1. business and industrial

Crisis Management Toolkit
Proprietary and Confidential
Crisis Management Toolkit
Contents
Introduction .......................................................................................................... i
How to Use This Toolkit ........................................................................................ i
Next Steps ........................................................................................................... ii
1.
Crisis Management (CM) Policy, Standards and Expectations ................................. 1
Crisis Management Policy ................................................................................... 1
Crisis Management Standards ............................................................................ 2
Crisis Management Expectations ........................................................................ 2
2.
Crisis Management: Definition, Structure, Processes and Planning ......................... 4
What is a Crisis? ................................................................................................. 4
Johnson Controls Response Structure ................................................................ 5
Crisis Management Structure Roles and Responsibilities .................................... 7
- Site Response Teams .................................................................................. 7
- Regional / Country Incident Support Team Structure.................................... 7
- Global Business Unit Crisis Management Teams ......................................... 8
- Enterprise Crisis Management Team ........................................................... 8
- Special Working Groups ............................................................................... 8
Crisis Management Processes .......................................................................... 10
- Notification and Reporting .......................................................................... 10
- Concept of Operations ............................................................................... 13
- Communications and Coordination............................................................. 15
- Plan Maintenance ...................................................................................... 15
- Training & Exercising ................................................................................. 16
- Post-Incident Reviews ................................................................................ 16
Planning ............................................................................................................ 16
Exercising .......................................................................................................... 18
3.
Real-Time Response Guidelines ............................................................................ 21
Roles and Responsibilities................................................................................. 21
Basic Response Guidelines ............................................................................... 22
Communicating During an Emerging Issue or Crisis .......................................... 24
4.
Appendices ............................................................................................................ 27
A. Glossary of Terms ......................................................................................... 27
B. Working Tools ............................................................................................... 32
C. Enterprise Crisis Management & Response Preparedness Business Operating
Standards (BOS) ............................................................................................... 36
D. Global Crisis Management Planning Resources ........................................... 43
E. Sample Emergency Response & Business Continuity Plans ......................... 47
F. Crisis Management and Preparedness Self-Assessment Tool ...................... 48
G. Crisis Management Preparedness Wallet Card and Poster .......................... 56
Proprietary and Confidential
i
Crisis Management Toolkit
Introduction
When a crisis hits, the first response is often uncertainty and
apprehension. No matter how much we plan and prepare, an adverse
situation catches us off guard and may leave us momentarily wondering,
“What do I do now?” It is impossible to know precisely when a potential
crisis may occur. However, the right insight, preparation and planning
can help us not only survive an adverse event but properly manage any
incident we face so that we protect our employees, operations, financial
performance, customer loyalty and community standing.
Appendix
Our first duty is to conduct daily business with care and foresight so that
incidents and crises are rare. When potential crises do occur, we must
behave and communicate responsibly in accordance with the public and
our company’s interests until the issue is resolved.
available to
advice and
To that end, Johnson Controls’ Crisis Management Program and Plan is
designed to guide response activities at all levels of the organization so
that we can respond, mitigate and recover from any type of event or issue
that threatens the organization. Each site, region and country level of
the organization is expected to either review its current or develop a
new local response plan based on the materials in this toolkit. The
goal is to ensure that each facility and location has the teams, resources
and tools to manage a crisis or incident and knows when and how to
access the broader resources of the company and the expertise of the
overarching business unit and corporate crisis management structure.
This document is designed to help you through those first difficult
moments and on into the event as it unfolds.
How to Use This Toolkit
This toolkit is designed to help ALL Johnson Controls sites, regions and
country structures to further develop or improve individual and local
response capabilities. In this document, you will find four main sections
to assist you in your preparedness efforts:
 Crisis Management Policy, Standards and Expectations
 Overall Crisis Management and Response Structure, Process and
Planning Steps
 Real-Time Response Guidelines
 Tools, samples and additional resources
Proprietary and Confidential
D
has
a
roster
of
global
contacts
that
are
i
provide
counsel
should you have any
questions
when
developing your site,
country or regional
plans.
Crisis Management Toolkit
In each of these sections, you will find additional planning guidance and
answers to basic questions such as:
 Who do I call when an event occurs?
 What questions should I expect? And, what if I can’t answer them?
 Where can I turn for help?
 Who should I coordinate and communicate with to manage the
situation properly?
 What is the proper chain of command during a response situation?
 What resources and support do I need?
In addition to the toolkit, there are supplemental resources as part of this
document and available on the Intranet [Enterprise Security
Website/eRoom].
A complete list of sample materials and
documentation can be found in the Appendices of this Toolkit.
Furthermore, a number of Johnson Controls colleagues have been
assisting the planning process and are important resources to support
you in this initiative. A roster of global contacts within each Business Unit
and representing our corporate functions is available in Appendix D.
Next Steps
The recommendations and guidance provided in this document can help
you update existing plans or develop new materials as necessary. Until
then, this toolkit can be used to help you through those first difficult
moments and as an event unfolds. It is not a complete guide, but rather
provides essential elements you will need during any emergency.
Working together, we can all help to ensure that Johnson Controls is well
positioned to respond effectively to any potential crisis and emerge not
only intact but ideally a better, stronger and more respected organization.
Proprietary and Confidential
ii
Crisis Management Toolkit
1
Crisis Management (CM) Policy, Standards and Expectations
Johnson Controls has adopted a Crisis Management Policy that describes the
organization’s stance on managing incidents and crises and the type of
response it expects of its people. The complete Crisis Management Policy along
with the Enterprise Business Operating Standards (BOS) for Crisis Management
and Preparedness can be found on the Johnson Controls intranet. They can be
found at (LINK).
Crisis Management Policy
The Johnson Controls Crisis Management Program and related Plans are hereby
created to establish a crisis management process that will allow coordination and
decision-making at all levels of the Company when a crisis occurs or when
incidents develop that could eventually become a crisis for the Company. The
Crisis Management Plans define a process for reporting and notification of
incidents that are or could become crises for the Company, establish a Johnson
Controls Enterprise Crisis Management Team and Global Business Unit Crisis
Management Teams to assist the businesses and the Company in managing
these incidents.
The Crisis Management Program will help position Johnson Controls to protect
employees, assets, customers, the public and Johnson Controls’ reputation.
The Crisis Management Program and Plans provide the capability to:
 Secure and protect our people, neighboring communities, facilities,
information and operations in a manner consistent with related laws and
policies;
 Quickly and effectively respond to, manage and recover from crises;
 Mitigate the impact of these risks on Johnson Controls people, facilities or
operations; and
 Maintain the capabilities through ongoing planning, training, exercising,
quality assurance and other program maintenance activities.
Proprietary and Confidential
1
Crisis Management Toolkit
This Crisis Management Program and related Plans apply to all of Johnson
