Whether you run a corporation, college, or any sizable institution, take a hard look at Northern Illinois University’s response to its February 2008 shooting.  Five students and the gunman died but NIU set a benchmark for action.

A partial afternoon timeline according to NIU:

3:06                       Shooting begins and police called.

3:06:29                 Two officers arrive in area

3:07:59                  Eight more officers arrive

3:20                        Campus alert, possible gunman, avoid King Commons, get to safe area

3:40                        Campuses closed, classes canceled

3:50                        Shooting confirmed, don’t come to campus!

4:10                        Campus police report scene secure, hotline numbers announced

4:14                        Danger has passed

4:31                        All students call parents ASAP

Ask yourself, “Could we react like that?”  If you couldn’t and especially if you couldn’t come close, ask, “Why not?”

Importantly, the first seven steps transpired in about the time it took Virginia Tech to first notify students of its threat.  Yet Tech was faster than Duke’s handling of the lacrosse team rape allegations.  Although Duke wasn’t life or death (and the accusations later proved bogus) it took four days for the information to reach Duke’s PR department. With each awful incident, universities appear to be improving their responses.  Dismayingly, NIU’s lightning reaction was still not enough.  The gunman killed others and himself before campus police could stop him. God knows how many more might have died were officers not closing in.

There are at least three crisis lessons in my opinion.  (1) The fastest response is best.  (2) Prevention trumps the fastest response. (3) The crisis team trumps all.

Fast response.  How do you ensure it?  NIU’s president provided the answer when he said, “We had a plan in place… (and we) practiced that plan.”  So, create a crisis management and communications plan and test it with drills.  A plan without a drill is no plan at all.

A complicating factor is how best to alert students or employees.  The technology is being sorted out and will vary with each organization.  Even with good mass notification there is no assurance that employees or students will pay attention.  A recent AP article said only about 1/3 of students are willing to participate in campus emergency notification programs.  Even at Virginia Tech where 33 died, 40% of students have still not signed up.  This is a work in progress.  Draft a plan and drill it anyway.

Prevention.  Almost no one saw the NIU gunman’s potential lethality.  Some troublemakers, as at VaTech, are more noticeable. How to identify them?  One idea is to establish a threat assessment team.  They review perceived threats and recommend pre-emptive action.  Not foolproof, also a work in progress, but a good first step.

The above actions work well with acute situations (shootings, spills, natural disasters, fires) but can be less effective for issue problems (lawsuits, management failures, economic difficulties, product breakdowns).  That’s where the crisis team comes in.

Crisis team.  Plans, drills and threat-assessment groups are only as effective as the team that implements them.  Crises contain uncertainty.  Teams adapt best.  Take Hurricane Katrina. New Orleans, according to the NY Times, had the nation’s best hurricane response plan.  They’d even drilled it full-scale one year earlier.  All for naught.  The plan didn’t fail, the team did.

So, plan and drill for speed, evaluate threats, and, most of all, establish a trained, decisive crisis team with members and backups reachable 24/7.  All rests on the team.