While not all crises cause significant legal liability, a company's response can result in major business risks. Corporate counsel should help balance these business risks with legal risks to advise a company appropriately.
It is no secret that it is not if a company crisis will occur, but when it will strike and what will strike. Nevertheless, most companies do not have a crisis management plan, and if they do, frequently, it is not a useful game plan. Most company law departments acknowledge that they are not prepared for a crisis, which should keep corporate counsel up at night, since it will be corporate counsel who will be called upon to save the day and become a crisis manager at a moment’s notice.
Crises come in all shapes and forms, from a company being caught in the #MeToo movement, to a cyberattack on a company; to an old politically incorrect photograph of an executive resurfacing; to an employee embezzling pension funds; to a design defect in a product; to a safety incident; to a financial restatement. With the prevalence of social media and instantaneous news alerts on our cell phones, the general public is inundated with a new company crisis occurring every day, and it is difficult, if not impossible, to miss the news. News, both true and fake, now travels at lightning-fast speed. If your company is not ready to respond to a crisis almost immediately, the unrestricted comments on social media will influence public opinion by which your company will be judged prior to the company even formulating a defense strategy.
When Crises Strike, Time Is of the Essence
Corporate counsel are trained to play defense, to proceed methodically, to wait and gather as many facts as possible, and to say nothing – even when they do say something. In a crisis, playing defense, waiting, and not communicating is not always in the best interest of the company.
Take for example, the United Express Flight 3411 incident in 2017. United Airlines needed to provide seats for four crew members on an overbooked plane. As a result, a passenger, who had refused to voluntarily give up his seat, was physically removed from the airplane, being knocked unconscious and dragged off the airplane. The incident went viral on social media within hours. The airline’s first statement was that the airplane was overbooked and the passenger refused to leave the aircraft. The next day, United’s chief executive officer issued a statement apologizing for having to “re-accommodate” the passenger (not for having him dragged down the aisle unconscious) and indicated that United will be conducting a “review” of what happened. As a result, United became the target of public outrage and jokes by other airlines, and even President Trump commented that United treated their customer “horrible.” As Warren Buffett aptly said, “It takes 20 years to build a reputation and five minutes to ruin it.” Time is of the essence in crisis management, and a company must weigh the legal risks and business risks, and react appropriately and quickly.
Build A Crisis Management Plan
Corporate counsel should appreciate the risk involved in a company making quick, off- the-cuff judgment calls under unusual pressure without adequate preparation. It goes without saying that the best way to address a crisis is to be prepared for it, even though the company may not know what the crisis will be. As such, every company should have a written crisis management plan, just as they have a corporate compliance program, and the crisis management plan should be updated continuously. Corporate counsel should at a minimum participate in the creation of the plan to evaluate the legal and regulatory liabilities in the crisis. The plan should start with the specific crises the company knows may occur. If the crisis de jour is executives’ personal texts being made public and it could happen at your company, then plan for it. Review the company’s annual risk assessment which identifies those risks the company has already determined may have an adverse effect. Building on the risk assessment, the crisis management plan should identify three potential risks and specifically address how each will be handled. Understanding that no one, not even corporate counsel, is omniscient and knows what specific crisis will occur, plan for the unknown by creating procedures for three types of crisis: a minor crisis, a medium crisis and a major crisis. The company should provide examples of each to guide the crisis management team. The plan should also distinguish between what the company considers a crisis and what it considers not to be a crisis. A disgruntled customer posting a complaint on a company’s Facebook page is normally not a crisis. A chief executive officer being arrested for a driving under the influence hit and run and the board finding out by reading about it online is a crisis.
