In business, many crises are avoidable. Yet because businesses are lead and operated by human beings, because many crises are unpredictable, and because natural catastrophes are not controllable, crisis happens.

What truly defines a crisis for your company is the preparation that takes place for the possibility, how your business behaves during the event, and what it does afterward. This is crisis management — navigating large-scale, negative Stakeholder and public reaction to a generally unlikely situation.

Crises are often public events that can negatively affect a company’s reputation and image, and the faith of consumers, shareholders and observers. Events that cause reputational damage also can equate to an instant drop in the market value of a company, something that in turn creates its own additional problems.

Internal audit has an incredibly valuable and important role in crisis management because it is uniquely positioned to focus on the before, during and after of the negative event. By proposing and committing to a prominent crisis management role along with bringing the attention of the company leaders to crisis possibilities, internal audit contributes professionally and responsibly.

Obviously, prevention is the best approach to crisis management – and internal audit’s ability to work with senior and line management teams to conduct credible and effective risk assessments is essential to avoiding crisis such as scandal, breakdowns, fraud, confrontations. misconduct and other possible problems.

By promoting involvement from senior management in these assessments and crisis response planning, evaluating the possibility of varying events that can damage a company’s reputation, and promoting a whole organization approach/involvement in preventing and handling crisis, internal auditors can have positive impact in preventing tough situations.

A full audit of the crisis management procedures, past events and evaluation of the risk assessment procedure itself can also be helpful in the preventive phase of crisis management.

Nevertheless, even with the best possible crisis prevention and risk assessment program,
crisis happens: product tampering, rumours, oil spills, injuries, fraud, faulty design, and even social media crisis. Today, when a tweet can make or break an Olympic athlete, companies can expect to have even more risk than ever. No possibility is preposterous anymore and all must at least be considered.

How leaders handle negative incidents will not only determine the damage control of the moment, but also the degree of the never-ending ripple effect of poor crisis management.

This makes preparation and proactive vision another key role for auditors as best practices are examined and applied and crisis management plans are developed and tested. Audit evaluates the test results and anticipates possible scenarios, including both internal response and public relations/media response.

Of course, during a crisis, internal auditing must be included as an integral part of the crisis management team at the same time it observes and assesses the business response processes.

Afterwards, a full evaluation of the company’s effectiveness in handling the crisis will help to prevent poor or encourage positive working responses in the future. But don’t wait to ensure internal audit and management are doing their crisis avoidance job until after the crisis – because without adequate preparation and handling, it is often too late, once the crisis has occurred, to manage the company’s reputation and resulting financial problems.