How Prepared Are America's Colleges and Universities for Major Crises?
Assessing the State of Crisis Management

Ian I. Mitroff is the Harold Quinton Distinguished Professor of Business Policy at the Marshall School of Business and a professor of journalism at the Annenberg School for Communication, University of Southern California (USC). Michael A. Diamond is a professor and vice president and executive vice provost emeritus, also at USC. C. Murat Alpaslan is an assistant professor of business in the College of Business and Economics at California State University, Northridge. The authors would like to acknowledge Casey Green and Estela Bensimon for their input and suggestions.

Originally published in the January–February 2006 issue of Change magazine. Reprinted here with permission of the authors.

Hurricane Katrina and the September 11th terrorist attacks alerted university leaders and governing boards to the full danger of both natural and manmade disasters. Yet the lesson should not have been needed. Like their corporate counterparts, in recent years colleges and universities have been beset by a wide variety of crises that, although not as devastating as Katrina and 9/11, have seriously damaged their infrastructures, reputations, and prestige - for instance, the University of Colorado football scandal, the harassment of female cadets at the Air Force Academy, and the 1999 Texas A&M bonfire disaster that killed 12 students and injured 27 others. And then there are the widespread and perennial crises such as grade tampering; the alteration of key files and student records; computer hacking; major fires and explosions; student unrest; civil disturbances; confrontations, sometimes violent, between students of different political, religious, and ideological viewpoints; ethical breaches by top administrators, faculty, and students; the fraudulent use of tutors by student athletes; the stealing of body parts from university medical schools, and so on.

Colleges and universities, if not necessarily their leaders, generally survive everything from earthquakes to grade scandals. However, as the complexity of institutional operations, technology, and infrastructure increases, the risks facing universities and their leaders multiply as well, and wise leaders will plan accordingly. But while a review of various university web sites reveals that some are prepared for physical disasters, those sites rarely display plans to manage a broad range of both physical and reputational crises.

The purpose of this article is to outline a set of recommendations to college and university leaders and governing bodies on how to develop crisis-management systems to ensure that their institutions are as well prepared as possible for a wide range of crises. These recommendations are based, in part, on crisis-management programs developed for various business organizations by one of the authors. Since there is virtually no national research that details how colleges and universities have prepared for such events, we also conducted a survey of colleges and universities to determine the level of crisis-management preparation among American colleges and universities. The results of that survey also inform our recommendations.

What is Crisis Management?

The field of crisis management is only twenty-plus years old. The 1982 poisonings of Tylenol capsules with cyanide in a suburb outside of Chicago is generally acknowledged as the beginnings of the modern field. The fact that Johnson & Johnson (J&J), the makers of Tylenol, responded quickly in pulling all bottles of the medication off the shelves nationwide, thus signaling that it was putting the safety of consumers ahead of profits, served to make J&J into an early role model for crisis management. Since then, a great deal has been learned about how and why crises occur. Even more important, the components of an ideal or "best-practice" crisis-management program are much better understood.

A crisis-management program is not just an emergency preparedness program, nor is it just thinking about or planning for a few isolated or particular types of crises in isolation from one another. Crisis management is thinking about and planning for a wide range of crises and especially for their interactions. One of the things we learned from the Hurricane Katrina debacle is that natural disasters often set off human-caused ones, the making of which were in place well before the precipitating event.

An ideal program has four essential components: 1) preparation for a broad range of crisis types; 2) mechanisms for picking up and amplifying the early warning signals that accompany all crises and are generally perceptible far in advance of the event; 3) a well-trained, interdisciplinary crisis-management team; and 4) the inclusion of a wide variety of both internal and external stakeholders in crisis plans, policies, and procedures. Prior to any disasters, a successful crisis-management plan exposes weaknesses within the current system and builds capabilities to deal with a wide variety of situations. That way, the crisis-management team can enact these capabilities with speed and efficiency during a crisis and can learn from the experience how to improve the system. If an organization or institution is not prepared, as for example FEMA was not prepared for Katrina, the effects of any calamity can be exacerbated enormously.

