Crisis Management: Key Questions
We live in a world full of high-stakes, high-profile corporate crises – environmental disasters, product liability issues, data breaches and government investigations, to name a few. No company is immune. Therefore, advance planning and preparation is the first key step toward weathering the crisis storm. In this Conversations on Governance, we pose some key questions regarding crisis management, with the hope that these questions might stir some crisis-related conversations among public company directors and executives.
1. What do you mean by crisis?
- Any situation that:
- Poses a threat to health and safety of employees, customers or the public; o Puts material business operations at risk;
- Creates significant financial, legal or regulatory risk; or o Adversely affects or threatens reputation or goodwill.
2. What are some types of crises that might occur?
- Negative press that threatens reputation
- Government investigations – Congressional, Department of Justice, State AGs
- High-profile lawsuits or other legal disputes
- Natural disasters
- Terrorist attacks
- Cyber attacks – data breaches
- Workplace accidents or violence
- Sensitive corporate transaction or financial problem
3. What should management be doing to prevent and prepare for a crisis?
· No business is immune from a crisis – preparation and planning are key.
- A crisis can be abrupt, e.g., a terrorist attack, but frequently has warning signs.
- The challenge is to recognize and address these signs.
- Be vigilant. It is easy for a company to become complacent.
- Periodically identify, assess, and mitigate potential threats and risks.
- Confirm and monitor best practices for prevention/compliance.
- Adopt protocols for situations thought to pose the greatest risks.
- Recognize that crises can brew in business unit silos. We have seen business units make matters worse by circling the wagons in an effort to contain a problem.
- Treat communications about potential issues that could erupt into a crisis sensitively, ideally with legal involvement.
- Recognize the need for a Crisis Management Plan, and establish an ongoing Crisis Management Team responsible for developing and implementing strategy, coordination, and communication to respond to a crisis.
4. Can you really plan for a crisis?
· Yes; companies that do plan can enhance their ability to manage a crisis effectively.
- You can’t identify the exact nature of a potential crisis, but to ensure effective response, management must be prepared to act quickly, on numerous fronts, and in a highly stressful environment.
- It is possible to identify areas of critical risk and to develop systems, approaches, and teams to respond to a crisis.
- In our experience, companies that follow this course can greatly enhance their ability to manage effectively through a crisis.
- The goal is to have in place consistent corporate guidance on how to respond to whatever crisis may arise.
- If you don’t plan for it, it will be too late by the time you get organized.
5. What scenarios should management be planning for?
- Focus on scenarios of greatest concern in preparing a plan. Keep the list of potential crises tight and focused around areas of critical importance to the organization.
- Identify threats and risks. Consider both probability and potential impact: o Highest probability scenarios
- Lower probability but high-consequence scenarios
- You want guiding principles in place, but flexibility to respond to each individual crisis.
6. What is the Board’s role in crisis management?
- Before the crisis:
- Ensure management has a robust enterprise risk management system in place to evaluate and mitigate the risks that could otherwise lead to a full-blown crisis.
- Build a Board that is prepared for a crisis: committed and available; diverse viewpoints and capabilities; collegial and deliberative in high-pressure situations.
- Ensure that management is devoting appropriate time and resources to crisis planning; receive periodic updates.
- During the crisis
- Determine the scope of the Board’s involvement – this will depend on the severity of the crisis and whether the crisis potentially implicates one or more members of senior management who would otherwise be responding to the crisis.
- Communicate with management – should strike a balance between the need to stay adequately informed and provide advice and support to management, on the one hand, and the need to avoid distracting management, on the other hand.
- Focus on the big picture – ensure management has the resources needed to respond to the crisis, and don’t lose sight of the long-term interests of the organization.
- After the crisis:
- Evaluate senior management’s response – was the crisis plan adequate and did management implement it effectively?
- Evaluate the board’s response – did the board have the right skill set to oversee the crisis response and was the board too much or too little involved?
7. What is the role of the CEO, specifically in reputation management?
- The magnitude of the crisis will determine the level of engagement by a CEO. If the situation is symbolically or substantively significant, the CEO is the logical face for the organization.
8. How should management assemble a crisis management team?
- Build a core team of experts with defined roles, who are familiar with each other and understand their respective responsibilities.
- Senior management
- Various business functions o Legal
- Risk management o Communications o Government affairs o Compliance
- Finance
- Business continuity o IT
- Security
- Human resources
- Environmental, health & safety o Other subject matter experts
- Identify outside consultants, counsel, PR professionals, vendors, and other sources who may be called upon to assist should a crisis arise.