Controls, including all business units and all Johnson Controls owned and
operated facilities/sites. They are meant to complement emergency and other
incident response procedures and related programs. This Crisis Management
Policy supersedes all previous crisis management policies within Johnson
Controls. A copy of the complete Enterprise Crisis Management and Response
Preparedness BOS is located in Appendix C of this Toolkit, and is maintained
with other Enterprise BOS documents.
Additionally, an Enterprise Crisis Management Business Operating Standard
(BOS) has been established that provides additional information on the
expectations and guidance on maintaining the appropriate level of preparedness
throughout the company and within each Business Unit.
Crisis Management Standards
The following standards should be met across the Johnson Controls
organization.
 Every site, regional or country level of the organization must have a Site or
Local Response Plan in place. That plan should reference and incorporate
guidance provided in this toolkit, and should establish a fundamental
response capability for the range of risks and threats. These plans should
include the response management framework, and include the integration
and alignment of all other response aspects including local governmental
emergency response, business continuity, IT disaster recovery and other
specialty or incident plans and procedures as needed.
 Johnson Control employees that are permanently based at a customer
location are expected to follow that customer’s emergency response and
crisis management procedures. Or, depending on the circumstances, the
Johnson Controls personnel and operations should retain their own response
plan if the customer’s plans do not fully account for our preparedness and
response requirements. In either case, during an event employees must
regularly update and communicate with the Johnson Controls Business Unit
Manager on the unfolding customer “crisis” situation and its impact on
Johnson Controls’ people and work.
Crisis Management Expectations
Every Johnson Controls site, region and country structure should:
 Establish a Response Management Team as appropriate for the local
structure
 Define relevant response sub teams as appropriate, for example fire
brigades, floor warden/evacuation teams, business continuity teams, etc.
 Include basic plan elements as defined in this toolkit
 Define how your level will integrate within the broader crisis management
response structure as defined within the Johnson Controls Crisis
Management Toolkit
Proprietary and Confidential
2
Crisis Management Toolkit
 Define the process for use of corporate-wide tools and resources such as the
Crisis Hotline, and leverage other available tools as appropriate
 Maintain and update plans with an annual review
 Keep multiple copies of the plan available for use during an emergency, and
maintain electronic or other access if appropriate
 Train and exercise all Response Team members on an semi-annual basis or
on a frequency appropriate to the local capabilities requirements
 Participate in an annual self-assessment process designed to provide an
assessment of the status of your program, and to provide a broader
understanding and assessment of preparedness functions and capabilities
across Johnson Controls
Proprietary and Confidential
3
Crisis Management Toolkit
2
Crisis Management: Definition, Structure, Processes
and Planning
What is a Crisis?
A “crisis” is any unexpected event or series of events that has the
potential to or does negatively impact and/or harm Johnson Controls
employees, customers, suppliers, shareholders, local community,
operations, assets, products, finances, image, reputation, or the
environment, AND requires immediate senior management notification,
focused involvement, action and resources. A crisis can be a physical or
non-physical event and even an emerging issue, and threaten to cause
damage or harm to our employees, business operations, brand,
customers, etc. Following are a list of sample incidents or crises which
may affect Johnson Controls.
Examples of incidents with the potential
to become a crisis for Johnson Controls
• Act of terrorism
•
Civil disruption
• Industrial accident
•
Unexpected labor dispute
• Fire or explosion
•
Malicious rumor
media report
•
Major investigation by government
agency
•
Class action lawsuit
•
Significant or malicious threats to
Brand or Reputation
• Workplace violence
• Kidnapping
• Storm or flood
• Hazardous material spill/release
• Major release of pollutants
• Major disruption
business caused
Controls
of customer
by Johnson
or
inaccurate
 Alleged misbehavior by
company or employees
In addition to potential crises for Johnson Controls overall, there are those
events that specifically and solely impact a Business Unit. These events
may be somewhat localized to the plant or location where the event
occurs, to the business line and its products or customers, and/or
uniquely to a single business unit’s employees. These incidents may
represent a potential crisis for the Business Unit, and are typically beyond
local response capabilities.
Proprietary and Confidential
4
Crisis Management Toolkit
Johnson Controls Response Structure
The ultimate objective of crisis management structure at Johnson
Controls is to forecast and mitigate the consequences of a significant
incident and/or potential crisis regardless of the cause or geographic
location. The overall CM structure establishes a process for coordinating
response actions among four critical response efforts:
 Site Response Teams
 Regional or Country Incident Support Team or structures
 Global Business Unit Crisis Management Teams (GBU CMT)
 The Enterprise Crisis Management Team (ECMT)
In addition to the overall Johnson Controls enterprise response structure,
special working groups may be convened. These special working groups
serve as a coordinating mechanism for the enterprise response and are
designed to provide subject matter experts, focused support, guidance
and response support, where appropriate.
Johnson Controls Response Structure
Enterprise Crisis Management Team
Global Business Unit
Crisis Management Team
Special Work Groups
and Functional
Department “Teams”
Regional / Country Incident Support Team*
Affected Site / Location
Response Team
*Where this exists.
To streamline operations, response teams at all levels of the organization
should focus on their distinct roles and responsibilities in managing
incidents. At the same time, there should be a common strategy,
resource coordination process and central information-sharing point
vertically in the Company, as well as a means to request additional
support where required for the business response efforts. The Johnson
Controls crisis management structure is designed to provide the flexibility
to expand or contract to meet the specific needs of a particular situation.
To the extent they get involved, the country, regional and corporate
headquarters teams will take a leadership role during crises. The Crisis
Management and Incident Support Teams are trained and ready with
Proprietary and Confidential
5
Crisis Management Toolkit
advice, support and resources for local management. That means you
can spend less time dealing with the broader consequences and impacts
of a potential crisis and more time protecting your employees and getting
your operations back to normal.
Most incident or emergencies will be resolved at the local level; in fact
97% or more of all events will only require a localized site response effort.
Others will rise to the level of a Business Unit crisis where the impact is
primarily or entirely on the Business Unit. In most cases these crisis
situations will be resolved at the Global Business Unit level and within the
business unit response structure. Involvement by the ECMT may be
limited to being briefed on the situation. And, even fewer situations will
reach the level of, and have the potential to be, a crisis for the Johnson
Controls Enterprise, and/or may have effects that reach across multiple
Business Units.
The following graphic depicts the distinctions among the roles and
responsibilities of the various levels of the response structure. As noted
above, local teams may be able to effectively mange a significant portion
of events. However, when an incident does escalate or may potentially
affect the region, country or business unit(s) in a broader way, incident
support should be requested and in some cases strategic involvement
and corporate crisis management resources should be involved.
This response structure also assumes coordination with and inclusion of
other types of incident plans, such as Business Continuity, Supply Chain
Management, Issues Management and IT Disaster Recovery, where and
if appropriate based on the situation and response needs. Beyond the
immediate “site” response, any regional, country, branch structures and
the affected Global Business Unit Crisis Management Team(s) becomes
involved as needed, and eventually the Enterprise Crisis Management
Team for those few events that reach the potential proportions and
significance that could result in a crisis for Johnson Controls as a whole.
Proprietary and Confidential
6
Crisis Management Toolkit
Crisis Management Structure Roles and Responsibilities
Following defined roles and responsibilities of each of the four response
team levels.
Site Response Teams
The first response to incidents at a Johnson Controls site, or a Johnson
Controls customer site, will be made by the Site Response Team. There
are several types of Site Response Teams. For physical incidents, the
site emergency response team will provide the first response to
emergencies that pose an immediate threat to life, health or safety of
persons and property. The role of this team is to ensure immediate and
competent handling of such an incident.
The Emergency Response Team, typically led by an incident manager,