Crisis Types—Most major crises do not consist of a single, isolated event but instead involve a complex chain of crises that the originating catastrophe sets off. For instance, 9/11 initiated a chain of reactions that rippled out from ground zero. The disaster not only affected the psychological and economic well-being of New York City but that of the entire country. Another example: the recent football scandal at the University of Colorado was not a single but a series of interrelated sex, recruiting, leadership, political, and financial crises. The toll on the university has been great. Not only was the president forced to resign, but admissions are down for both out-of-state students (19%) and Colorado students (4%) - and, according to an article in the Christian Science Monitor, "faculty and students say the mood on campus is increasingly dark." So crisis management must be a systemic activity, because almost all crises are part of a system of other crises.

The most dramatic current example of a system of crises is, of course, Katrina. Katrina-related problems for colleges and universities in the New Orleans area involve far more than the physical damage to the local campuses. Even after the buildings are repaired, these institutions will have to recover lost tuition revenues, reestablish admissions procedures, reconstruct lost student and faculty records and research data, rebuild research facilities, and retain and recruit faculty and staff, to mention just a few of the challenges ahead. Further, the institutional capability to reopen will depend to a large extent on the short- and long-term crisis-management capacities of federal, state, and local governmental agencies and political organizations, as well as those of cooperating corporate contractors.

Of course it is impossible to prepare for every conceivable type of disaster. Nonetheless, the best-prepared organizations have learned how to form a crisis portfolio that lays plans for what institutional leaders have identified as the seven to 14 types of crises that they are most likely to experience (see Figure 1). Akin to a financial portfolio, a crisis portfolio helps an institution spread its risks. Indeed, a broad-based crisis portfolio is one of the best insurance policies that any organization can take out.

Despite their core educational missions, colleges and universities are really like cities in terms of the services they must provide and even some of the businesses they are in. For example, in developing a crisis-management plan for the University of Southern California, we found that USC operated close to 20 different businesses, including food preparation and services, hotel services, retail outlets, health-care facilities, sports events, and many other activities besides teaching and scholarship (each of which has its own sub-"businesses," such as distance education). Each of these activities presents the university with different risks.

Thus it is important for those managing and leading universities to develop a crisis portfolio that reflects their institution's complexity and that can change over time. For example, USC is a large and complex institution with a College of Letters, Arts and Sciences and 17 professional schools, ranging in size from about a dozen to over a thousand faculty. Each of these academic units faces different operating and academic risks, depending on a variety of factors such the composition of the student bodies and faculties (e.g., the number of international students) and the types of research conducted (e.g., clinical and human-subjects research or research involving hazardous materials). The risks associated with running the School of Fine Arts are very different from those associated with operating the Marshall School of Business or the Keck School of Medicine.

Crisis Mechanisms—The crisis-management literature suggests that all crises, long before they occur, send out a trail of early warning signals that indicate that the likelihood of a crisis is quite strong. If these signals can be picked up and amplified, many crises can be prevented before they occur -- obviously the best possible kind of crisis management.

One approach universities officials can use is to identify what we call ticking time bombs. These are potential crises that lie just under the surface of various business or educational activities but could be activated by either exogenous or internal events. Figure 2 lists the types of ticking time bombs a large research university might face. University managers and leaders need to constantly listen for signals that might indicate a bomb is about to explode. Another example of a crisis mechanism is damage control, mechanisms that help to ensure that a crisis--a fire, for example--will keep from spreading to other unaffected parts of an organization.

The Crisis-Management Team—The literature suggests that even if an organization cannot prevent all possible crises from occurring, it nonetheless can recover substantially faster and at much less cost if it has a well-trained, inter-departmental crisis-management team in place. In the corporate sector (and probably for the campus sector as well), most top executives of an organization should be members of the team. This may include the chief executive and financial officers and the heads of legal affairs, public affairs, security, operations, information technology, medical affairs, quality assurance, and so on.

