Five steps to help the board respond to a corporate emergency.

At some point during every director’s tenure, a crisis will hit. There is no doubt that when it does, all relevant stakeholders will look to the board for their leadership, yet with some level of scrutiny. How did the board respond to the crisis? Could the board have prevented the crisis with better oversight or governance? Can the board ensure that this type of situation never happens again? In order to be prepared, directors are best-served if they follow the below five steps to strategically guide their corporations through a crisis.

Gather the right team. When a crisis hits, the first step is to make sure that the right team has been gathered to respond. Are the key decision-makers for the company informed and working together? Does the CEO have the right people around him or her to help gather information and evaluate next steps? Has the board been properly engaged, with the right directors in the room? Does the company have the right spokespeople (inside or outside of the organization) to engage with the media, if and when the time comes? Do you have a trusted lawyer with the experience to help evaluate the legal benefits and risks of your crisis response and related communications as they arise? The right lawyer leading the response allows the company to control and access advice from specialists, and if appropriate steps are taken the attorney-client privilege can protect sensitive deliberations from disclosure (and being second-guessed). 

Different people will be needed to respond to different crises. For instance, the head of human resources would play a significant role if there have been allegations against an employee, while the chair of the audit committee will have a heightened role if financial regulators have knocked on the door. But no matter what the crisis is, there are certain people who will always be part of the core team needed to respond. Have your board and the CEO discussed who those people are? Do those people know that they are part of the core team? 

Understand the crisis. Once the team is assembled, everyone (including the board) needs to be well-informed and ask the right questions. What happened? When did it happen? Were the appropriate stakeholders notified when they should have been, or are you now responding to a crisis that quietly started quite some time ago? Is the root of the crisis currently internal (e.g., an employee has made allegations against a senior executive) or external (e.g., hackers have breached your corporation’s network to steal information and extort the company for ransom)? Should you publicly address the situation? If so, who is the best person to be making that statement? What should be included in the statement? What are the legal benefits and risks of these decisions? Directors will need to be able to access the appropriate information, processing it quickly to help evaluate all options and develop the best response.

Initiate your plan and response. Once your team decides on the right strategic response, it is time to act. Again, there are important questions a director can ask at this moment. Has your legal team reviewed the plan and signed off? Are there specific stakeholders that would benefit from an individual call from you personally about this situation? Is your response team planning now for different scenarios about how your stakeholders will respond once the plan is initiated? 

Notably, you do not need to wait for a crisis to occur before developing a response plan. Designing a well-thought-out crisis response plan today will help you initiate and execute your plan when the crisis comes. Are your organization’s compliance programs well-run and effective? Do you have risk management policies and procedures in place? Do the employees actually use them? With the help of your lawyers, you can develop and implement crisis response plans and conduct in-house training sessions. These can include mock regulatory inspections, tabletop exercises for a ransom attack, and risk-clarity assessments to determine what risks might impact your business more than others. Doing these types of exercises now will help your company minimize risk and allow you to develop solutions to problems on your own timetable. 

Disclose necessary information. Initiating your response plan and handling disclosures and communications about the plan will have some overlap, but they are different steps in the process. There are two types of communications to consider:

• Those required by law
• Those that are good for business and the company’s reputation 

First, is your corporation legally required to report an incident or potential legal violation? If so, to what extent? If such requirements exist with multiple agencies or stakeholders, it may matter (both legally and strategically) what you disclose to whom and when. Your lawyers can help you evaluate all these risks. 

Next, even if not legally required, what communications should be made because they are good (or necessary) for business? In some circumstances, the crisis may be public (or leaked to the public), and your shareholders, your customers and the media will be watching how you respond in real time to unfolding events. In a public-facing crisis, your organization will need to decide how to respond. Whether you choose to make many public statements as the situation unfolds, just one statement or none at all, you should ensure that the statements you make are coordinated, clear and, most of all, truthful. Lying or misrepresenting the facts as you know them will be discovered in time and will only exacerbate reputational damage and legal risk. Any statements that the company releases – either internally or externally – should be vetted by both communications professionals and lawyers working together.

Emerge on the other side. Winston Churchill once said that you should “never let a good crisis go to waste.” During a crisis, individuals and organizations will be tested, but true leadership can serve as the real difference between a bad day (or year) and an existential crisis for the company. At the end of any incident, it is natural to pat yourself on the back for a job well done and take a break. And you should congratulate yourself on surviving a serious incident. But that is the exact moment when you are best able to recall the details that will get lost to time and evaluate how you can make the organization stronger and better prepared for the next time. 

There are several questions the board should ask: 

• What did we do well in our response? 
• What could we have done better? 
• What policies or procedures could we have had in place that would have better served us during this incident? 
• What can we do now as directors that will prevent this from happening again? 

The more prepared you are today for the inevitable crisis, the better able you will be as a director to help guide your company through turbulent times. And that is the best governance and leadership of all. 
    
Clare Putnam Pozos is a partner at Dechert LLP.