will provide immediate tactical response to the Johnson Controls site or
customer site. The first response to other non-physical incidents
originating at a site will be made by another or a response sub-team,
such as a site-based Business Continuity Team, Supply Chain
Management Team or possibly a site-based Issues Management Team.
These teams may not reside at the site level in all cases. Some of these
incident response teams may support multiple sites/locations, and may
not be at the location when the situation occurs.
*
Regional / Country Incident Support Team Structure
The Regional/Country Incident Support Team Structure is a loosely
defined or geographically proximate organization that represents to
varying degrees both Business Unit(s) and functional departments in the
area of the affected site. This structure will serve as an information
gathering and sharing point, and provides needed support and
coordination from a near location to the affected site. Where it exists, the
Regional/Country Incident Support Team Structure provides or
coordinates the provision of incident support and resources to manage
the situation and works to assist in the mitigation of the immediate
consequences of the situation on the site and immediate area or region.
The Regional/Country Incident Support Team Structure will generally be
composed of a Lead Business Unit General Manager, other Business
Unit GMs in the region/country, key functional department representatives
in the region or country and ad hoc members. In some cases a Branch
organizational structure may also be present, and would become involved
in a similar way as the regional or country incident support team to assist
an affected location.
Where Regional or Country or Branch management structures exist, the
site response team and the Global Business Unit Crisis Management
Team if involved will coordinate with that structure to provide the needed
incident support and resources to the affected site(s).
Proprietary and Confidential
7
Crisis Management Toolkit
Global Business Unit Crisis Management Teams
The Global Business Unit Crisis Management Team is the senior
Business level decision-making body for the response to all major
incidents and/or emergencies that threaten to become a crisis for the
Business Unit. The Global Business Unit Crisis Management Team will
provide (or coordinate the provision of) incident support to manage the
situation and work to mitigate the effects of the situation on the business
and its operations. Where Regional or Country management structures
exist, the Global Business Unit Crisis Management Team(s) will
coordinate with those teams directly to provide additional incident support
to the affected location(s).
Enterprise Crisis Management Team
The Enterprise Crisis Management Team (ECMT) is the Enterprise-level
strategic decision-making body that ensures the necessary support and
coordination of needed resources to the affected Business Unit(s) for the
response to all major incidents and/or emergencies that threaten to
become a crisis to Johnson Controls overall. Additionally, the ECMT will
provide strategic and policy decisions and will manage corporate
consequences and issues to protect the company’s legal and financial
stability, brand, image, reputation and overall business strategy. The
ECMT is responsible to manage issues and adverse events that threaten
the Enterprise, including in those cases where there is no specific site or
business unit is involved directly (e.g. airplane accidents, external highlevel investigations or accusations, special risks, etc.).
Special Working Groups
In addition to the overall Johnson Controls enterprise response structure,
special working groups may be convened. These special working groups
are generally ad hoc and designed to provide subject matter experts, and
focused support, guidance and response actions. When activated,
Special Work Groups serve as a coordinating mechanism for the
enterprise response, and may be either cross-functional or may represent
a single department or function. Typically, Enterprise Work Groups would:
 Facilitate sharing of information on the situation
 Provide guidelines, policies and advisories for their subject/area
 Identify issues, resources and other response needs for further
focused effort and make recommendations
 Ensure the proper resources are being made available
 Report status/situation briefs to the response structure leadership
Recent examples of these enterprise work groups include: the Pandemic
Enterprise Work Group and the Hurricane Enterprise Work Group.
Proprietary and Confidential
8
Crisis Management Toolkit
The following chart provides a summary view of each team’s roles.
CRISIS MANAGEMENT / RESPONSE TEAM RESPONSIBILITIES
Enterprise Crisis Management
Team
•
•
•
•
•
•
Assessing crisis impacts on the
Enterprise
Forecasting
Corporate
or
enterprise-wide consequences
Managing Corporate crisis issues
Selecting the strategy(ies) to
manage the actual or anticipated
Corporate consequences
Issuing policy directives for those
issues reserved for the ECMT
Ensuring coordination of those
crisis issues and response actions
that impact more than one
Business Unit, and providing
oversight of the response
•
•
•
•
•
•
•
Proprietary and Confidential
Global Business Unit Crisis
Management Team
Regional / Country Incident
Support Team or Team Structure
Providing or coordinating the best
available resource support and/or
technical expertise from across the
corporation to the Site Response
Team(s) (resources may be pulled
from across business units, or
elsewhere throughout the region or
country, and is managed by this
team if a regional team is not
available to do so.)
Coordinating
the
response
activities of functional departments
within the Business, including
human
resources,
communications, health & safety,
etc.
Supporting
incident
response
including
business
continuity,
resumption and recovery;
Identifying/forecasting
and
managing key business issues and
consequences stemming from the
incident
Managing issues beyond the Site
Response Team’s authority
Reporting incident information and
unmet needs to the Enterprise
Crisis Management Team
Identifying and escalating strategic
issues to the Enterprise Crisis
Management Team
•
•
•
•
•
•
Clarify to the site response team
and up through the Global
Business Unit what capability
exists at the region/country level,
and what support can/will be
provided
Providing or coordinating the best
available resource support and/or
technical expertise from across the
corporation to the Site Response
Team(s), in coordination with the
Business Unit Team (resources
may be pulled from across
business units, or elsewhere
throughout the region or country)
Assisting in the coordination of
functional department response
efforts,
including
human
resources,
communications,
Environmental, Health & Safety,
etc.
Providing assistance with business
continuity,
resumption
and
recovery, as necessary
Assisting with the management of
issues beyond the Site Response
Team’s authority, in coordination
with the Global Business Unit
Crisis Management Team
Reporting incident information and
unmet needs to the Global
Business Unit Crisis Management
Team,
and
identifying
and
escalating strategic issues as
necessary
Site Response Teams
• Providing tactical response to site
emergencies
• Executing or Coordinating Business
Continuity, Supply Chain and
Issues
Management
response
efforts
• Executing business recovery plans
• Restoring normal site operations
• Communicating with locally affected
parties and the public, including
contractors, vendors, etc.
• Reporting incident information and
unmet needs to Regional/Country
structure and/or Business Unit
Team
Planning Action:
team
descriptions
Review
and
responsibilities, and factor
them into your own plan.
Establish your site, country,
or regional response team
and define membership.
9
Crisis Management Toolkit
Crisis Management Processes
When updating existing site or regional/country plans or developing new
plans, it is important that they reflect the procedures and guidelines which
have been established at the corporate and business unit level. Key
processes that should be addressed in each Response Plan include:
 Notification and Reporting
 Concept of Operations
 Communications and Coordination
 Plan Maintenance
 Training and Exercising
 Post-Incident Reviews
Notification and Reporting
Johnson Controls has streamlined its reporting process to ensure that
incidents and potential crises are reported quickly, appropriate crisis
response teams are notified as needed, and the site or region is able to
quickly access the additional resources and guidance that may be
required.
The company maintains and operates a centralized control center that
provides remote building operation, system monitoring and other services
to Johnson Controls customers and sites. The Remote Operations
Center (ROC), located within the 507 Building in downtown Milwaukee,
Wisconsin, manages the Johnson Controls Crisis Hotline (1-866-4441414 US/Canada, or 1-414-524-7840). The Crisis Hotline serves as the
24/7 initial reporting and notification point to initiate the Johnson Controls
enterprise crisis management process worldwide. The Crisis Hotline also
maintains a software system that provides alerts and data related to
potential threats that could affect Johnson Controls employees, sites and
customers.
A key objective of the initial reporting and notification process is to
prevent incidents from escalating into a crisis for Johnson Controls.
All incidents that meet the following criteria should be reported to the
crisis hotline:
Planning Action: Ensure that
the Crisis Hotline information
is included in Site, Country
and/or Regional plans.
10
Proprietary and Confidential
Crisis Management Toolkit
Reporting to the Crisis Hotline
Calling the Crisis Hotline does NOT preclude the need to make other regulatory,
safety or other reports per normal reporting procedures.
Incident Status Reporting Criteria

