Utility companies today face an environment full of challenges and uncertainty. Transformational forces are driving the entire industry to make significant changes in order to adapt. These changes require utilities to reconsider their preparedness in the face of a crisis, which can hit an organization in many different ways: a security breach, regulatory non-compliance and even weather-related disasters. As the industry transforms, and executives seek to grow their businesses and streamline processes, new vulnerabilities and threats arise. If not handled carefully, these weaknesses can lead to organizational crises and damaging outcomes. Gone are the days of merely having a crisis plan in place. Today, adapting to change, uncertainty – and even crisis – requires a cross-functional, integrated and dynamic plan to ensure it will be effective regardless of the issue. 

Cyber attacks are one example of a constantly evolving threat to utilities. In addition to protecting customer information from hackers, the energy grid itself must be protected. Recent breaches, such as the “Dragonfly” attack reported this summer, illustrate the very real dangers posed by the possibility of critical infrastructure being attacked. Utilities need to be resilient in the face of an attack by looking holistically at risk plans. 

As these plans are reviewed and evaluated on a regular basis by the steering committee to address new types of issues that arise in the marketplace, ineffective processes can be fixed. These simulations should be focused on: 

Collecting the resources and the various types of expertise that will be needed depending on the size of the issue, such as outside counsel, a public relations firm or a forensic analyst; 

Understanding the potential financial and legal implications of each type of issue;  

Ensuring that the reams of data that are collected during a crisis are communicated – both externally and internally.

When a crisis occurs, it is imperative to engage not only the management team, but also those functional leaders who can assess the needs of their specific departments. Each leader has distinct risks to consider and responsibilities to plan for in every disruption or crisis. The operations function, for example, might be responsible for identifying and coordinating issues related to health and safety or natural and environmental disasters. Similarly, the legal function will also have an important role in addressing environmental disasters as well as other potential liabilities for employees. The IT function will be focused on addressing any issues related to data breaches or theft. 

Additionally, during a crisis, executives must be cognizant of how their responses to these incidents are perceived by stakeholders. It is common to question what the priorities are and how best to respond; however, in the moment that an incident occurs there will be little time to make these decisions. The key is implementing the prepared crisis plan, engaging the right people to work together to address the issue quickly and efficiently. 

Following a crisis – and after the company returns to normal business activities – the steering committee should remain committed to actively managing stakeholder perceptions and recovery. A specific team with cross-functional authority and perspective should be appointed to continue managing issues in later stages, including rebuilding reputation, monitoring stakeholders, assessing cash flow, and ongoing management and response to investigations and litigation. Too often, companies go awry later in a crisis because they remove the resources aligned with the crisis too soon. As the recovery is managed to address unexpected items that may still arise or any settlements in process, companies should also consider how to seamlessly reincorporate employees who were dedicated to the crisis back into their daily responsibilities. This is a time to assess lessons learned, ensuring that policies and procedures are updated accordingly. 

It is critical to look at crisis planning in stages and remember that it does not end when the crisis ends. Planning ahead and following the various steps in each stage of a crisis will be instrumental to ensure an organization regains control in the wake of a crisis. Especially in an environment in which even a minor event can lead to negative repercussions – and in which customers demand more reliable service from their utilities – it is critical that crisis planning be taken seriously.

Ginger Menown  is a partner in KPMG’s U.S. Forensic Advisory Services practice, where she is the forensic national energy industry leader. She can be reached at gmenown@kpmg.com.