with how the organisation communicated with stakeholders during a crisis.

Clearly decision-making would be driven by the national restrictions placed upon organisations but decisions would still have had to be made.

For example, operational decision-making issues may have involved in particular health and safety matters such as determining which work activities were essential, the application of the Covid-19 secure guidelines, risk assessing, working from home issues, proactively managing employee welfare, etc.

The above may cause concern among stakeholders but any review process must be undertaken with an open approach. Everybody should be clear that you are not setting out to lay blame on any individual for taking the wrong actions.

Organisational resilience

The key outcome from this exercise should be a clear understanding of where improvements can be made in how your organisation responds to crisis situations.

The organisation should be developing a suitable action plan that identifies:

  • what actions are required

  • who will be responsible for their implementation

  • a timescale for completion

  • the evidence required as confirmation of implementation.

As previously noted, the purpose of learning lessons is to make an organisation more resilient and respond more effectively and in an agile way to any future crisis situations.

According to the BCI report, Coronavirus: A Pandemic Response, “in the new normal the board is going to want to get much more involved and CEOs are going to be asking a lot more questions about business continuity and organisational resilience”.

Certainly, the response to the pandemic is likely to have involved various “protective disciplines” such as health and safety, business continuity and security as well as those working in human resources and facilities management.

Therefore, when considering how to manage future crisis, an organisational resilience approach to crisis management can set the agenda. Certainly, the key characteristics of a resilient organisation reflect those of good crisis management. BS 65000:2014 Guidance on Organisational Resilience notes the following shared characteristics:

  • using horizon scanning of trends to anticipate problems along with potential consequences of challenges and changes, both good and bad

  • preparation through planning and providing appropriate resources to respond to disruptions

  • protecting people, physical assets, financial value, reputation and social capital through traditional protective disciplines

  • intercepting and containing adverse events, mitigate their impact and sustain the transition to recovery and beyond

  • adapt by embracing and responding to change in a resourceful manner.


The Covid-19 pandemic has been unprecedented in terms of the significant impacts it has had on organisations.

Evidence from the BCI suggests there is a need for organisations to learn lessons from how they managed the pandemic.

The pandemic was a crisis and as such, how an organisation manages a crisis should be reviewed as this will capture all aspects of the organisation’s response.

Learning lessons will involve engaging with stakeholders to collect and collate information on the organisation’s response.

This can be achieved by the use of appropriate checklists that capture information on the key elements of the crisis management structure of the organisation.

Learning lessons should not aim to apportion blame for any wrong decisions made. Rather it should aim to ensure the organisation improves its organisational resilience.

A resilient organisation is one that is capable of recognising at an early stage the potential for a crisis to impact on the organisation and then manage the impacts.

This in turn will assist in making the organisation more robust, agile and capable of sustaining its existence during a long-term crisis such as the pandemic.

Further information

The following are available from the BSI Shop:

  • BS 11200:2014 Crisis Management. Guidance and Good Practice

  • BS 65000:2014 Guidance on Organisational Resilience.

The following is available from the BCI: