Crisis plan

Responsible unit: Property Management Office

(The document was reviewed in 2024 and will be revised in the second half of 2024.)

1. Purpose

This crisis plan aims, in accordance with the Regulation (2022:524) on the preparedness of government agencies, to reduce societal vulnerabilities and to develop the capacity of Stockholm University to effectively manage its responsibilities during peacetime crisis situations, as well as in periods of heightened alert. The crisis plan delineates a coherent and explicit central crisis management structure and outlines procedures for responding to serious incidents. The objective of the crisis plan is, through training, exercises, and the establishment of appropriate organisational structures both before, during, and after a crisis, to prevent, withstand, and manage crisis situations that may arise within the University’s operations.

Crisis planning should prioritise the following:

• The swift establishment of unified leadership with a clear division of responsibilities
• Coordination with relevant stakeholders at both central and local levels within Stockholm University.
• Effective management of media relations and communication with staff, students, relatives, and the public
• The prevention of rumour dissemination.

The objectives of crisis management are to:

• Attain a comprehensive understanding of the incident
• coordinate resources at Stockholm University,
• Assist in controlling the progression of the incident
• Minimise damage and consequences
• Maintain public trust in Stockholm University
• Ensure that other operations can resume as quickly as possible

2. Definition of crisis

A crisis is a serious event that threatens fundamental functions and is characterised by the fulfilment of the following three criteria:

• The event is unexpected and deviates from the normal.
• The incident requires immediate action.
• The event causes a significant disruption or poses an imminent risk of a significant disruption to key operational functions and necessitates urgent intervention by management. (Society's Crisis Preparedness - Strengthened Cooperation for Increased Security, Government Communication 2009/10:124, p. 8

What distinguishes crises from other events is their large scale, and the fact that the progression of the event is often rapid, difficult to assess, and demands swift decision-making. Most events, even if disruptive and sudden, should not be regarded as crisis situations to be managed by the central crisis management group. These events can be handled within the ordinary organisational structure and by personnel in their regular roles

However, it is not possible to define in advance the exact threshold or which situations should be considered serious crises. This must be determined based on a comprehensive assessment of each individual case.

Some examples of crises:

• serious accidents or incidents involving multiple injuries,
• deaths,
• events with environmental and/or health hazards (such as fires, chemicals, gases, radiation sources, microbiological agents),
• data breaches with the potential for serious disruption, or
• events that may cause reputational damage

Crisis management principles

Swedish crisis management is based on three principles – the principle of responsibility, the principle of similarity and the principle of proximity. The principles clarify responsibilities and roles before, during and after a crisis. (Common Framework for Cooperation and Leadership during Societal Disruptions, p. 24, 2018, The Swedish Civil Contingencies Agency (MSB))

The principle of responsibility

The foundation of Swedish crisis management is the principle of responsibility. This means that the entity responsible for an activity during normal conditions generally retains that responsibility during a crisis. For example, the head of department holds responsibility for staff on a daily basis – this responsibility remains during a crisis. The responsibility also includes ensuring that the different parts of the organisation and other key stakeholders cooperate to effectively manage the event.

Similarity principle

During a crisis, operations should, as far as possible, continue to function in a manner similar to everyday conditions. This is referred to as the Similarity Principle. Where feasible, operations should also be conducted in the same locations as usual.

Proximity principle

The Proximity Principle dictates that a crisis should primarily be managed at the location where it occurs, and by those who are directly affected and responsible for the operations. While the central crisis management group holds overall responsibility, the university’s departments, or equivalent units, are expected to manage crises arising within their own operations to the greatest extent possible. In situations involving multiple parts of the university, or where the crisis is too extensive for the department or unit to manage, the central crisis organisation of the university may coordinate the crisis response.

3.1. Central crisis management structure

The crisis management structure at Stockholm University clarifies responsibilities and tasks at both the central and local levels in order to prevent duplication of efforts and misunderstandings. As Head of Agency, the President holds ultimate responsibility for operations. In the event of a serious incident, the President will inform the board and the relevant government department as necessary.

The university has both a central crisis management group and local crisis management groups (see section 3.4), to ensure that decisions are made at the appropriate level. The central crisis management group is convened by the University Director or their deputy. Local crisis management is handled within the regular line organisation and convened by the head of department, division head, or equivalent.

3.1.1. Central crisis management group

In the event of a crisis, the University Director, after consultation with the President and, if necessary, other members of the university's executive leadership, convenes the central crisis management group by forming a crisis staff. The University Director oversees the work of the staff members within the crisis management group and makes decisions in response to the unfolding events. The University Director is also responsible for keeping the President informed about the development of the crisis, its management, and any decisions made by the crisis management group.

In the case of a serious incident, the crisis communications group is also activated, and if necessary, a crisis support group as well. Both of these working groups report to the central crisis management group.

