Executive Summary
A perfect system does not exist, and breaches are expected occurrences. Company leaders must be ready for breaches and create a plan for their management well in advance. The case of SimplePay is a demonstration of the magnitude of damage that lack of crisis planning and management skills can do to an organization. A clear step-by-step crisis management plan is presented in this report for use in solving the root cause of the problem.
Statement of Immediate Problem(s)
Root Cause of Problem
The actual root cause of the issue is poor risk management. Jake is right that IT specialists cannot seal all the loopholes, so system breaches are expected occurrences. However, he did not focus his energy on developing a crisis plan strategy that sets out a clear management pathway for such kind of risk. SimplePay halted its operations for 42 hours (Seitjs, 2015) because of the lack of a risk management plan that would have enabled the company to sort out the issue immediately.
Other potential causes include lack of proper leadership, poor teamwork, or lack of synergy, which saw Jesse’s team working slowly, and, shifting the focus to the impending IPO to the detriment of internal systems.
Company’s Situational Analysis (SWOT)
Strengths
SimplePay’s strengths include a good reputation of reliability and security, positive brand image and positioning as the company was the industry leader (Seitjs, 2015), and a strong communication team headed by Michelle.
Weaknesses
The weaknesses include vulnerable systems exposed to security breaches, lack of brand loyalty, which usage of the app fell by 30% (Seitjs, 2015), and weaker strategies for managing risks.
Opportunities
SimplePay has opportunities in using the crisis to strengthen its systems, that is, examine and improve their response to similar issues in the future, and increase their market share after upgrading their systems.
Threats
It still faces threats like other forms of security breaches, some of the customers have lost trust in the company (Seitjs, 2015), which may be difficult to earn back, and competitors may seize the opportunity to discredit SimplePay and win over their disgruntled clients.
Four Management Functions
Planning
Planning would help avert rather than address the crisis. According to Soltanizadeh, Abdul Rasid, Mottaghi Golshan, and Wan Ismail (2016), enterprise risk management requires the identification of various events in the company that may predict the occurrence of adversity. Planning is then done with mechanisms put in place to adequately and efficiently manage the adverse situation. With proper planning, Jesse and his team would have brought the situation under control much earlier.
Organizing
Organizing a comprehensive PR team would have minimized the loss of trust witnessed among the customers. While Michelle did well just on her own (Seitjs, 2015), the company should have organized a strong and unified voice that brings all the management departments around her. That would have demonstrated to the clients that the entire company is serious about solving the problem, and cares about their security.
Leading
Leading entails taking charge of a situation. Jake, for instance, should not have waited to be forced to resign. That should have come naturally for a leader whose aim is to restore the company's trust among the customers. Leading would also assure the board of a better way forward instead of the resignation of a top executive to manage the situation.
Controlling
Controlling would mostly apply to communications. Controlling the information disseminated to the clients and the public would play a significant role in allaying their fears. Controlling the operations through effective management skills would also be instrumental in reducing the gravity of the crisis.
Action Plan
The first thing that must be done in such a case is to convene a risk management team in the shortest time possible. The board will play a primary role in picking a comprehensive team within the company that will be handling the risk management process in the background. The risk management plan consists of risk identification, assessment, response planning, monitoring, and control. After the select team has identified the risk, they will assess it and list its impacts based on gravity and the dangers it poses (Srinivas, 2019). An appropriate response follows the assessment. In the case of SimplePay, risk reduction involves a thorough review of the systems and their design to ensure that the potential of future occurrence is mitigated. Following all the steps in the plan is necessary because it will not only help in providing a solution to the current problem but also similar occurrences in the future. In this plan, the select team has to maintain open communication and knowledge creation (Cagliano, Grimaldi & Rafele, 2015) with other departments, consistently offer accurate and timely updates to the PR team, which will update the public on the progress. This strategy will give the company control of information, which is vital in debunking any myths that may compromise its reputation during this hard time. All the while, Jake should demonstrate transformational leadership and be at the forefront, facilitating approvals of any decision related to the risk management that may require high authority input. He should also ensure synergy where everyone is appropriately handling their tasks as this increases efficiency and reduces the time taken to get a solution.
In case any problems arise, a contingency plan involving the invitation of a team of experts should be in the offing. The primary concern and focus should be on the protection of clients’ data and securing the system. Adding a group of experts to help Jesse and his team would increase their chances of bringing the crisis under control sooner and efficiently. The contingency plan could have SimplePay incur extra financial costs, but their future depends on how effective they solve the current problem.