7 steps to successful crisis management
Clare Putnam Pozos is a partner at Dechert’s enforcement and investigations practice, while Peter McGinley is an associate at Dechert’s enforcement and investigations practice.
From cybersecurity breaches to compliance failures to scandals in the C-suite, crisis situations are inevitable in the modern business world. Clients wisely often turn to outside counsel for help.
How you manage a crisis is critical and may be the difference between a swift resolution and a prolonged public nightmare. Consider these seven lessons to help guide your clients successfully through their next crisis.
Lesson 1: Have a plan in place before a crisis strikes
Successfully navigating any crisis requires a well-thought-out response plan. But you should not wait for a crisis to happen to develop a plan. Designing a response plan today will help you initiate and execute your plan when the crisis comes.
First, ensure that your client knows that you are ready to assist when a crisis strikes and how to contact you at any time. This requires proactive communication with key client stakeholders.
Next, understand the client’s core response team that will come together to address any crisis. Keep that core team small, and build it out depending on the nature and the scope of the crisis. As part of this core team, always know who can handle sensitive and time-sensitive IT and administrative tasks. If a member of this core team is implicated in a crisis and must be excluded from the response, know who will fill in.
Once you know the above, it is important to develop a thorough plan for collecting, processing and reviewing client information to avoid delays. Understand the client’s policies and procedures (e.g., IT and “bring your own device” policies) to anticipate what documents will be stored and who has them.
Also, if you are able, consider proactively evaluating your client’s compliance programs and risk-management procedures. Developing crisis response plans and conducting training sessions to minimize risk allows the client to develop solutions to problems on their timetable.
Lesson 2: Gather the right team to respond to a crisis
When a crisis hits, immediately convene the key decision-makers. As mentioned, the composition of this team may vary depending on the nature of the crisis.
For example, the head of human resources will likely play a significant role if there have been allegations made against an employee, while the chair of the audit committee will have a heightened role if financial regulators come knocking. In virtually all cases, ensure that the CEO is read into the situation. When appropriate, also be sure that the board is informed and involved.
There may be times when members of the core response team disagree as to how to handle a particular situation. Leverage your position as experienced outside counsel to implement a plan for making difficult decisions when the team does not agree on the way forward.
If a crisis is, or could be, public facing, engage trustworthy in-house or outside public relations professionals to collaborate with you while handling media coverage and messaging from the client.
Lesson 3: Initiate your response plan quickly
Now that you have developed a plan and gathered the core team, implement that plan without delay. Quick action can help you preserve and collect key documents, prevent internal speculation within the client’s organization, and stay ahead of public messaging. By avoiding delay, you can begin developing a record of what happened and who is involved.
Communicate frequently with key stakeholders to understand the crisis fully. Make sure you are asking the right questions:
- What happened?
- When did it happen?
- Were the appropriate stakeholders notified when they should have been, or are you now responding to a crisis that quietly started quite some time ago?
- Is the root of the crisis currently internal (e.g., an employee has made allegations against a senior executive) or external (e.g., hackers have breached the client’s network to steal information and extort the company for ransom)?
- Should you publicly address the situation?
- If so, who is the best person to be making that statement? What should be included in the statement?
- What are the legal benefits and risks of these decisions?
Knowing these answers is critical to communicating successfully in any crisis.
In gathering information to understand the nature and the scope of the crisis, you should communicate with your client about the organization’s objectives and discuss the potential outcomes of the situation. Identify what a good result would be for the client, but be sure to explain that investigations are dynamic and can be unpredictable.
Lesson 4: Take all steps to preserve attorney-client privilege
From the outset, emphasize and preserve attorney-client privilege. Ensure that the core team understands the importance of privilege and confidentiality (and especially how privilege can be unintentionally waived). By keeping the response team tight and small, you will be better positioned to preserve privilege and prevent unwanted disclosures later on.
Lesson 5: Understand the client’s reporting obligations
You should also be aware of the client’s reporting obligations, which may be time-sensitive. For example, public companies generally must file a Form 8-K within four days of reportable events, which range from common occurrences, such as the departure of certain company officers, to more serious situations, such as material cybersecurity incidents.
This is another area in which planning ahead will greatly benefit the client. Before a crisis hits, understand the extent of the client’s required disclosures, agencies and stakeholders that must be notified in certain situations and who is responsible for handling these reports. As the client makes necessary disclosures, always ensure consistency in the client’s filings.
There may be additional disclosures that, while not legally required, the client could make to promote trust and transparency during a crisis response. For example, if a crisis is public, the client’s shareholders, customers and/or the media will be watching to see how the client responds in real time to unfolding events. Clear, truthful statements vetted by communications professionals and counsel can be powerful tools when navigating a public crisis.
Lesson 6: Balance business and legal risks
A crisis will usually present business and legal risks. Understandably, your client may be particularly focused on the business risks and the organization’s goals during a crisis.
For example, senior executives may be hyper-focused on potential financial losses, while communications professionals may be focused more on messaging and sound bites. As outside counsel, it is your job to help your client assess and balance all risks while keeping the legal landscape in mind.
Lesson 7: Learn from each crisis
Naturally, clients want to emerge from a crisis and move on as quickly as possible. But often, this results in a missed opportunity to come out stronger and more resilient as an organization. Take time to evaluate how the client can improve and be better prepared for the next crisis. There are several questions the client should ask:
- What did it do well in its response?
- What could it have done better?
- What policies or procedures could it have had in place that would have better served it during this incident?
By taking this obligation seriously, you and the client can be better prepared to navigate through difficult situations together.
Clare Putnam Pozos, a partner in Dechert’s enforcement and investigations practice, represents clients in a broad range of high-stakes litigation, including white collar, investigations, crisis management, complex litigation and privacy and cybersecurity matters.
Peter McGinley, an associate in Dechert’s enforcement and investigations practice, focuses his practice on investigations and the defense of publicly traded companies and their officers and directors in securities litigation, derivative litigation and other complex commercial litigation.
Mind Your Business is a series of columns written by lawyers, legal professionals and others within the legal industry. The purpose of these columns is to offer practical guidance for attorneys on how to run their practices, provide information about the latest trends in legal technology and how it can help lawyers work more efficiently, and strategies for building a thriving business.
Interested in contributing a column? Send a query to mindyourbusiness@abajournal.com.
This column reflects the opinions of the author and not necessarily the views of the ABA Journal—or the American Bar Association.