The central crisis management group shall consist of staff with the necessary expertise to provide a comprehensive perspective on the organisation and its external environment. The group is assembled based on the incident that has occurred and the assessment made regarding which parts of the organisation are primarily affected. The following staff functions are always included in the central crisis management group:

• University Director (Chief of Staff),
• Director of Human Resources (handles personnel matters),
• Head of Security (handles security matters),
• Head of Communications (manages internal and external communications), and
• Minute-taker from the Management Secretariat

In addition to the above-listed functions, other functions and representatives deemed appropriate by the University Director may be co-opted into the central crisis management group. In crises that affect students, student representation shall be included in the crisis management group. During major crises, a staff administrator is also activated to support the minute-taker. To ensure that the group can always be activated and to provide relief during extended crises, there must be at least one deputy for each member of the crisis management group.

3.1.2. Crisis communication group

The crisis communications group is tasked with the following responsibilities:

• Develop a communications plan, which includes:
  1. Providing recommendations to the crisis management group regarding internal and external communication measures,
  2. Executing and coordinating internal and external communication measures as instructed by the crisis management group,
• Monitoring the portrayal of the crisis in traditional and social media,
• Receiving incoming media inquiries regarding the crisis,
• Collaborating with the crisis support group, operational leaders at the affected faculty/department/unit, and the communications lead at the relevant external agency,
• Keeping the switchboard and the President's assistant informed to ensure the prompt handling of inquiries.
• Keeping the central crisis management group informed about communication activities and the media's portrayal of the crisis.
  

3.1.3. Crisis support group

The requirement for first aid and crisis support is regulated by the Swedish Work Environment Authority's provisions (AFS 1999:7), which clarify the employer's responsibility to provide crisis support to employees in the event of a serious incident.

The crisis support group is an operational working group whose purpose is to coordinate support for the organisation's managers in crisis situations involving staff and students during the acute and initial stages of crisis management. The working group reports to the Head of the Human Resources Office and can be reinforced with expertise from the Student Services and the security organisation as needed, as well as other units within the central administration if required. External specialist expertise may also be brought in if necessary. Occupational health services may be engaged, where applicable, for emergency crisis management or other forms of support. However, the crisis support group is not responsible for addressing the need for general medical care arising from a serious incident.

The Head of the Human Resources Office is responsible for appointing members to the group. The operational work of the crisis support group is coordinated by a personnel specialist from the Human Resources Office.

The crisis support group is tasked with the following responsibilities:

• Collaborating with the municipality’s crisis support coordination in the event of major accidents or disasters, if required,
• Acting to mitigate acute situations and thereby prevent mental health issues,
• Collaborating directly with external public services, such as the police and fire department, on the instructions of the crisis management group,
• Contacting affected family members, if necessary, and
• Keeping the central crisis management group informed of activities carried out.

3.1.4 Local crisis management

In accordance with the principle of proximity, a crisis situation should primarily be managed within the affected department, division, or equivalent. Consequently, each department, division, or equivalent must have a local crisis management group with fundamental and up-to-date knowledge of crisis management in line with Stockholm University's crisis plan.

This also means that each department/equivalent is responsible for establishing a continuity plan, an action plan for managing various crisis situations that may arise within their operations. The continuity plan should be implemented within the department and include phone lists, contact persons for different incidents, and checklists.

To standardise crisis management across Stockholm University, local crisis management groups, where appropriate, can use the templates developed for the central crisis management group and assign the following roles within the local crisis management group:

• Chief of Staff,
• Operational leadership,
• Head of Security,
• Head of Communications, and
• Minute-taker.

The Head of Department or equivalent is responsible for the direction and leadership of the local crisis management until the University Director decides that the central crisis management group will take over part or all of the crisis management. The Head of Department or equivalent is also responsible for contacting the central communications department before making any public statements regarding crisis management.

3.2 Officer on standby (TiB), communicator on standby (KiB) and alarm chain

To effectively manage serious incidents and ensure clarity in roles and responsibilities during a crisis, Stockholm University has established the roles of Duty Officer (TiB) and Duty Communicator (KiB). TiB and KiB are staff members from the Security Organisation within the Property Department and the Communications Office, respectively. They possess the knowledge and responsibility to detect, verify, alert, and inform in the event of incidents that may escalate into serious crises. In addition to these readiness functions, security guards are present on campus around the clock.

The security guards often form the first line in an alarm chain during physical incidents, as they are responsible for detecting and reporting anomalies to TiB. Serious incidents can also be detected by KiB through media monitoring. Both TiB and KiB are responsible for reporting anomalies and serious incidents that may develop into a crisis to the on-call managers (back-office), who, in turn, can assess, make decisions on how to handle the situation, and, if necessary, inform the University Director about the serious incident, as well as propose convening the crisis management group.

4. Guidance, checklists, and role cards

Guidance, checklists, and role cards serve as support in managing serious incidents and crises, as well as the subsequent crisis management work. Guidance, checklists, and role cards are available online. They define various areas of responsibility within the organisation and are divided into central, local, and administrative units with specific responsibilities in the event of a crisis.