It is extremely difficult to bring in members of a team on an as-needed basis. The best teams train together in order to function as cohesive units in the heat of an actual disaster. Precisely because each crisis has the potential to set off an uncontrolled chain reaction, having a well-trained interdepartmental team that meets regularly is the best preparation possible for handling any eventual crisis. The formation and workings of crisis-management teams for academic institutions are discussed in more detail in a later section of this article.

Crisis Stakeholders—Crises also involve a wide array of stakeholders, both internal and external to an organization. In the corporate sector, such stakeholders not only include the top executives of an organization but middle managers and workers. Other major stakeholders include unions, competitive organizations, regulatory agencies, special-interest groups, law enforcement, and so on. In other words, the best-prepared organizations factor into their crisis plans, policies, and procedures how these various stakeholders are apt to both help and impede and should be included in the organization's crisis response.

Universities' stakeholder groups include students, faculty, staff, parents, governing bodies, regulatory agencies, vendors, and athletic organizations, to name just a few. These stakeholder groups can play important roles when a crisis occurs. For example, the discussions one of the authors had with officials from New York University revealed that the university's ability to respond quickly to the various needs of its students immediately after the attacks of 9/11 was due in part to the excellent relations it had with its vendors, who provided needed supplies, such as cots and food, to stranded students. And the excellent communications with students and parents that President Scott Cowan of Tulane University rapidly established through the Web after Hurricane Katrina helped the university manage an important set of stakeholders.

Finally, crisis management has before, during, and after phases. The before phase consists of studying previous crises experienced or avoided, auditing one's crisis strengths and weaknesses, correcting the weaknesses, and building the capabilities to survive a crisis. The during phase involves implementing those capabilities. And the after phase consists of a post-mortem that attempts to assess what went wrong and what could be improved so that the institution will be better able to cope in the future.

How Prepared are American Colleges and Universities for a Crisis?

Have American colleges and universities systematically prepared themselves for a variety of crises that they are likely to face sometime in the future? Do they have crisis-management programs in place?

We designed our institutional survey to assess

• How many kinds of crises, and which kinds, colleges and universities were prepared for. Did they have broad or narrow crisis portfolios, and were their portfolios matched to the actual kinds of crises that they had experienced?
• Whether they had a crisis-management team, and if so, who was on it. Did the composition of their crisis-management teams provide additional information about their crisis portfolios?
• The degree of support (financial, political, and institutional) for crisis management versus other major programs.
• And most important, did being prepared for crises pay off, in the sense that better-prepared institutions experienced fewer crises and recovered better and faster from those that nevertheless occurred?

The answers to these questions provide a benchmark against which university leaders can assess their own preparedness.

The Survey—In fall 2004, we sent a survey to the provosts of 350 major U.S. colleges and universities. We received 117 useable responses, a response rate of over 33%, which we consider very reasonable for a survey which asks for such sensitive information. Of the returned responses, 36 percent were primarily urban colleges and universities, 39 percent were suburban, and 24 percent were rural, while 41 percent were private and 59 percent public. Only a quarter (24 percent) had a medical school. The average number of undergraduate students was 9,700, of professional or masters students 3,000, and of doctoral students 1,200. The average budget was nearly half a billion dollars.

Crises Prepared For Versus Crises Experienced—We asked the provosts to indicate how well prepared their institutions were for each of the general categories of crises identified in Figure 1, which are representative of the types encountered by a wide range of institutions. In addition, we asked how many of the fourteen potential crises their institutions had actually experienced.

Our first major finding was that the surveyed colleges and universities were generally prepared only for those crises that they had already experienced. In other words, they do not follow the best-practice model of crisis management that has been identified in the corporate world and described above.

At the same time, degree of preparation did not completely track with the frequency of those experiences. The first three crises that they had experienced the most-- fires, lawsuits, and crimes-- were also the ones for which they were the best prepared (see Figure 3). But environmental disasters and athletic scandals were the fourth and the fifth crises respectively for which these colleges and universities were prepared, even though these were among those that they had actually experienced the least.