A business-related death or serious injury of an employee, contractor or
visitor, or death of other person(s) caused by or attributed to any Johnson
Controls facility or resource

An actual or threatened kidnapping of an employee of Johnson Controls

A building evacuation or quarantine resulting from an actual incident or threat
(including due to contagious outbreaks)

Regional events that may impact Johnson Controls sites, employees or
customers

A potential business interruption expected to last for more than 24 hours

An incident receiving significant adverse media attention

A regulatory violation potentially with the potential to result in a substantial
enforcement fine

A site inspection expected to result in a substantial enforcement fine, or
negative exposure

Unplanned Investigations, site inspections, contagious health concerns
identified within a Johnson Controls site or Johnson Controls Customer site,
etc.

A fire, explosion, hazardous material spill/release with potential to adversely
impact the environment.
Planning Action:
CRISIS HOTLINE
Call: 1-866-444-1414 US & Canada
1-414-524-7840 International
for inclusion in local plans
and develop additional
reporting
needed.
When reporting an incident or crisis, Crisis Hotline operators will do the
following:
 Complete an Incident Status Report form (contained in the appendix)
to document the incident being reported
 Ask you about the nature and severity of the event, and response
efforts underway
 Find out what kind of help you need
 Place notifications to select designated representatives within your
Business Unit, region and/or functional departments.
11
Proprietary and Confidential
Review
the above reporting criteria
criteria
as
Crisis Management Toolkit
The more you know, the better able they’ll be to provide you with the
resources and any help you need. However, don’t wait until you have all
of the information before calling the hotline.
What information should you attempt to provide?
Be prepared to provide as much information as you can, including:
What happened?

When did it happen? Where?

Have there been any fatalities? Is anyone injured? Who are they?

Are the injured being cared for?

Have families been notified?

Is anyone still in danger or in need of assistance?

Is there damage to Johnson Controls or customer property?

Is the crisis confined to our property or is the local community
impacted?

Have local authorities (police, fire, rescue) been contacted? Are
they on-site?

Is there potential for more damage?

Is any hazardous material involved? Any release to the
environment?

Are news media on the scene? Who are they?
IMPORTANT: Do not wait until all of the information is available
before calling the Hotline. The initial report should be made as quickly
as possible or at the first safe opportunity. If all of the information is
not available immediately, further updates can be provided in the
following hours and days. When in doubt, call the Crisis Hotline.
Benefits of the Hotline
More than just a management tool, the hotline gives individual Johnson
Control sites as well as region/country teams a simple and streamlined
way to inform management of an incident and request additional support
without making multiple phone calls or sending numerous emails.
Specifically, the hotline will help



Quickly escalate incidents to other response teams as needed
Forward requests for additional resources and help
Inform region / country staff or high-level business unit managers of
an emerging incident or crisis
12
Proprietary and Confidential
Crisis Management Toolkit

Provide the Incident Status Report form to ensure consistent
understanding of the known facts resulting in a timely and consistent
report
It does not preclude local management from notifying the normal chain of
command, does not take the place of other safety or regulatory reporting.
Concept of Operations
Each local Response Plan should include a concept of operations that
defines the process for how the site or regional/country team will operate.
This should include guidelines around what can be accomplished at that
level with local resources, as well as when other teams should be relied
on to provide incident management and strategic crisis management
support.
The concept of operations should also address the following four
components:
1.
2.
3.
4.
5.
Team Structure
Activation
Communications and Coordination
Open Issues & Action Item Status Tracking
Response Team Resources
Team Structure
Planning Action: Ensure your plan includes a
detailed Concept of Operations defining
how your Response Management Team
members will work together as a group, and
coordinate with other response teams across
Johnson Controls.
This section of your plan includes local Response Team membership,
roles and responsibilities of individual members. All team member
contact information is typically in an appendix as a roster.
Activation
This section of your plan should define the circumstances and criteria
under which the local Response Team will activate, who is responsible for
making that decision, and the process for activation of the response team.
Open Issues & Action Items Status Tracking
An Open Issues Tracking process and Open Issues Tracking form should
be used by each Response Team to identify, prioritize and assign issues
requiring action or resolution. Team members are expected to develop
strategies and action plans to address assigned issues, and will be
expected to report back on status to the response management team.
Those issues that cannot be resolved at the local level will be up-leveled
to the regional team, Global Business Unit Crisis Management Team or
the Enterprise Crisis Management Team for decisions and actions as
needed.
13
Proprietary and Confidential
Crisis Management Toolkit
The Action Items Status form is designed to capture specific actions that
are identified during team meetings for assignment. The Action Items
Status form will be updated to capture status and completion of the
actions, as the assigned team member reports it to the team.
Response Team Resources
Your plan should include details of the available team resources,
including specialized expertise, teams or outside consultants, as well as
physical resources and tools available. Resources should include primary
and alternate locations for team meetings, technical and technological
capabilities and communications availability. On-site resources and
equipment for the local Response Team should also be considered such
as the following:





Hard-line and mobile telephones, and radio communications
Speakerphone capabilities
Audio/Video capabilities, including projection/playback equipment
Television with cable connection
Computer(s) linked to Corporate network, and external internet
14
Proprietary and Confidential
Crisis Management Toolkit









Facsimile machine(s)
Copy machine(s)
Printer(s)
Audio/Video recorder(s)
Back-up power supply
Battery supported radio(s)
Satellite telephone(s)
White board(s)/black board(s)
Standard office supplies
Communications and Coordination
Communications and coordination is essential to a successful response,
and it is imperative that response teams effectively communicate
information and coordinate actions among and between themselves. This
section of your plan should contain how communications and coordination
will occur, by whom (both within the local response team, and in the other
teams that might become involved and require direct contact), when and
how frequently, and the process that will be used to maintain effective
communications and coordinated response throughout the response
effort.
Plan Maintenance
This section should include details of the process and anticipated
timelines to ensure the planning documents are maintained and always
up-to-date. Following are some general guidelines:



Critical plan changes as the result of new guidance, new team
members, or changing business responsibilities/priorities should be
implemented as soon as possible, or at least quarterly.
Planning materials should be reviewed and updated after a major drill
or exercise; changes should reflect lessons learned.
A complete document review and update should be completed
annually.
15
Proprietary and Confidential
Crisis Management Toolkit
Training & Exercising
Your plan should define your training and exercising program to maintain
a level of readiness and well trained and practiced responders. Following
are some general guidelines:

All response team members should be trained initially and then
periodically (at least annually) on the local Response Plan,
procedures and protocols. Refresher training should be scheduled
periodically, and can be combined with other activities or standing
meetings. When a new team member is appointed, that individual
should be trained on the existing plan as soon as possible.

