CRISIS MANAGEMENT PLAN

CRISIS MANAGEMENT PLAN

Table of Contents Introduction... 3 Purpose... 3 Objectives... 3 Types & Levels of a Crisis... 4 Plan Activation... 6 Crisis Management Team (CMT) Structure... 6 CMT Responsibilities... 7 Communication Resources... 8 CMT Emergency Contact Information... 9 OPS/COM Emergency Contact Information... 9 Post- Incident Review... 9 Conclusion... 10 Appendix A: CMT Emergency Contact Information... 11 Appendix B: Organizing Committee Emergency Contact Information... 12 Specific Response Plans Product Recall/Withdraw... Active Shooter... Earthquake, etc.... Additional Topics (TBD) Version- 4/2013- Page 2

1. Introduction During a crisis, COMPANY requires processes that address the needs of emergency response operations and recovery management. To address such emergencies, the company has established this Crisis Management Plan, which includes roles and responsibilities of the Crisis Management Team (CMT), and guidelines for the immediate actions required in response to an emergency or disaster. COMPANY has an obligation to effectively manage any crisis that might affect the System. That includes situations that affect our customers, team members, property, and/or brand reputation. Disasters or emergencies can happen suddenly, creating a situation where normal operational and support services for COMPANY may become overwhelmed. This Crisis Management Plan can help guide and inform immediate actions and appropriate responses. In the event of a crisis, our top priority is the protection of lives. Additional priorities include the protection of assets, the community, and brand reputation. It is the CMT s responsibility to respond swiftly and effectively to emergencies as well as manage the restoration of business. 2. Purpose of the Plan This plan is intended to provide the management structure, key responsibilities, emergency assignments and general procedures to follow during and immediately after an emergency. COMPANY has established this plan to address the immediate requirements for a major disaster or emergency whereby the normal operations are interrupted. Measures must be taken to: Protect and preserve human life and well-being. Minimize loss, damage, or destruction to COMPANY facilities, resources and/or operations. Manage media communication and information regarding the response. Provide essential services and operations. Provide and analyze information to support decision-making and action plans. 3. Objectives The objectives of this Crisis Management Plan are as follows: Organization a. Provide clear and easy-to-follow checklists and guidelines for the most critical functions and liaisons during an emergency response. Version- 4/2013- Page 3

b. Provide an easy-to-follow design in which users can quickly determine their role, responsibilities and primary tasks. c. Link and coordinate actions, responses, and the exchange of critical information. The goal is to establish an efficient real-time communication system so that stakeholders are informed of the emergency response process, and also have access to the necessary information regarding a specific incident or crisis situation. Communication & Information Management a. Serve as foundation of communication for both the transmission and receipt of urgent information and messaging. b. Official point of contact for all damage reports when normal channels of communication are interrupted, with information collected and collated for notification, public information, documentation and post-incident analysis. c. Provide a basis for training departments and staff in emergency response management. Decision-Making a. Determine the response level and extent of an emergency utilizing a clear and consistent decision-making process. Response Operations a. Identify the necessary resources within COMPANY to deploy a comprehensive and efficient emergency management response team. b. Be prepared with a pro-active emergency response management action plan that provides the possibilities and eventualities of emerging incidents. Recovery Operations a. Transition response operations to normal management and operational processes, as the situation permits. b. Support business resumption plans and procedures, as needed, during restoration phase. c. Provide documentation and information to support any legal, regulatory, and vendor requirements for the incident. d. Perform post-incident critique in order to analyze steps taken and the results of the incident. 4. Types & Levels of a Crisis To provide focused and appropriate responses, incidents are assigned a level of Class I, Class II or Class III. FDA regulates recalls for food, equipment, packaging, drugs and medical devices for human and animal uses only. Version- 4/2013- Page 4

Class I (Major) Catastrophic Business Interruption: Death; Life-threatening or Serious Injury; FDA- Required Recall; High Probability for Illness or Media Exposure; Major Loss of Assets On-site shooting or workplace violence that results in harm, hostage(s), a bomb threat, and/or death Natural disaster with serious injury and/or death; may result in store closure Product contamination resulting in, or has the potential to cause, serious injury, death, or hospitalization Requires immediate cross-functional support and direct intervention Class II (Moderate) Non-Life Threatening Health or Safety Concerns: Harm; Personal Injury Requiring Medical Attention (such as with food safety, injury, illness); Store Notice by Health Department, Government Agency or Supplier; Minor Loss of Assets Burglary or robbery with injury to team member or customer Hepatitis A, meningitis, tuberculosis, bacteria allegation Raw sewage flood in store Natural disaster with minor injuries, damage; may require external aid Product contamination complaint involving illness or injury allegation, which may or may not involve an FDA recall Social media or security breach that impacts our customers Extortion threats to the company Involvement with external parties such as the police, medical professionals, and/or fire department Requires cross-functional support to resolve and/or address with appropriate urgency Class III (Minor) No Potential Threat to Life or Health: Public Relations Issues, Possible Brand Reputation or Impact; May Impact Some Company Assets Burglary, robbery with no injury, sexual harassment allegation in the media Natural disaster with no injuries or breakage (only store closures) Product Withdraw (no customer complaint) for quality or minor issue Version- 4/2013- Page 5

