When discussing safety and well-being, it’s essential to prioritize prevention. Preparing for and preventing crises offers significant value, but it’s impossible to anticipate every potential event or create an environment that can withstand all calamities. Just as we conduct regular hazard assessments in the workplace, a crisis audit serves a similar purpose. It involves reviewing our environment to identify existing threats and determining which can be minimized or eliminated through proactive measures.

Financial Justification for Audits

Conducting an audit is not only a safety measure but also a sound financial decision. Addressing issues before they escalate saves resources and money compared to reactive approaches. For example, consider a light switch that gives a shock when turned off. This likely indicates a short circuit that an electrician can fix for a service fee. Ignoring the issue could result in a fire, leading to significant damage, operational delays, and potential injuries. The saying, “An ounce of prevention is worth a pound of cure,” remains relevant for a reason.

Approaching the Audit Process

To effectively manage the audit process, it can be broken down into manageable steps. Here’s a recommended approach that can be tailored to your organization’s needs:

1. Documentation Audit: Begin with a thorough review of existing emergency, crisis, and safety plans, as well as hazard assessments. This will help consolidate information and identify any gaps that need addressing.
2. 360-Degree Audit: Similar to a performance review, this audit involves gathering insights from all levels of the organization, including key external stakeholders. Conducting brief interviews (around twenty minutes each) will help capture a comprehensive view of potential risks.
3. Executive Audit: Facilitate a session with the executive team to identify vulnerabilities that could escalate into crises. This perspective often reveals insights regarding external threats, such as competition and regulatory issues, that may not be apparent to all staff members.
4. Employee Audit: Gather information through interviews with employees across departments. Ensure confidentiality to encourage honest feedback about vulnerabilities they perceive in the workplace.
5. External Audit: Conduct individual interviews with external stakeholders to gain insights into potential threats that may not be visible from within the organization. This fosters open communication and identifies external risks.
6. Online Audit: Given the vast amount of information available online, this audit involves assessing your organization’s online presence for potential reputational threats. Specialists in data mining and analysis should conduct this to uncover any risks that might not be immediately obvious.

Conclusion

Implementing a structured crisis audit process is vital for enhancing safety and preparedness within an organization. By identifying and addressing potential threats proactively, businesses can mitigate risks and ensure a safer working environment.

Documentation Audit

A documentation audit involves a comprehensive review of all existing emergency, crisis, and safety plans, as well as hazard assessments that the organization has previously developed. Many companies may already have established various crisis management protocols, such as fire response plans, chemical spill procedures, and electrical outage strategies. This phase of the audit consolidates all these documents, providing a centralized overview and identifying any gaps that have yet to be addressed.

360-Degree Audit 

Similar to a 360-degree performance review that assesses all aspects of an employee’s contributions, this audit requires input from various levels within the organization. It’s essential to interview not only internal staff but also key external stakeholders and clients. Each segment of the audit results in a detailed report outlining the necessary steps to mitigate identified risks and threats.

To ensure efficiency, keep each interview brief—approximately twenty minutes per person, especially in larger organizations.

While the list of participants may seem extensive, it’s important to remember that senior management may not be aware of threats that are visible to middle and front-line staff, and vice versa. Engaging a diverse range of perspectives is crucial for a comprehensive assessment.

Executive Audit

The auditor will lead a session with the company’s executive team, typically lasting a full day, to help identify and discuss existing vulnerabilities that could escalate into crises. This session often provides insights that differ significantly from those gathered from employees, as the executive team may possess knowledge of external threats, including competitive pressures and organizational challenges such as funding, taxation, compliance, and potential takeover issues.

Employee Audit

During this phase, information is collected through interviews with all employees, or at least representatives from each department and committee. The goal is to create an environment where employees feel comfortable sharing their insights, ensuring that their responses remain confidential. It’s crucial to address any potential concerns employees may have about reporting vulnerabilities, as they might hesitate to disclose issues if they fear it could jeopardize their job security.

External Audit

These interviews should ideally be conducted individually to preserve privacy and foster open dialogue. The approach may vary based on the company’s relationship with external clients, the nature of the business, and specific circumstances. If external providers can identify threats to your organization, it is essential to gather that information to address potential risks effectively.

Online Audit

Two decades ago, this aspect may not have been prioritized, but the Internet now serves as a vast repository of information about your organization, often containing details you might not be aware of. Conducting this audit requires specialists skilled in data mining, analysis, and interpretation. It should focus on identifying reputational threats, which can appear on sites created for complaints as well as more subtle online platforms, along with risks from potential system breaches. The findings from this audit can be invaluable to company executives, public relations teams, and information technology staff.

Sample Audit Questions

 You’ll need to customize the questions you ask to fit the company and what they do. This list is here to start you off.

• Tell me if you notice any threats to safety here at work. How about threats to business continuity?
• If there was an emergency this evening, and you had to report to work offsite tomorrow, do you know how to work remotely?
• Can you perform your job without access to your computer or usual machinery?
• Is there a place designated as an Emergency Operation Center where work can be underway with minimum delay? Have you been there to see if it meets your needs?
• Do you understand your role in an emergency situation? Have you been trained for that role?
• Do you have access to contact information for everyone (internal and external)? How often is it updated?
• If your computer is unavailable, how will you access the information that you need?
• What areas of vulnerability do you see that could lead to a problem? (Use the language of creeping, slow-burn, and sudden crisis as suits the situation.)
• Are confidential documents securely stored and shredded?
• Is security for all remote access to computers and equipment secure?
• Is garbage and recycling (such as the disposal of used manufacturing parts, which could contain proprietary information) secured?
• Do people have highly secure passwords in place to protect information on their computers and cell phones?
• Do people walk away from their desks and leave their desktop open?
• Can phone conversations or meetings be overheard?

If the company is small, you can probably conduct the audit quite quickly and easily. Even walking around the facility (inside and out) and visiting popular lunch restaurants can reveal a lot.

As we have mentioned, prevention is the best way to manage any crisis, and there may be lots of quick, simple things that can be implemented to mitigate any risks that are identified through these interviews.