The plan should be validated through an ongoing exercise program.
The exercising process should account for scenario-based tabletop
discussion periodically (e.g. semi-annually) and drills or exercise
approximately every 12-18 months. Exercises with multiple teams
and levels of the Johnson Controls response structure should be
scheduled and coordinated to ensure validation and practice among
teams.
Post-Incident Reviews
A standard best practice for crisis management and corporate
preparedness programs is to ensure a post-incident review process is
included. As part of the deactivation process in your plan, a post-incident
review process and protocols should be defined. A post-incident review
should be conducted following every time your local Response Team is
activated. The process provides an opportunity to review response
procedures, identify areas for improvement and capture lessons learned.
Planning
Action:
Review how the above
basic guidelines can be
expanded
and
customized based on
specific site, country
and/or regional needs.
Planning
The development or update of existing response plans at the site or
regional/country level in accordance with the recommendations in this
toolkit is an important step in assuring that all crisis management and
corporate preparedness elements within Johnson Control’s are aligned
and well integrated. Planning for your crisis management and response
capabilities generally should follow a standard approach, which typically
includes a seven step process.
16
Proprietary and Confidential
Crisis Management Toolkit
1. Review CM Policy, BOS and CM Toolkit: Review the material
presented in this CM Toolkit as well as the policy and Crisis
Management and Response Preparedness BOS, for standards,
expectations and guidance. The sample documentation in Appendix B
may also be a useful reference.
2. Define Response Structure: Determine who will play an active role
on the local Response Team(s).
Focus on team member
representation from across different business and functional areas as
well as key resources such as human resources, finance, legal, health
and safety, communications, etc.
3. Identify Roles & Responsibilities: Define and document the roles
and responsibilities of each team member, as well as for all of the
teams in the Johnson Controls Crisis Management and Response
Structure. Ensure there is a primary and alternate identified for each
team position at your level.
4. Define Response Team Relationships & Integration Points:
Determine which teams will provide incident and crisis management
support for your particular site or region/country, and define the
process for coordination, communications and integration when
multiple levels and teams are involved. Also, ensure your local
planning includes the coordination, communication and integration
17
Proprietary and Confidential
Crisis Management Toolkit
where appropriate with local response agencies, such as fire, police,
government and regulatory entities, etc.
5. Create Concept of Operations: Review the key components
referenced above in the concept of operations section and define the
business process and procedures by which the local Response Team
will function.
6. Update / Develop Plan: Update existing plan materials as necessary
to include the new and corporate concepts defined in this CM Toolkit.
If no plan currently exists at your level, begin developing one that
encompasses the necessary response management requirements.
Reference the integration, oversight and management considerations
for other existing incident response plans such as procedures for
emergency response, business continuity, IT disaster recovery, etc.
Secure feedback and approval from local leadership and response
teams as necessary.
7. Response Team Training & Exercises: Develop a training and
exercise program that focuses on improving response capabilities at
the site or region/country level, and periodically validated integration,
coordination and communications among other teams throughout the
overall crisis management response structure.
Exercising
Exercising is an important step in assuring that all crisis management and
corporate preparedness elements within Johnson Control’s are aligned
and well integrated. Building a response capability is more than just
developing a plan; it is also about training and giving team members an
opportunity to practice implementing plan components.
Exercising gives response teams an opportunity to validate the concepts,
processes and protocols in their plans under hypothetical scenarios.
Crisis management and response exercises can be conducted with
participation from a single response team or a combination of teams from
different levels of the organization. The activities in Johnson Controls’
comprehensive exercise program consist of:
Tabletop Exercises - Facilitated scenario-based discussions that allow
participants to work through realistic crisis situations, define or validate
crisis management policy, and validate the corporation’s crisis
management and response plans. The tabletop exercise is facilitated, and
includes structured facilitator questions designed to encourage interaction
among team members. One extended or a series of “snapshots”
scenarios should be used, and the session is typically conducted over a
three to four-hour time period in a conference room setting.
18
Proprietary and Confidential
Crisis Management Toolkit
Functional Exercises - Scenario-based exercise activities lasting four to
six hours where participants are afforded the opportunity to demonstrate
individual and team crisis management capabilities by reacting and taking
actions based on a simulated crisis or emergency situation. Rather than
simply discussing what the Team would do under the scenario (as in a
tabletop exercise), the Team actually carries out their decision-making,
response actions and communications process in real-time in a fastpaced, pressured environment. Functional exercises are typically limited
in their involvement of teams, and the breadth of response objectives to
be demonstrated.
Full Scale Exercises - Scenario-based exercise that involves a
participating team from multiple levels of the enterprise and provides for a
comprehensive validation of the crisis management and response
capabilities. Participants are afforded the opportunity to demonstrate
individual, team, and organizational crisis management capabilities and to
validate the linkages between the various corporate response levels.
Teams participate from their actual command or operations centers with
full movement of resources over a six -hour or greater period. Full-scale
exercises usually include field level response team participation and often
also include local, state and/or Federal government response
participants. This type and level of activity is often driven by the ECMT or
Global Business Unit Crisis Management Team levels.
Johnson Controls response teams at the site or regional/country level are
expected to participate in at least one exercise activity every 12-18
months. It is recommended that when starting a program, teams begin
with a Tabletop Exercise and then move on to a Functional Exercise. Fullscale exercises will be sponsored by the ECMT or the Global Business
Unit CMTs. If a site or regional/country team is asked to participate in a
Full Scale Exercise that activity would fulfill their exercise requirements
for that year.
Exercises for your crisis management and response capabilities generally
should follow a standard approach. Following are the four key steps to
designing, developing, conducting and evaluating an exercise:
19
Proprietary and Confidential
Crisis Management Toolkit
1) Design: Individuals who will not be participating in the exercise
and who are knowledgeable of Johnson Controls’ business
processes, risk profile and general vulnerabilities should develop
exercise objectives and formulate a scenario(s). The goal is to
raise issues and challenges that will exercise the Plan(s) and
current Team structure and procedures.
2) Development:
During the development phase, individuals
responsible for conducting the exercise must further develop the
sample hypothetical scenarios. In the case of a tabletop exercise,
scenarios can unfold as “snapshots” in time written in narrative
form. For exercises, the scenario takes the form of a timeline and
messages– essentially the scenario information scripted to drive
actions directly through the individual responders, as it would
occur in real life. In this case, the scenario “facts” would be
revealed in the real time frame that a crisis unfolds.
3) Conduct: The Exercise should be conducted in a realistic mode,
to the extent possible, and will follow the Team’s simulated
response over the duration of the exercise period. As the
scenario information is revealed, participants either discuss and/or
practice applying elements of the plan to managing the
hypothetical event and mitigating its impact. At the conclusion of
the Exercise, participants should debrief to discuss what went well,
areas for improvement and action planning items.
4) Evaluation: At the conclusion of the exercise, a final report
containing all observations, assessments and recommendations
should be developed and shared with the team. Areas for
improvement or plan changes should be prioritized and
implemented as soon as possible. A team member or responsible
manager should be assigned to follow up on all action items.
20
Proprietary and Confidential
Crisis Management Toolkit
3
Real-Time Response Guidelines
Initial Emergency Procedures
Roles and Responsibilities
As noted in the planning section, the roles and responsibilities of
response team members should be defined within the site or
country/regional response plan. However, if the planning process is not
complete and the organization is faced with a potential crisis, avoiding
overlap of responsibilities or duplication of efforts can help streamline
response activities. The following chart provides a brief overview of who
is responsible for what response programs. This may need to be further
customized or updated based on your site, regional or country operations.
21
Proprietary and Confidential
Crisis Management Toolkit
Who Has To Do What
 Operations/Management – Oversee local response efforts,
coordinate activities with the appropriate country/regional or Business
Unit teams, request additional support resources as needed, identify
and raise those issues that require senior-level decision making, focus
on the health and safety of Johnson Control employees, and identify
business continuity issues
 Communications – Identify all affected audiences, understand their
information needs, develop a communications strategy, draft
messaging and communications materials, secure all appropriate
approvals, and execute against the communications strategy