The central lists include:

• Role cards for members of the crisis management group,
• Guidance on crisis management methodology,
• Agenda for initial and staff meetings,
• Template for continuity planning,
• Template for minute-taking,
• Support for managing general scenarios,
• Support for managing serious accidents, and
• Support for managing fatalities.

The above-listed documents can also be used by local crisis management teams if deemed helpful. In addition to these, a number of predefined checklists are available to provide support in the implementation and practice of crisis management:

• Procedure when a student is fatally injured or severely harmed,
• Support for managing threats via social media, telephone threats, and bomb threats,
• Support for managing serious accidents,
• Support for managing fatalities, and
• Support for managing personal crises.

It may also be necessary for the department or equivalent to have local checklists based on identified risks within its own operations, as well as role cards for positions in the local crisis management team that are not present in the central crisis management team.

The Communications Office, Human Resources Office, Property Management Office, and IT Services constitute administrative units with specific responsibilities. These administrative offices, in cooperation with one another, are required to establish the guidance and checklists necessary to fulfil their respective duties.

5. Training, drills and evaluation

An essential requirement for effective crisis management is that the crisis management group has the appropriate training and has practised crisis management in advance. The effectiveness of handling an incident depends on the extent to which the members of the crisis management group know and trust each other, understand their own and others' roles and mandates, and share a common language. Training and practice are the best ways to increase mutual understanding and establish the most effective forms of collaboration.

5.1 Training

• Central crisis management group: The Security Organisation within the Property Department is responsible for ensuring that the central crisis management group is knowledgeable in crisis work and familiar with how crisis management at the university functions.
• Department, division, or equivalent: The Head of Department, or equivalent, is responsible for ensuring that the members of the local crisis management group have basic knowledge of crisis work and understand how crisis management at the university functions. The Security Organisation within the Property Management Office is responsible for making available guidance on crisis management methodology and general checklists. Training in crisis management methodology and the use of support systems for crisis management is provided through the Property Management Office. The University Director decides on any major targeted training initiatives.

5.2 Drills

• Central crisis management group: The central crisis management group must hold planned meetings at least twice per calendar year. During these meetings, exercises are conducted with the central crisis management group in the form of desktop or scenario exercises. The Security Organisation within the Property Management Office is responsible for implementation after consultation with the University Director.
• Department, division, or equivalent: The crisis management group at a department, division, or equivalent must conduct a local crisis management drill at least once per calendar year. The Head of Department, or equivalent, determines the scope/scenario and timing. The exercise must be documented and reported to the Security Organisation for compilation and possible follow-up.

5.3 Deactivation

When a serious incident is deemed to be manageable within the scope of regular line operations, the University Director must decide to deactivate the central crisis management group.

Upon returning to the regular line organisation, the following points must be considered:

• Deactivation should occur gradually. It is important to maintain the ability for ongoing crisis communication.
• Documentation related to the management of the incident must be completed and organised to facilitate follow-up. Event logs, minutes, decisions, and any documentation from cooperation with external actors must be registered and archived.
• The Head of Security is responsible for evaluating the crisis management when the central crisis management group has been activated.
• The Head of Security is responsible for ensuring that the results of the evaluations are considered in future revisions of the university’s crisis management plans and procedures.

5.4 Evaluation

After an incident that has necessitated crisis management, the evaluation process should begin as soon as possible after operations have returned to normal. Following central crisis management, the University Director appoints the individuals responsible for conducting the evaluation. After local crisis management, the Head of Department, or equivalent, appoints the individuals within the local operation who will carry out the evaluation.

During the evaluation process, all materials in the form of logs and notes must be collected and catalogued. If the crisis management support system was used, the log from the system should be retrieved. All staff involved should be given the opportunity to provide feedback on areas for improvement and potential development measures. Where relevant, the opinions of collaborating authorities and organisations on the work carried out should also be gathered. Based on the collected data, an analysis of the work is conducted, with any proposals for revisions to the organisation and plans.

6. Follow-up

Follow-up on the crisis management work is conducted regularly during the central crisis management group’s meetings and during risk and vulnerability analyses in accordance with the Government Agencies Preparedness Regulation (2022:524) and risk analysis in line with the Government Agencies Risk Management Regulation (1995:1300).

7. Miscellaneous

7.1 GDPR in Crisis Management

When compiling staff lists, the employment contract regulates the personal data that the authority is permitted to handle under GDPR, which includes information such as place of residence. However, this does not apply to the compilation of next-of-kin lists. Employees have the right to refuse consent for their next-of-kin’s personal data to be submitted to the authority. The university must inform employees of the voluntary nature of providing this information and at the same time highlight that refusal to provide the information means that the employer will not be able to contact next-of-kin in the event of a crisis or serious incident.

Governing documents in pdf