Identify A Response Team
After determining what is a crisis and what the company should do, the plan should identify who will actually do it. At the time of a crisis, spending hours determining who should be contacted and how, and who will do it, is counterproductive to properly addressing the crisis timely. Every plan should identify a core crisis management team, the leader of the team and the spokesperson. For example, your team could include your corporate counsel, lead outside counsel, chief financial officer, chief risk officer and your spokesperson. Frequently, corporate counsel is the leader of the crisis management team (but should not be the spokesperson). In addition to the core crisis management team, other individuals who will be tasked with participating on the team should be identified. If the crisis involves employees, then your human relations manager should be involved. If the crisis involves an activist investor, then the corporate secretary should be involved. If your crisis involves a data breach, your information technology director should be involved. However, simply identifying the individuals and their contact information is not enough. The plan must identify their roles and responsibilities and who reports to whom, and should also outline any escalation procedures for minor crises that escalate to major crises.
Communication Is Key
It is also important to be prepared to communicate effectively during a crisis. As evidenced by the United Express Flight 3411 incident, proper communication is key to managing a crisis, and it should be part of the preparation and plan. A lawyer’s traditional advice during a crisis – to clam up, say “no comment” or to deny everything – will no longer suffice. At the time of a crisis, public relations persons, executives and even board members will urge corporate counsel to have the company’s response approved for dissemination to the public almost immediately – a much quicker timeline than most counsel are comfortable with. Having sample communication pieces drafted in advance, appropriately vetted and included as part of the crisis management plan allows all the members of the crisis management team, management, and potentially members of the board, the opportunity to provide input on the response and allows corporate counsel the opportunity to spend hours analyzing each word of the communication for risks before the crisis.
In addition to the communication with the general public, a company has many other constituents with whom it should communicate during a crisis: board members, shareholders, regulators and employees. The crisis management plan should identify the method of communication for each and identify who will be responsible for the final drafting of the communication. Samples of previously vetted and approved communications should be included in the crisis management plan. If the company is SEC reporting, the plan should address what crises may be material enough to file a Form 8-K and who makes the ultimate determination of whether it is filed. The plan should include draft Form 8-Ks that have been approved by legal counsel and other management.
Although United did communicate during the United Express Flight 3411 incident, the company was criticized for not immediately apologizing for removing the passenger. (United had apologized for “re-accommodating” passengers). Although publicly apologizing is counter to everything an attorney has been taught, frequently, it is important for a company to quickly take responsibility for its actions to mitigate business risks which may outweigh the legal risks involved in the crisis. For a company to quickly disseminate an apology, corporate counsel should consider having a carefully worded apology drafted in advance to avoid negatively affecting any legal defenses and affecting insurance coverage which may prohibit public apologies or statements of liability. If possible, corporate counsel should have the canned apology approved by the company’s insurance carrier before communicating it to the public.
The Role of Corporate Counsel
As important as it is for corporate counsel to control the message, as indicated above, corporate counsel should not be the spokesperson for the company in a crisis. Corporate counsel should be mindful that he or she is still an attorney and bound by the rules of professional conduct in a crisis with respect to client confidentiality and trial publicity. In addition, corporate counsel should be mindful of waiving the attorney client privilege during a crisis, either during meetings where third-parties are present or when speaking to third-parties regarding advice provided to the company. Although the general rule is that communications between an attorney and a client (or its employees) is protected from disclosure by the attorney privilege, the privilege may be waived by having a third-party present or by disclosing the contents of the communication to a third-party, such as a public relations consultant. Corporate counsel should familiarize themselves with the law of his or her jurisdiction and proceed accordingly. Addressing who will be present when counsel, both corporate in-house counsel and outside counsel, is providing legal advice in the crisis management plan will avoid confusion when the company finds itself in the middle of a crisis and focused on matters other than who is sitting in a room.
Although the crisis itself may not cause significant legal liability, the company’s response may cause significant business risks. Corporate counsel serves a pivotal role in crisis management, as it is the corporate counsel who can balance business risks with legal risks and advise the company appropriately. As such, corporate counsel should ensure that the company has an adequate crisis management plan that prepares the company in advance for when, not if, a crisis occurs.
Published April 26, 2019.