Environment/Health & Safety – Identify current and potential /
future health and safety issues, develop strategies to mitigate their
impacts, notify senior management of unresolved issues, respond to
inquiries from related local, state or federal government agencies
 Human Resources – Ensure employees are accounted for, leverage
Employee Assistance Program and other resources, determine if
further support services (counseling, time away from work, etc.) will
be needed, determine what if any employee regulations apply
Basic Response Guidelines
If the site or region/country does not have a plan in place and an adverse
event or potential crisis strikes before the planning process is complete,
reference the following as a guide to help direct actions. This is not a
complete or exhaustive checklist; rather this document provides some
high-level guidelines that can be used during an event.
22
Proprietary and Confidential
Crisis Management Toolkit
RESPONSE CHECKLIST
Take Appropriate Action to Protect Anyone from Immediate Danger
Evacuation
Shelter in place
Contact/Dispatch first responders
Complete Accountability Process
Initiate local Incident Response Management
Obtain/Search for Credible Information
Planning
What happened?
Action:
Local
How bad is it, or how bad could it become?
response
plans
should
include points of contact,
What is being done?
coordination
and
communications processes,
What is the potential for escalation?
consequences could result?
What potential impacts or
Make Appropriate Notifications
If there is a continuing or imminent danger to people and/or property,
contact Law Enforcement, Fire, Medical, local security officers or other
necessary first responders.
and other aspects related
to the response that will be
provided
agencies.
by
local
Notify key contacts or stakeholders within the facility
Notify any internal or external experts necessary
– Mental health experts
– Technical experts
– Environmental experts
Complete safety, health, regulatory or other required notifications
Notify the Crisis Hotline (U.S. and Canada 866-444-1414 or
International +1 414-524-7840).
of the Crisis Management
Program maintain global
relationships with security,
investigatory,
crisis
Notify affected family members and provide appropriate support
Contact your local HR representative, or request assistance from the
Regional/Country Incident Support Team
Give Direction on What Employees Should Do In the Near Term
Leave the facility/go home
management, emergency
response
and
public
relations firms that can be
quickly applied to local
situations, in addition to
your country or regional
Stay where they are
teams.
Return to their facility, building or office
23
Proprietary and Confidential
Planning Action: Managers
Crisis Management Toolkit
Manage the Incident
Develop an immediate response strategy and execute against plans
Work with other response teams as necessary
Request additional resources and support as needed
Forecast potential business impacts of the incident
Communicate to all stakeholders as appropriate (coordinate as
necessary)
Upon Resolution of the Situation
Management should be highly visible following an event
Clear acknowledgement of what occurred should be made
Employees should be given the opportunity to ask questions and
discuss concerns
Appropriate persons should attend a briefing by senior management at
location
Provide employees with an opportunity for additional on-site counseling
and emotional support
Get employees back to work as soon as possible
Follow Up Actions
Schedule and conduct a post-incident review with all relevant response
teams
Present lessons learned to appropriate management, employees and
assign actions for plan updates and corrective actions
Communicating During an Emerging Issue or Crisis
Planning Action: Review
how the guidelines on
managing the news
media
should
incorporated
existing plans.
be
into
Every case is different. Consult with either your local or regional
communications representative or the Enterprise Communications
Work Group before issuing any statements from the company—to
employees, the media, customers, local officials or the like. In most
cases, Johnson Controls will develop a set of messages in
response to an incident and work with you to develop
communications for key stakeholders; which includes appointing an
appropriate spokesperson(s) to handle all media contacts.
However, the nature of global communications today—where nearly
every incident or issue can be broadcast worldwide in an instant—
requires that we respond very quickly. In these cases, a general
statement that is somewhat non-committal regarding the facts, but
expresses the company’s concern is adequate. For example:
24
Proprietary and Confidential
Crisis Management Toolkit
“We are working to address the situation, as well as to get an
understanding of the facts. We will be back to speak with you as
soon as possible.”
Beyond this initial statement and when developing a strategy for
communications, Johnson Controls should ensure it is identifying
a list of relevant stakeholders, defining their likely and relevant
concerns and questions related to the situation, and then
developing a proactive communications plan to respond
appropriately to the situation, while protecting Johnson Controls.
Following is a list of potential stakeholder groups to consider:
Identify Audiences Potentially Impacted

Employees

Customers

Surrounding Community

Suppliers

Vendors

Business Partners

Government Entities, Politicians & Regulators

Financial Analysts (corporate will address these)

Shareholders (corporate will address these)

Board of Directors (corporate will address this group)
As events unfold and as additional information becomes available,
Johnson Controls will be implementing its response protocols.
Communications efforts will need to evolve from a simple holding
statement to messages and materials that better define what happened,
how Johnson Controls is responding, and what the company is doing to
mitigate the crisis, including the protection of employees and the
community, how the company will continue to meet customer demands,
and what the organization is doing to prevent a similar situation in the
future.
Additional key messages to consider for communicating about an ongoing
situation include the following:
25
Proprietary and Confidential
Crisis Management Toolkit
Key Messages

“Following our normal processes, we are closely monitoring the
situation to manage its potential impacts on the personal health and
safety of our employees as well as our global operations.”

“We have a number of contingency plans and are in the process of
implementing them.”

“We are committed to protecting the health and safety of our
employees globally. The personal health and safety of our
employees is a top priority.”

”We are prepared and ready to support all of our customers.”

“We continue to monitor the situation and will continue to keep you
updated as needed.”

“We are working closely with local authorities (i.e., fire, police,
emergency medical services) to protect and help our employees and
the surrounding community.”

