The role of corporate legal departments before and during a crisis
For any company, a crisis situation can come in many forms, including major litigation, data breach, government investigation, criminal indictment, environmental catastrophe, social media “meltdown,” product recalls, death of the CEO, campus intrusion, FCPA claims, just to name a few.
How the company responds to a crisis will go a long way to prevent or limit damage caused by the crisis. In-house counsel play a key role in planning for and managing these risks. This article discusses some of the basics to help in-house lawyers in a crisis situation (both before there is one and if one occurs).
AI news and insights
Industry-leading insights, updates, and all things AI @ Thomson Reuters
Join community ↗Pre-crisis
One challenge in the area of crisis planning is to get the business to understand that bad things don’t always happen to the “other guys.” In-house counsel should discuss with the CEO, CFO, and others what plans, if any, the company has in place in the event of a crisis (and how to go about updating or implementing those plans in a repeatable and systematic manner). If necessary, you can easily find very public examples of crisis situations that went badly and use them to stress the importance of having a plan.
If the company has no such plans, then it’s time to take the lead and start to create them. While you cannot plan for everything you should be able to think through and prepare for the most likely five to ten situations that would – given your business – present a crisis to your company.
The first step is to create a cross-company team (finance, tax, human resources, internal audit, legal, system security, business unit, heads, etc.) to flesh out the risk scenarios. A broad cross-section of the company will give insight into the risks you should be most concerned about. This will enable the team to prioritize the most likely crisis situations and put together the right plans to deal with them. Your job as in-house counsel is to help ensure the process of crisis planning gets underway and stays on track.
The next step is to prepare a written plan. You can have one overarching plan that contains sections dealing with different types of crisis situations, or separate plans for each type of crisis. Part of this effort may be gathering crisis plans that already exist in different parts of the organization and bringing them into one document whose purpose is to give the leadership team step-by-step guidance as to what to do in the event of a crisis.
Here is a non-exhaustive list of things you will need to cover in your plan:
- Clear definition of roles and responsibilities.
- A process to triage the crisis, i.e., how serious and widespread the problem is, including impacts on customers and other parties, litigation risk, what facts are known, and what needs to be determined.
- Where to meet (including an off-campus location in the event you are not able to meet at your headquarters).
- How people will be notified of a crisis situation, e-mail, phone call, etc.
- Crisis bridge line number and instructions (including how to dial in from foreign countries).
- Who needs to participate (including primary backups in the event someone is not available). Your crisis team will likely consist of the CEO, CFO, General Counsel, COO, Chief Compliance Officer, HR, Corporate Communications, Marketing, Investor Relations, and Internal Audit. Likewise, the heads of the various business units should be part of the team.
- Who is in charge of any particular type of crisis, depending on the issue it may be the general counsel, human resources, CFO, etc. It is not a good idea to have the CEO be in charge of the crisis team. While he or she will be part of the team and may have a key role in communications, the nitty-gritty details of operating the crisis team day-to-day should rest with someone else.
- Contact information for internal people, including alternative phone numbers and alternative email addresses should the company’s e-mail server go down.
- Contact information for external people including the board of directors and any outside resources you may need including outside counsel, media relations, security, police/FBI, etc. As in-house counsel, you will want to think about who you would call in the event of a particular crisis. It may be a different lawyer for a data breach vs. a litigation crisis. Make sure you have multiple contact numbers for them and have a backup person you can contact. Let your outside counsel know they have been identified by you as someone to help in the event a crisis hits.
- Communications plan for dealing with external media, social media, employees, investor relations, board of directors, and regulators, as well as who is in charge of developing the messaging and making contact with each group. While you cannot develop the exact messaging language in advance of the crisis, you can develop standard templates (format, language, etc.) that will save time.
- A clear process and timeline to develop and distribute communications, updates to the team, and other documents. Concerning outside communications, it will be very important to set out in detail how communications get approved as you can lose valuable time if it’s not clear who needs to “sign off” on something before it goes out.
- Where the plan is stored and how it is accessed, and who is the “keeper” of the plan.
- A process to update the plan regularly. Do a health check on the crisis plan at least annually and, ideally, twice a year. Be sure to get a broad set of viewpoints about risks the company faces, in particular, if you have new executives joining the company or your business has expanded into new areas.
Once you have your plan in place, create “tabletop” exercises to practice different scenarios over the course of the year. You can eliminate a lot of the uncertainty and confusion that come with a crisis by running through a training exercise so people know what to do and what to expect. This is an area where you may want to invest money in having a third party help you with developing and running the exercises.
Communication, both internal and external, is a key element of a crisis response plan. You and your executive team may be called upon to speak publicly, via a newspaper, trade magazine, television, or any other medium. Many companies provide basic media training to their executives. If your company does not, you should raise the issue in terms of at least considering it.
 |
During a crisis
When the crisis hits the most important thing you can do as in-house counsel is to stay calm. Many in the business will take their cues from you. Even if your stomach is churning with worry, you will need to be a rock and bring perspective to the situation. If you’ve done the right type of planning, you will already know what to do, who to call, and what to say. You need to set the tone and keep people focused on the task at hand.
Second, trust the plan you’ve put into place and follow it. The first meetings and responses regarding a crisis should track what you already have down in writing. This is especially true when it comes to media and other communications. You need to speak with one voice and stay on message. The company will be bombarded with questions about the crisis (from both outside and inside the company). The worst thing that can happen is for someone to free-lance a response or speculate without knowledge of the facts. Make sure the board of directors is properly updated. If your company is publicly traded you will need to be on top of any necessary 8K filings.
In a serious crisis situation, you will need outside help. It can be in the form of experienced outside counsel, a public relations team, or other experts. You should have these resources identified in advance and have their phone numbers on speed dial. Moreover, it will be important to ensure that parts of your investigation are appropriately protected as privileged communications. If appropriate, you will want either the legal department or outside counsel to direct and lead the investigation.
You also need a process in place for legal to review all substantive communications with an eye toward possible litigation down the road. The legal department must work hand-in-hand with corporate communications in this area. Your instinct as a lawyer will be to say as little as possible. In many circumstances, however, that simply is not possible. You will need to be flexible with respect to communications and look to balance as best you can “business needs” (simple, digestible messaging) vs. “legal needs” (all the complexity and nuance of litigation). Working together – with some flexibility on both sides – you will be able to balance these needs. One way to build a better relationship with your communications colleagues is to provide them with training about legal issues generally and the pitfalls of poorly drafted documents before there is a crisis.
Finally, when the crisis is over you should invest time in reviewing what worked, what didn’t work, and how best to revise your plans, behaviors, and other actions going forward.
 |
At some point, you and your company will be faced with a crisis. The time to prepare for that crisis is now. Planning will not prevent a crisis from happening, but it will make managing the process much easier on everyone (including you) and will help minimize the potential damage to your company. If you have access to Practical Law, then you have a wide array of tools already in place to help you plan for and manage a crisis.