- Have designated responsibilities and reporting processes.
- The response to each crisis event should be led by an empowered executive.
- Our experience has been that the General Counsel or other law department representative often is an appropriate leader for the Crisis Management Team.
9. What elements should be addressed in a crisis management plan?
- You will have to address both the operational response to the crisis and the communications issues simultaneously when the crisis hits.
- Address:
- Intake/activation
- Decision-making authority, chain of command
- Process – protocols, standard operating procedures
- Communication and information management - provide for regular and backup methods of communication
- Response operations o Recovery operations
- Post-crisis evaluation, including root cause analysis, corrective action and lessons learned
- Developing a coordinated strategy for resolution of potential litigation, regulatory, and other disputes or investigations
- Check for existing policies, protocols or procedures and harmonize them. Such protocols have often been developed on an isolated basis, but have not been coordinated with a corporate-level crisis management directive.
- Plan for spokesperson training
- Run drills or simulations to test the plan
10. What are the objectives in crisis communications?
- Accuracy – above all else, know the facts
- Timeliness – be visible and transparent
- Consistency – speak with one voice
11. Which stakeholders need to be addressed?
- An effective crisis plan should identify potential stakeholders and audiences who may need to be contacted, and assign responsibility for contacting them:
- Emergency responders o Government regulators o Board of Directors
- Employees o Customers
- Suppliers
- Local and national media, and social media o Key politicians and elected officials
- Trade associations o Insurers
- Investors o Bankers
- Financial analysts
12. What are the key issues about crisis communications?
· The CEO and Board should be on board with the Crisis Management Plan.
- Understand that the most common problems are missteps and misstatements in the first hours and days of a crisis.
- A crisis is a difficult time to make friends. Potential third-party allies should be identified and engaged in advance of a crisis.
- Establish key relationships in advance:
- External – emergency responders, supply chain, government regulators, elected representatives, industry associations
- Internal – vertical and horizontal, engage with key support functions
- The identification – and intense training – of company spokespeople should happen in advance of a crisis.
- In a crisis, every audience reexamines what they believe about an organization. If the crisis is handled well, it can reinforce the positive views audiences have prior to the crisis.
- Internal communications are often short-changed in a crisis. The opposite should happen. Maintaining the confidence and respect of internal audiences is a core objective.
13. What is the impact of social media?
- News travels at lightning speed through cable news and social media, broadening the commentary and amplifying the intensity of a corporate crisis. Rumors and inaccuracies take hold faster.
- A company dealing with a crisis cannot avoid social media. It is the initial source of information for most mainstream reporters.
- Any attempt at messaging about a crisis through social media should be approached with caution. Any poorly or ambiguously drafted message points could be turned against the company in litigation, regulatory or political challenges.
14. Are there ethical dilemmas that arise dealing with crisis communications?
- There is a natural tendency to want to control the story, and especially for lawyers to want to say as little as possible. The reputation and business of the company typically benefits from transparency. Don’t try to cover up bad facts, but put them in context when possible. Don’t prolong the story.
- Be cautious about implicating specific individuals, which could generate additional problems.
- Deal with people honestly and forthrightly.
- It’s okay to say you don’t know, but the story will be developing momentum and it is critical to confirm facts as soon as possible.
15. When the crisis hits, what should be the response?
- Effective communication as contemplated by the Crisis Management Plan: o Speak with one voice
- Be accurate, consistent, and timely
- Avoid premature statements that could create confusion, have liability implications, or reduce insurance coverage
- Internal response
- If appropriate, conduct privileged investigation of incident/matter, guided by counsel o Securely store and retain all relevant data and documents
- External response
- To government (DOJ, FDA, Congress, state officials/regulators, etc.) o Contractual commitments
- Legal notification requirements, including insurers
16. What are the objectives for recovering from the crisis?
- Root cause correction/mitigation
- Restoration as required – physical assets, business, reputation
- Dispute resolution – internal investigations, government investigations (regulatory, Congress, States), commercial disputes, litigation, arbitration
- Insurance – coordinate proof of loss with root-cause investigation, evaluate jurisdictional issues affecting coverage for contested claims/other litigation
- Analyze and incorporate lessons learned – strengthen the company; prevent recurrence; improve response to the next crisis.