“We are conducting an internal investigation to understand why this
happened and more importantly so we can avoid a similar incident in
the future.”
26
Proprietary and Confidential
Crisis Management Toolkit
4
Appendices
A. Glossary of Terms
To ensure a common understanding, language within the Plan must be
consistent and easy to understand. Definitions of terminology in the plan
are critical to a user-friendly document.
Activation: The initial formal assembly and involvement of the crisis
management or response teams that marks the beginning of the
involvement of that team in the coordination, support and decision-making
processes in response to an actual event.
Ad-Hoc Members: Individual members who have functional or specific
expertise directly related to the consequences of specific incidents. Can
be pre-designated but may not be involved in all actual response
situations.
Alternate: The individual to be called upon to represent a given function
on a crisis management or response team in place of the Primary
member.
Business Continuity: The measures to ensure continuity of normal
business operations and resumption of these after an incident.
Business Continuity Plan(s): The processes, tools, resources etc. and
the documentation of these maintained in readiness to enable Johnson
Controls to respond to incidents and risks that threaten to disrupt
business continuity, and prevent the performance of normal business
processes.
Business Impact Analysis: This is the systematic analysis of critical
processes to determine:
 Identification of processes critical to the businesses ability to operate.
 How long the business can operate without the process.
 What might cause the process to fail and what is the probability of
failure (Risk Assessment).
27
Proprietary and Confidential
Crisis Management Toolkit
 What resources, tools, hardware, facilities, software etc. is critical to
the ability to maintain the process.
 What the current protection or mitigation is that maintains the process.
 What alternative means of delivery there are
 Responsibilities for the process.
Concept of Operations: The portion of a crisis management plan that
broadly describes how a response will be carried out and provides
specific information on operational aspects, such as notification,
activation, response priorities and a description of meeting protocols and
activities.
Crisis: A “crisis” is any unexpected event or series of events that has the
potential to or does negatively impact and/or harm Johnson Controls
employees, customers, suppliers, shareholders, local community,
operations, assets, products, finances, image, reputation, or the
environment, requiring immediate senior management notification,
involvement, action, focus and resources.
Crisis Communications: The process of creating and executing both
internal and external communications strategies that support operational
objectives and facilitate either avoiding a crisis or the minimizing of its
impact.
Crisis Management: A focused, proactive and strategic operating
capability designed to prevent, prepare for, respond to, and recover from
an event, series of incidents, or set of circumstances that threatens to
negatively impact the organization, its reputation or brand, and relations
with employees, volunteers and patrons.
Crisis Management Plan: A documented set of processes and related
procedures that provides a framework for senior representatives to
manage the response to an actual or potential crisis by providing seniorlevel direction, strategy, response coordination and support.
Critical - An asset or process etc. that is essential to Johnson Controls’
ability to do business, support its clients and remain legal.
Disaster Recovery (Plan) – The recovery plans put in place by IT to
recover IT hardware and software etc. after an incident.
Enterprise Crisis Management Plan – The Johnson Controls
Enterprise-level Crisis Management Plan covering the company overall
including all business areas and functions of Johnson Controls.
Maintained by the Johnson Controls Corporate Security Executive
Director.
28
Proprietary and Confidential
Crisis Management Toolkit
Enterprise Crisis Management Team (ECMT): The senior
management-level team that is charged with identifying, evaluating, and
managing the strategic response to actual or potential crisis issues and
consequences for Johnson Controls.
ECMT Chair: Provides overall direction and coordination of strategic
crisis management activities and the ECMT.
Deactivation: The orderly return of crisis management, emergency
response, and site level response team members to their normal duties.
Emergency: Any incident that has the potential to broadly or significantly
threaten human life, health, property or the community if not controlled,
contained, or resolved immediately by local responders and resources.
Emergency Response Team (or Incident Response Team): Provides
first response for physical incidents and emergencies that pose an
immediate threat to life, health or safety of persons and property. The role
of this team is to ensure immediate and competent handling of an incident
that poses a threat to human life or physical property or assets.
Emerging Issue: An issue or series of seemingly unrelated incidents
that, combined and/or made public, may create a crisis, including
negative news coverage, damage reputation, and/or result (more than a
predetermined amount) in fines, penalties, legal damage, unbudgeted
expenses, and other costs.
Exercise: A practical simulation activity requiring the performance,
integration and coordination of planned response activities by individuals
and teams. An activity designed to facilitate training and provide a basis
for evaluating the effectiveness of plans or procedures.
Global Business Unit Crisis Management Team (GBU CMT):
Incident: Any event that has or may negatively affect any aspect of
Johnson Controls operations.
Incident Support: Those activities associated with the provision of
assistance and support during an incident, including the provision of
operational, functional, departmental resources and other support
activities to an affected location.
Local Response: Those activities that address immediate on-site needs
that arise during an incident or emergency. The primary function of Local
Response is tactical, including initial life safety and emergency response
requirements at the affected location in accordance with any established
local response procedures and processes (e.g. fire response, building
evacuation, etc.) and regulations.
29
Proprietary and Confidential
Crisis Management Toolkit
Maximum Permissible Downtime – The longest period of time that a
process can not operate for without causing damage or other loss to the
business generally or to a department.
Operational Disruption: The disruption or threat of a disruption to
Johnson Controls services to an extent that the disruption will cause
broader harm to Johnson Controls operations, image or standing in the
community.
Planning Case: A tool used to define the potential (worst-likely) impacts
of the incident, which will enable the crisis management or incident
support team to look ahead and make assumptions about potential
response needs.
It is used to identify and define the incident
characteristics, consequences and issues that have or could impact
Johnson Controls. The Planning Case will serve as the common set of
assumptions upon which crisis management and response is based.
Post-Incident Review: The analysis of an organizational response to an
incident for the purpose of identifying both positive and negative aspects
of the response. The review also documents lessons learned and
recommends improvement actions, where appropriate.
Regional Coordinator – Someone within each region appointed to own
and maintain the regional crisis structure and to coordinate any crisis and
incident support management planning activities.
Regional Executive – The senior Johnson Controls executive for the
region.
Responsible for ensuring that there is a regional crisis
management and response structure is in place.
Regional Incident Support Team – The pre-arranged and named
individuals who will manage the impacts, consequences and provide
resources to manage the crisis at the regional level, together with any
additional resources they consider necessary to support them.
Remote Operations Center (ROC): Manages the Johnson Controls
Crisis Hotline which serves as the 24/7 initial reporting and notification
point to initiate the Johnson Controls enterprise crisis management
process worldwide. The ROC also maintains a software system that
provides other alerts and data related to potential threats that could affect
Johnson Controls employees, sites and customers.
Response: Those spontaneous or predetermined actions taken to save
lives, protect property, assets, and the environment, or otherwise limit the
consequences of any actual or potential incident.
Risk – A combination of threat, probability, mitigation and impact that
determines a level of risk.
30
Proprietary and Confidential
Crisis Management Toolkit
Site: Any Johnson Controls occupied premises used by Johnson Controls
for its business – but excluding client premises.
Site Response Team – The senior Johnson Controls managers and
specialists at a sight brought together to manage the responses to an
actual incident or potential crisis.
CM Screening Group: The Corporate Security Executive Director and
Regional Security Directors who receive notification of an incident and
assess the nature and severity, as well as the actual or potential impacts
of the incident, to determine the need for broader involvement, continued
monitoring of the event, or to notify and/or convene the Enterprise Crisis
Management Team.
Tabletop Exercise: A scenario-based simulation for a crisis management
or emergency response team that uses facilitated discussion to validate
crisis management and response plans by analyzing one or more
hypothetical situations, developing possible courses of action, and
arriving at critical decisions.
31
Proprietary and Confidential