This information can be interpreted in several ways. We could conclude that the surveyed institutions over-prepared for, say, environmental disasters (such as the release of toxic chemicals). But given the importance of these crises and their potential impact on campuses and surrounding communities, it could very well be that preparation for them substantially lowered their frequency of occurrence. A third explanation is that state and federal laws mandate most colleges and universities to prepare for environmental disasters and that the regulations are working, in that the number of such disasters is relatively low in the surveyed institutions. Similarly, the experience of athletic scandals was comparatively low, a somewhat surprising finding given the prominence of several recent cases in the national news. Nonetheless, preparation for these scandals has been high, possibly in light of that media coverage.

At the same time, there are several important types of crises that were frequently experienced but not prepared for. These tended to be the softer areas such as reputation and ethics, as well as other non-physical crises such as data loss and sabotage. They represent areas in which the surveyed colleges and universities have gaps in their crisis-management plans.

What emerges clearly from these data is that few of the surveyed institutions have broad-based crisis-management programs. One can also infer that these institutions do not have broad-based crisis-management teams, with members drawn from different administrative, faculty, and technical areas. Crisis management must be undertaken and practiced systemically because crises are systemic in both their nature and impacts. On the other hand, it is impossible to prepare for every conceivable eventuality. Proactive organizations attempt to prepare for at least one set of risks in each of the 14 categories, thus creating a broad crisis portfolio.

There is another important reason for forming a broad crisis portfolio based on sample scenarios: no catastrophe happens exactly as it has been planned for. Thus, the plans are less important than the ability to improvise during an actual event. Those organizations that have prepared for a category are better able to adapt to whatever particular form the disaster takes. For instance USC, having experienced a number of earthquakes, had a well-conceived and tested plan to deal with these occurrences. When the Rodney King riots broke in Los Angeles near the campus, the university was able to use much of its earthquake-preparedness plan to deal with the civil unrest around the campus.

Tulane University's experience during and after Hurricane Katrina provides an example of how difficult it is to plan for the ripple effects of a crisis. As reported in the September 28, 2005, Wall Street Journal, Tulane has had some successes in dealing with one of the greatest natural disasters ever suffered in the U.S., but there were some unanticipated consequences as well. According to the Journal, "When generators ran out of fuel, 27 massive freezers lost power. The resulting heat destroyed 33 years worth of blood samples collected as part of a research project into adolescent heart disease."

The Composition of Crisis-Management Teams—From our survey, we found that there are six levels of participation on crisis-management teams. The heads of student affairs (at a 91 percent level of participation), facilities (88 percent), and public affairs (86 percent) were almost always on the crisis-management team. On level two, the chief financial officer was on the team 79 percent of the time, while the head of campus police served 74 percent of the time and the head of information technology 73 percent. At the third level, the head of security was present 69 percent of the time, the provost 68 percent, and legal counsel 66 percent.

At the fourth level, the president was on the team 64 percent of the time and the head of risk management 62 percent. The fifth level consisted solely of the head of operations, who was on the team only 49 percent of the time. Finally, the last and sixth level consisted solely of the director of athletics, who was only present on a team 26 percent of the time.

We were surprised to find that legal counsel was not represented more often, especially since almost all major crises eventually involve legal concerns. Also, this finding stands in sharp contrast to what has been found in the corporate world, where the chief financial officer and chief legal counsel are present on virtually all crisis-management teams.

We wanted to determine whether those institutions that were more proactive in dealing with crisis management were also more likely to have crisis-management teams that meet regularly. In our study, "proactivity" was measured simply by the number of crises an institution was prepared for minus the number it had experienced. Thus, the maximum proactive score was plus 14 and the minimum was minus 14. If the number was positive, an organization was classified as proactive; if it was negative, it was considered reactive. We found that the more proactive an institution, the more apt its crisis-management team was to meet whether a major crisis had occurred or not. The more proactive institutions were likely to meet once a month, in contrast to once a year or as needed for reactive organizations.

From our results, it would appear that the surveyed colleges and universities do not have crisis-management teams that are similar to those that have been developed in the corporate world. A crisis-management team that was true to its name would have all of the various parties on the team 100 percent of the time so that they would be trained to function as a cohesive unit no matter what crisis arose.

