Incident Commanders serve a crucial role in protecting company operations, so clearly they should be drawn from senior management due to their authority and experience, right?


When I see clients whose pool of Incident Commanders is largely made up of senior managers, directors, and even vice presidents, I am simultaneously impressed with their commitment to incident response but worried about their results. Here’s why:

To begin with, on an entirely practical note, the people at that level of the org chart are usually the ones with the least availability to respond to incidents. They often have double- or triple-booked schedules, more mission-critical meetings, and more travel planned. Worse, many of their meetings and trips are with one another, reducing the pool of available Incident Commanders at any given time even further. Drawing Incident Commanders from a larger body of trained individual contributors and lower-level managers ensures that there are qualified Incident Commanders available when incidents occur.

Additionally, folks at the top of the org chart generally already have a full plate of critical work for the future of the business. If they’re not doing that work, the entire business suffers. As a result, many senior leaders will find it difficult to devote their full attention in the moment to resolving an incident. Less-senior people usually have more slack in their schedules, and more freedom to temporarily set aside whatever else they were working on and focus on the role of Incident Commander for a few hours; they may even already have “incident response” as an explicit part of their job description. 

Finally, when the bosses are the Incident Commanders, the whole incident response process can falter. Incidents may not be declared in the first place; no one wants to interrupt the Big Boss meeting with the Bigger Boss so that she can run an incident. Once an incident is in progress, the quality of the response can suffer. It’s more difficult to respond under pressure when you’re also under the eyes of the higher-ups. No one wants to make a high-profile mistake in a crunch situation in front of a person with impact on their careers. It’s also a challenge to push back against the boss, even if that’s needed to resolve a critical situation.

So what should senior management be doing for incident response?

For the duration of the incident, the Incident Commander is THE boss, regardless of that person’s everyday position in the org chart. During incidents, senior management should set the example of deferring to the Incident Commander and clearing access to whatever resources are needed. Senior management supports the Incident Commander (and incident response in general) during the incident by letting their teams get on with the job of responding, running interference with other departments to prevent interruptions, and putting the weight of their authority behind the Incident Commander.

In the larger picture, senior management has the task of ingraining incident response (including the role of the Incident Commander) into the culture of the business. Between incidents, senior managers need to ensure that incident management is getting the staffing, funding, training, visibility, and recognition required to succeed. It is their job to keep incident management a top priority due to its critical impact on the future of the business as a whole.

Everyone has an important role to play during an incident. The role of senior management is to let the Incident Commander be the boss.

Outages and other IT emergencies are expensive in many different ways, including lost sales, lost productivity, damaged reputation, and damaged morale. It’s essential to be prepared, and to learn from each incident so that you’re better prepared for next time. I can guide your organization to develop these critical incident management capabilities. Contact me to learn more, or to schedule a free tech talk on incident management for your team or organization.