Crisis Management Toolkit
B. Working Tools
CRISIS MANAGEMENT
INCIDENT STATUS REPORT
Business Unit/Function:
Reported By (name):
Incident Date:
Date/Time of Report:
Global Directory ID:
(Page 1 of 2)
Phone:
Incident Time:
Location of Incident/Affected Site, Building, or Facility (location name and address):
Type of Incident
Fire
EMERGENCY SITUATION
Location of Incident
Other:
Explosion
Product Related
Workplace Violence
Financial
Weather
Security/Theft/Fraud
Counterfeit / Piracy /
On-Site
Off-Site
Regional/Country Threat
Supply Chain/Business
Interruption
Health Alert/Emergency
Drug Activity
Labor Issue
Yes
No
No
Hazmat Release
Contaminant Name:
Estimated Duration
(if known):
Describe
(complete
selecting other):
Yes
Business Interruption
Intellectual Property
Data Breach / IT Security
Activism
IT Outage
Power Outage
Property Damage
Airborne:
Yes
Liquid:
Yes
Other:
No
No
when
Release Amount (if known):
DESCRIPTION / STATUS OF INCIDENT
CASUALTIES/HUMAN IMPACTS
Name
Employee
Contractor
Public
Fatality
Injury
Missing
1.
2.
3.
4.
DESCRIPTION / NATURE OF INJURIES AND HUMAN IMPACTS
32
Proprietary and Confidential
Crisis Management Toolkit
CRISIS MANAGEMENT
INCIDENT STATUS REPORT
(Page 2 of 2)
CUSTOMER / COMMUNITY IMPACT
SUMMARY OF PUBLIC / MEDIA ACTIVITIES
Agency
Contacted By
NOTIFICATIONS
Date/Time
Name of Agency
Contact
Activity
SUMMARY OF RESPONSE ACTIVITIES
Response Underway
Planned Response Actions
Report Taken By:
Title:
Report Transmitted to the Screening Group Date/Time:
Thank you for taking the time to report this incident. If appropriate, this information will be forwarded to the
Screening Group. In the meantime, do you need any additional resources or support?
Yes
No
If yes, would you like me to contact the designated Business Unit Team in:
The associated region?
Yes
No
The Global Business Unit Crisis Management Team?
Yes
No
Any Functional Departments?
Yes
No
If yes, which?
33
Proprietary and Confidential
Crisis Management Toolkit
CRISIS MANAGEMENT
OPEN ISSUES TRACKING
Issue #
Priority
Issues Description
Contact
Scheduled for Deliberation
or Decision
PROPRIETARY AND CONFIDENTIAL
34
Proprietary and Confidential
Crisis Management Toolkit
CRISIS MANAGEMENT
ACTION ITEMS STATUS
Work Group
Priority
Contact
Action Items Description
Status
Due Date(s)
PROPRIETARY AND CONFIDENTIAL
35
Proprietary and Confidential
Crisis Management Toolkit
C. Enterprise Crisis Management & Response Preparedness Business Operating Standards
(BOS)
Hard copy located on CD
36
Proprietary and Confidential
Crisis Management Toolkit
37
Proprietary and Confidential
Crisis Management Toolkit
38
Proprietary and Confidential
Crisis Management Toolkit
39
Proprietary and Confidential
Crisis Management Toolkit
40
Proprietary and Confidential
Crisis Management Toolkit
41
Proprietary and Confidential
Crisis Management Toolkit
42
Proprietary and Confidential
Crisis Management Toolkit
D. Global Crisis Management Planning Resources
Automotive Experience
Last Name
First Name
Department
Title
Location
Email
An
Lin
EHS
Mgr- Health &
Beijing Auto Comp
[email protected]
Safety
Co Ltd
No. 1 Linhe South
Road
Beijing 101300
China
Duesterberg
Dave
EHS
Director, Health,
AG - Interiors -
Safety and
Environmental
Prince Technical
and Customer
North America
Center 915 E. 32nd
Street Holland MI
[email protected]
49423
LademannFleger
Claudia
Communications –
Executive Suite
VP
Communications -
JC Automotive
Group European HQ
Vice President
Industriestrasse 2030 Burscheid 51399
[email protected]
Germany
Leunens
Guido
EHS
Director HSE
Johnson Controls
EU/SAf/Sam
Automotive N.V. Bell
Telephonelaan 2
[email protected]
Geel, 2440 Belgium
Building Efficiency
Last Name
First
Name
Department
Title
Location
Email
McGavin
Martin
Risk Management
Manager Global
Casualty Insurance
North America
[email protected]
Swanson
Scott
HR - Safety
HR - Safety
631 S. Richland
Avenue
[email protected]
Nelson
Kristy
HR - Safety
DIR Safety Indus
Hyg
507 East Michigan
Milwaukee, WI
[email protected]
Hein
John
Communications
Global Mgr Comm,
Head of Europe
De Kleetlaan 3
Diegem, Belgium
[email protected]
De Kleetlaan 3
Diegem, Belgium
[email protected]
York, Pennsylvania
and African
Comms
Lyssens
Jan
EHS EMEA(HR)
Health & Safety
Manager EMEA
43
Proprietary and Confidential
Crisis Management Toolkit
Last Name
First
Name
Department
Title
Location
Email
Dance
Simon
Facility Management
Dir. Of Security European Real
EMEA
[email protected]
Estate and Fac.
Mgmt Solutions
Nackaerts
Nancy
EHQ Communication
PR
De
Communications
Manager Europe &
Diegem, Belgium
Kleetlaan
3
[email protected]
Africa
-Communications
Systems & Service
Flanagan
Donna
National
Services
Account
Manager, National
11301 W Lake Park
Services
Dr
Milwaukee WI 53224
[email protected]
United States
Leskovec
Daniel
Environmental
Sr Environmental
507 E Michigan St
Compliance
Engineer
POB 423
Milwaukee WI 53202
[email protected]
USA
Everdepoel
Serge
GWS FM EMEA Health
Regional Health &
De
& Safety
Safety Mgr
Pegasus
Park
Diegem Zuid
Kleetlaan
[email protected]
-
Diegem 1831
Belgium
Bichler
Nathan
T&M Safety
Safety
507 E Michigan St
Representative
POB 423
Milwaukee WI 53202
[email protected]
USAA
Power Solutions
Last Name
First
Name
Department
Title
Location
Email
Mrozinsky
Beth
HR - Safety
IH & Safety
Manager
JCI Corporate Headquarters Battery 5757 N.Green Bay Ave
[email protected]
Milwaukee, Wisconsin
USA
53209
44
Proprietary and Confidential
Crisis Management Toolkit
Last Name
First
Name
Department
Title
Location
Zhu
Joe
Operations
General
BG - Battery - Shanghai, China
Manager
700-800 Kang Qiao
Kang Qiao Industrial
Pudong
China
VanDerWeele
Brian
HR
Email
Shanghai,
[email protected]
Road
Zone
201315
Lake Park 113, 7800 N. 113 St.,
[email protected]
Milwaukee, WI 53224
Fitzgerald
Rebecca
Comm
Director, Global
JCI Corporate Headquarters -
Comm
Corporate, 5757 N. Green Bay
Avenue, Glendale, Wisconsin
[email protected]
53209 USA
Gibbs
Lesch
Steven
Executive
VP
Global
JCI Corporate Headquarters -
Suite
Operations
Hybrid Battery
Corporate, 5757 N. Green Bay
Avenue, Glendale, Wisconsin
Systems
53209 USA
Director HSE
Am Leineufer 51
Hannover 30419
Axel
HSE
[email protected]
[email protected]
Germany
Enterprise Crisis Management Planning Resources
Last Name
First
Name
Title
Email
Bichler
Nathan
BE Manufacturing
[email protected]
Brondyke
Roger
Operations Program Manager
[email protected]
Carpenter
Sharon
corporate HR
[email protected];
Dance
Simon
Dir. Of Security - European Real
Estate and Fac. Mgmt Solutions
[email protected]
Duesterberg
Dave
NA Automotive HSE
[email protected]
Sherman
Gary
Disaster Recovery & Infrastruture
Services Manager
[email protected]
Flanagan
Donna
Bldg Eff Group Operations: Fire &
Security Branch
[email protected]
Fleck
Rick
IT/ Disaster Recovery Coordinator
[email protected]
Forton
Todd
BE Global EHS
[email protected]
45
Proprietary and Confidential
Crisis Management Toolkit
Last Name
First
Name
Title
Email
Greene
John
Corporate HR Leader Development
[email protected]
Grigg
Peter
Coordinator - Remote Operations
[email protected]
Hall
Michael
Manager Corporate Travel
[email protected]
Komorowski
Ward
Dir. Fac. And Bldg Services GWS
[email protected]
Ksobiech
Chris
Director, Service Safety
[email protected]
Leskovec
Daniel
BE Sr. Environmental Engineer
[email protected]
Leunens
Guido
AE Europe, South America, Middle
East, South Africa HSE Director
[email protected]
Marshall
Jim
Director, Global IT Security
[email protected]
McGavin
Mick
Manager Global Casualty Insurance
[email protected]
Mrozinsky
Beth
IH & Safety Manager
[email protected]
Sanchez
Yammel
Global
Director,
Procurement, Americas
Shull
Jennifer
Sr. Ops Program Analyst ROC
[email protected]
Soderberg
Bob
Director Global Security
[email protected]
Voeller
Greg
Dir. Global Employee Comm.
[email protected]
Indirect
[email protected]
46
Proprietary and Confidential
Crisis Management Toolkit
E. Sample Emergency Response & Business Continuity Plans
The following sample plans are available for review. These have been provided by individual sites and regions
and have not necessarily been approved by corporate nor have they been reviewed in light of the guidance
provided above. These documents are intended to be for our reference as certain elements or components
may be applicable as the sites and regions are developing their own plans.
TITLE
OWNER /
LOCATION
DATE
UPDATED
INTRANET LINK
Building Efficiency /
N/A
Daniel Leskovec
Building Efficiency /
Emergency Response Plans (PPT)
N/A
Daniel Leskovec
Simon Dance, GWS
GWS EMEA Crisis Management &
Central
Operations Dec. 2008
Business Continuity Plan (BOS)
Director EMEA
Guidelines for the Development of
Automotive Experience /
Aug. 2007
Emergency Response Plans &
Guido Leunens
Business Continuity Plans
Emergency Action Plan Template
47
Proprietary and Confidential
Crisis Management Toolkit
F. Crisis Management and Preparedness Self-Assessment Tool
Please see the attached CD for the Crisis Management and Preparedness Self-Assessment Tool Excel document.
48
Proprietary and Confidential
Crisis Management Toolkit
49
Proprietary and Confidential
Crisis Management Toolkit
50
Proprietary and Confidential
Crisis Management Toolkit
51
Proprietary and Confidential
Crisis Management Toolkit
52
Proprietary and Confidential
Crisis Management Toolkit
53
Proprietary and Confidential
Crisis Management Toolkit
54
Proprietary and Confidential
Crisis Management Toolkit
55
Proprietary and Confidential
Crisis Management Toolkit
G. Crisis Management Preparedness Wallet Card, Security Incidents Must Be Reported and
Emergency Contact Information Posters. (also located on CD in pdf format).
56
Proprietary and Confidential
Crisis Management Toolkit
Security Incident Reporting Poster
To increase awareness at company locations worldwide, the Security Incidents Must Be Reported poster should be
displayed in prominent locations throughout the plant, facility or office. Please login to the Johnson Controls portal and
select Employee Services > Employee Security Services to download this poster.
57
Proprietary and Confidential
Crisis Management Toolkit
58
Proprietary and Confidential