Degree of Support—In order to better understand the level of support that crisis-management programs receive, we also asked the provosts to indicate the "current degree of support" for each of the following eleven activities or programs at their institutions:

1. Athletics
2. Undergraduate education/teaching
3. Graduate education/teaching
4. Research
5. Fund raising/grants
6. Endowment
7. Institutional and departmental rankings
8. Facilities improvement
9. Crisis management/prevention
10. Good relations with trustees
11. Good relations with the community

The results of our survey show unequivocally that undergraduate education enjoys the highest degree of perceived financial, political, and institutional support among the surveyed institutions. In contrast, crisis management experiences the lowest, tied with institutional and departmental rankings. Analysis shows that these differences in rankings are statistically significant. In addition, further analyses reveal that the greater the support an institution has for crisis management, the greater is its preparation for all fourteen types of crises. Moreover, the greater the support an institution has for all programs across the board, the more that it conducts simulations for major crises and the more training it provides in crisis communications.

Developing a Crisis-Management Plan and Team—Major Recommendations

In summary, what we have learned from our review of corporate crisis-management programs, our survey of the current status of university crisis-management plans and procedures, and our understanding of how universities have reacted to major crises is that crisis management is often confused with emergency planning and/or planning for a physical disaster. So what colleges and universities currently call crisis-management teams are mainly emergency response teams -- the main function of which is to prepare for and to respond to natural disasters such as earthquakes and environmental crises such as toxic spills -- or business continuity teams -- which exist mainly to insure the continuity of the business functions and services of major organizations.

But crisis management is not thinking about a few isolated catastrophes; instead it is planning for a wide range of possible emergencies, and especially for their interaction, in a crisis portfolio. That portfolio should include a list of time bombs that the institution hears ticking, since the most effective way to deal with a crisis is to anticipate it by listening for those signals that often, in retrospect, are leading indicators of crises to come.

Further, institutions should convene a broad and multi-departmental crisis-management team and then ensure that it has the support of university leadership, including the trustees, the president, and the provost. Just as a battle is one of the worst places to form and train a military unit, crisis-management teams should not be formed and trained in an ad hoc manner but through regular meetings and a broad range of simulations. The actual capacity to evacuate a campus (or a city, as we recently learned from the experiences of New Orleans and Houston) is obviously not the same as listing steps in a plan.

Given the complex and volatile environment in which all institutions operate, crisis management needs to be given the strongest possible support. We believe that it must be viewed as a key element in the strategic governance of colleges and universities. In a proactive institution, all of the senior officers--including trustees, administrators, and faculty members-would be familiar with, and many would participate in, the institution's crisis-management program.

In the immediate aftermath of a crisis, communications are critical. Today, many universities rely on sophisticated technology for the internal and external communications. As we saw from Hurricanes Katrina and Rita and earthquakes in Southern California, communication capacity is often the first part of the infrastructure to fail, and backup communication strategies are critical. Being able to quickly reach decision-makers such as deans and department chairs and external stakeholders such as students and their families is critical in managing a crisis. This also means having a clear chain of command for critical decisions (such as whether a campus should be evacuated).

Institutions' crisis-management teams should begin their work by evaluating not only crises that have occurred on their own campuses but situations that had all the makings of, but for some reason did not evolve into, disasters in order to see what kept them from doing so. Second, they need to analyze crises that have occurred on other campuses. Our experiences show that the first reaction to anything that has happened on another campus is "This could never happen on our campus - we have a different situation." But further and honest evaluation often shows that in fact, many of the same factors are in place and the disaster could easily happen almost anywhere.

Crisis Management—An Institutional Imperative

Our work suggests, at best, a very mixed picture regarding crisis-management preparation in American colleges and universities. Colleges and universities have responded in varying ways, and sometimes successfully, to the multitude of crises that have confronted them. But the colleges and universities we surveyed are in the very early stages of establishing their crisis-management programs, and much remains to be done. We suggest that it be done immediately. The recent experience in New Orleans and elsewhere suggests that developing and maintaining a well-functioning crisis-management program is an operational imperative for college and university leaders.