Auditing a Critical Incident Response Program
by Michael Tunnecliffe

Modern organisations need to be prepared to prevent, respond to, and recover from critical incidents which have the potential, not only to disrupt their operations, but create stress for all involved.

For organisations, conscious of their employee obligations, a CIR Program has become an essential aspect of the way in which they meet their overall 'duty of care', requiring an investment of both time and money. Depending on the type of organisation, an effective CIR Program may include attention to Human Resource and Occupational Safety & Health policies, involvement from Employee Assistance Program providers and the initiation of in-house peer support or CISM teams. These initiatives require accessing the skills of appropriate personnel, the development of a plan, plus attention to on-going maintenance and administration. Unfortunately, many organisations tend to rely on a few people to shoulder this burden, or hand it over to an outside agency, or EAP provider, with few checks to ensure they're getting their money's worth.

When organisations invest time and money in a CIR Program, steps need to be taken to ensure the following:

• The program established meets the needs of the organisation.
• The program provides sought-after outcomes.
• The organisation is getting an expected return on its investment.

This can be done by having the CIR Program evaluated, or audited, on a regular basis (eg. every 12 months). Such audits may be conducted by internal or external auditors, or independent consultants to ensure the outcome is a completely objective and unbiased evaluation. To maximise the effectiveness of this evaluation system, it's important to ensure CIR Program audits are not conducted by anyone directly involved in the development or on-going support of the program.

In conducting the audit, an auditor should be seeking answers to the following four questions:

• Has the organisation adequately assessed its critical incident response needs?
• Has the organisation's CIR program been designed to meet those needs?
• As the organisation changes and evolves, is the effectiveness of the CIR program
     maintained?
• In the aftermath of a critical incident, will the CIR program work as intended?

The answers to these questions must be based on hard evidence, rather than on guesswork or assumptions. The auditor must collect and analyse sufficient documentary and anecdotal evidence to support the conclusions regarding the program's adequacy.

There are a variety of ways of gathering evidence in a CIR program audit. The following are examples:

Needs Assessment
Review past critical incidents and survey documented reports of potentially stressful areas, critical incident risk vulnerabilities, and any overviews of possible impact on personnel involved.

Effective Response and Recovery Design
Review the adequacy of documented current strategies for prevention, response and recovery from critical incidents, including the use of EAP providers and internal peer support or CISM programs. Review current EAP contracts, CIR agreements, availability of follow-up support, etc.

Program Maintenance
Evaluate any program maintenance procedures, the results of exercises or reviews, and the CIR program's place in the organisation's major Emergency Management Plan. Check the currency of inventories listing key personnel, equipment, software, records, etc.

Plan Viability
How detailed are critical incident response and recovery procedures? Do they contain details of personnel assignments, contact lists and training programs. Are exercise plans and objectives well documented with a clear evaluation of exercise results?

The goal of the CIR program audit should not be to find fault with the program, but to seek assurance that the organisation has a viable program achieving the stated objectives.

Any major deficiency needs to be highlighted for immediate attention, with minor deficiencies documented, not as criticisms, but as areas for potential improvement. Because of the changing nature of organisations, a CIR program is almost always a work in progress, and the audit should serve to reinforce the organisation's continued commitment to the program's development.

To ensure that the CIR program keeps pace with changing needs, an audit of the full program should be conducted at least every two years. It's also advisable to conduct an audit whenever any major organisational changes are planned, such as mergers or major restructuring. The focus of these audits should be to ensure any disruption to the organisation's CIR program is minimised.