Social media, investor relations (delisting of the stock) or activism/protesting Security breach with brand or internal ramifications; computer virus/hacking Involves limited cross-functional interaction. Note: A Crisis may be assessed at any level and based on investigation and may be reclassified. Example: A team member diagnosed with a reportable illness such as tuberculosis may start as a Class I crisis; but if there is no exposure to others that results in illness, this may be reclassified as Class III. Conversely, a Class III crisis, such as an equipment fire in the store, may be reclassified as Class I after a team member is seriously burned. 5. Plan Activation This plan is to be activated whenever emergency conditions exist that prevent normal operations and immediate action is needed to: Save and protect lives Coordinate communications Prevent damage to the company, systems, and property Provide essential services Temporarily assign staff to perform emergency work Invoke emergency authorization to pick your and allocate resources Activate and staff the emergency operations center 6. Crisis Management Team (CMT) Structure Departments that comprise the CMT: Risk Management Corporate Communications Legal Human Resources Internal Communications System Field Leaders o Company- Regional Directors o Franchise Regional Franchise Leaders Quality Assurance Supply Chain Version- 4/2013- Page 6

Finance Facilities 7. CMT Responsibilities If a crisis is declared, the CMT provides support services to facilitate the recovery. Primary responsibilities are as follows: Human Resources should address the people side of the issue. Corporate communications shapes the message to the public and shareholders at large. Legal assists with insurance negotiations and potential litigation. Operations must work to ensure execution with the stores system-wide. Team members must focus on their functional specialties. Additional roles and responsibilities can be found below. Roles & Responsibilities Risk Management Activates and leads the crisis management team throughout the recovery process. Drives the recovery to a prompt conclusion. Corporate Communications Coordinates communications with shareholders, the public and the customer. Responsible for delivering external communications throughout the recovery process. Provides updates to Executive Leadership. Internal Communications Responsible for delivering internal communications throughout the recovery process. Legal Responsible for assisting with legal issues that may arise as result of the incident. Human Resources Responsible for notifying families of any injury or loss. Responsible for assisting with payroll issues resulting from the incident. Organize Medical actions, Benefit information and/or Employee Assistance Counseling that is needed. Quality Assurance Responsible for leading and guiding company through the Product Recall process. Interfaces with FDA and other regulatory agencies concerning Product Recall and Health Department issues. Supply Chain/Purchasing Responsible for information on product. Works with Suppliers to facilitate Recalls and Withdrawals. Supply Chain/ Distribution Responsible for communication and action with the distribution centers. Facilities Responsible for the coordination of damage assessment, salvaging and restoration activities. Version- 4/2013- Page 7

System Field Leaders Responsible for collecting initial information about the issue if it originated in the Field. Responsible for driving execution of tasks in system-wide stores to promptly close issue and resume normal business operations. Finance Provides financial guidance and analysis to issues related to the incident. 8. Communication Resources a. Conference Call Phone Number this number should be used for any CMT meetings. Emergency Operations Center (EOC) designate a room (i.e., Conference Room) to be reserved and blocked off during any Class I and II Crisis. b. Company Incident Report Hotline System-wide communication service for stores to notify business partners of an incident or potential incident. List number here c. Company Business Emergency Line this will provide one-way communication to those team members who have been affected by a major crisis. The business emergency line is only for external communication and will not accept incoming messages. The business emergency line will only be activated in certain types of Class I crises. List number here d. Company Media Hotline this phone number should be used to submit to any media inquiries on the company. List number here Version- 4/2013- Page 8

9. CMT Emergency Contact Information Crisis Management Plan The emergency contact information for members of the Crisis Management Team (CMT) is located in Appendix A. Please reference this list for the most up-to-date names, phone numbers, and additional contact information. Note: This information will be reviewed quarterly and updated as needed. 10. Operating Committee Emergency Contact information The emergency contact information for members of the Operating Committee is located in Appendix B. Please reference this list for the most up-to-date names, phone numbers, and any additional contact information. Note: This information will be reviewed quarterly and updated as needed. 11. Post-Incident Review After the Incident: Upon closure of all incidents requiring the support of the CMT, a Post- Incident Review should be performed. The Post-Incident Review is an evaluation of the response to an incident. It is intended to identify weaknesses as well as identify the strengths within the organization that will serve to reinforce policies and programs in the future. This review should be completed within 72 hours of the closure. Format to be used for the Post-Incident Review: I. Pre-Incident Preparedness a. What tools or training was provided prior to incident occurring? Which were the most effective? b. What additional resources are needed to prevent incident from occurring in the future? II. Incident Management a. How was the CMT notified? b. How long did it take for CMT to receive complete information about the incident? Version- 4/2013- Page 9

III. c. What actions and/or steps were assigned to affected parties? d. Were external tools or resources needed to complete execution or recovery? e. How long did it take to receive 100% compliance on assigned tasks? f. Did the CMT have enough internal resources to complete execution in expected time frame? Recovery a. What was the financial impact of the incident? i. Loss to the company ii. Additional labor used iii. Additional costs for resources to complete execution. b. Any consumer/customer impacts noted? c. Any impact to Team Members? d. Any additional policy or procedural changes need to be adopted as a result of the incident? 12. Conclusion Transitioning to Individual Response Plans This Crisis Management Plan identifies the roles and responsibilities of the CMT during any and all incidents and crises. It is intended to help guide and inform immediate actions and responses in a timely and effective manner. The associated guidelines, resources and protocol should remain consistent. However, after a specific incident or crisis has been further identified (e.g., a natural disaster, health concern or workplace violence), employees should reference the detailed documentation provided for that particular event. These detailed response plans, guides and check lists can be found in the appendix of this plan. In the Appendix you will find detailed response plans for the following: Product Recall Workplace Violence Earthquakes Hurricanes, etc. Version- 4/2013- Page 10

APPENDIX A Crisis Management Team Emergency Contact Information Note: This information will be reviewed for accuracy every quarter and updated as needed. Name Phone Number 2nd Phone Number APPENDIX B Operating Committee Emergency Contact information Note: This information will be reviewed for accuracy every quarter and updated as needed. Name Phone Number 2nd Phone Number Version- 4/2013- Page 11