So… A crisis has arisen? Don’t Panic!

A crisis can take many different forms. Depending upon the nature of the business in question, a crisis can mean a crippling cyber-attack, material fraudulent activity coming to light, a whistleblower raising serious allegations of impropriety, or something else entirely that is unique to the business. However, while the nature of the crisis may vary, in each case it is likely to mean that a fundamental threat to the business or its reputation is now looming and demanding a response.

As is likely obvious, the worst time to develop a crisis response plan is in the middle of a crisis. Preparation is essential. While the specific response will reflect the nature of the specific crisis and, indeed, reflect the culture of the business responding to it, there are some basic principles that are likely to apply in most circumstances. If crisis response plans are developed, and adhered to, then not only will the impact of any crisis be lessened, but the time and resources needed to deal with it will also be reduced.

Any crisis starts with the issue surfacing. The first nettle to grasp is determining what it is that you are dealing with: getting on the right track early is critical to long-term success. Once the problem has been identified then you need to establish a timeline. For example, is there an immediate risk to the public that needs to be addressed and communicated rapidly? Or is there time available to conduct a full risk review? Are there any immediate reporting obligations under relevant contracts, statutory frameworks or other regulations? Identifying these reporting obligations in advance as part of the crisis response plan is essential.

The next step, once the immediate issues have been addressed, is to establish a clear response team that draws upon a range of relevant disciplines as is needed to address the crisis (for example, legal, communications, operations, customer service etc). It is also important to determine if external counsel is needed to help co-ordinate the response. If external legal counsel are instructed, then it should be clearly defined who within the internal response team is ‘the client’ so that legal privilege can be best preserved. More generally, preserving privilege is a crucial element of any crisis response and internal investigations more generally, and companies will be well served to educate their business personnel on best practice when communicating with legal counsel (either internal or external) and with each other.

Finally, the next stage is to conduct a factfinding exercise in a proportional and targeted manner to ensure that you get the answers you need to the critical questions. This is a delicate process that would most often benefit from the input of external counsel with in-depth experience handling sensitive internal investigations. The result of the investigation will determine what the final response ultimately is.

In summary, the following ten steps can help define a successful crisis response:

1. Set up a core team to investigate, take decisions and liaise with external counsel.
2. Consider internal and external PR.
3. Limit unnecessary internal communications (including instant messaging and social media).
4. Preserve relevant evidence.
5. Consider if there are any immediate obligations to report to authorities.
6. Notify insurers if necessary.
7. Consider data protection regulations.
8. Is there a whistleblower? If so, consider how they should be handled.
9. Investigate and remediate. Consider if any HR steps are necessary.
10. If there is a criminal breach, stop the conduct as soon as possible.

Once the storm has been weathered, and the crisis is resolved, it is also vital for businesses to assess what worked well within the crisis response plan and what fell short. Cultural change may well be essential. Any ‘lessons learnt’ should be incorporated into the next iteration of the crisis response plan to avoid making the same mistakes twice.

[View source.]