Part II of this article appears in the November 2004 issue of The Metropolitan Corporate Counsel.
A convergence of legal developments resulting from the corporate debacles of the past few years, strongly recommends the development by in-house counsel of a crisis management plan that can rest on the shelf until needed. The plan must be flexible in order to address the different types of crises and issues that may arise and must provide a roadmap for reliable and timely reaction to events as they occur. Companies should prepare in advance for these events so that the learning curve does not overlap with a future crisis. This article discusses the key elements of a crisis management plan and attempts to provide a framework from which such a plan can be developed.
What Is A Crisis Management Plan?
A crisis management plan is generally a framework from which counsel and senior management of a company can respond to threatened or pending actions by third parties or governmental agencies, breakdowns in public reporting or compliance with securities laws, criminal investigations, whistleblowing and other areas in which the company finds itself in a threatened position. The plan must address the various phases of a crises, which include:
- Receipt of the initial information triggering the crisis (e.g., whistleblower allegations, SEC investigation or subpoena, unexpected discoveries in audit, criminal investigation, etc.);
- Initial determination of the scope of the crisis and the issues presented;
- Assembly of the team to conduct the internal investigation and develop recommendations and responses;
- Internal investigation of the factual and legal issues; and
- Development and implementation of recommendations and responses to the issues, including a strategy for the company to respond to any third party complaints or defend criminal charges and in many cases a strategy for dealing with reactions by customers, suppliers, shareholders and/or the public generally to the crisis event.
The Beginning - Receipt Of The Triggering Information
The crisis management plan must address the very earliest stages of a potential crisis. Human nature drives us to rush into action as the information is coming in and often the leniency policies of law enforcement agencies, which require prompt early reporting of criminal wrongdoing, exacerbate the problem. Haste is undoubtedly important - but a more controlled response will usually benefit the company.
Information comes to the company in many ways. Any effective corporate compliance program will require that a hotline exist for employees to anonymously report corporate wrongdoing. An effective corporate compliance program must also provide for audits to ensure the company is complying with the law. Even apart from these sources, a company's own internal legal or audit functions may discover potential wrongdoing. Information can also come directly from a regulator or prosecutor in the form of an investigation, subpoena or indictment.
How the information is discovered will often dictate the timing for an investigation and response. Allegations from whistleblowers of past wrongdoing, while serious, may not have the time pressures of a subpoena or SEC investigation. Companies will often feel compelled to promptly disclose the existence of governmental investigations that could lead to future material disclosures. Such a release will then put tremendous pressure on the company to expedite the investigation process and take prompt corrective action or otherwise reassure the markets.
A very important part of a crisis management plan is the mechanism for immediately overriding any document retention program that could cause the destruction of relevant documents or evidence. Section 1102 of Sarbanes-Oxley, together with other obstruction of justice provisions regarding preservation of evidence, requires the company take immediate action to protect evidence. The crisis management plan must interface with the company's document retention program for this purpose.
Determine The Scope Of The Crisis And Issues
Immediately upon receipt of the initial information, the team charged with the matter will begin analyzing the information and determining the scope and risk that the information poses to the company. Companies are finding that many of the charges made through their hotlines are no more than personnel issues that can be referred to the Human Resources Department. However, other issues may be more problematic, and the responsible attorney must attempt to determine the scope of the issue. The scope of the crisis will drive the answers to questions such as:
- Who will supervise the project internally?
- Should the company retain outside counsel to conduct the investigation and which areas of legal expertise will be required?
- Does the audit committee or some other independent committee of the board supervise the investigation process and approve the responses?
- What other outside experts or professionals will be required to complete the investigation?
- Will the company disclose to the public the facts of the crisis and what public and investor relations issues will arise as the issues and the investigation become public?
A formal approach to making the initial determination of the scope of the investigation should be included in the crisis management plan. This process should be under the control of the company's general counsel and her staff, with input from other relevant members of management. From this point through the remainder of the project, heightened concern should exist for the proper preservation of the attorney-client and work product privileges. For this reason, preliminary interviews should all be conducted in the presence of the general counsel or other attorneys in her staff. The crisis management plan should set forth useful guidelines for the conduct of initial interviews and the preservation of the content of such interviews. At a minimum, those guidelines should provide instructions regarding: advising the interviewee who owns and can waive the privilege; the generation of interview notes so that one set of notes contains all relevant factual information from the interview and nothing more, while the other set contains attorney mental impressions and strategy but no facts; and the provision for multiple interviewers in the event that the privilege is later waived and someone must testify about the interview.
Assembling The Team
The crisis management plan should establish the initial participants in each category of crisis that can be anticipated. For instance, with respect to matters involving disclosure issues in SEC filings, the plan should set out the names and contact information of the members of the disclosure committee or other group responsible for disclosure controls as well as outside securities counsel, auditors and experts involved in the disclosure process. As the scope of the issues are being determined, members of this group would presumably be heavily involved in the process.
Early in the process, consideration must be given to whether outside counsel should be utilized. The use of outside counsel can improve the perception of objectivity with respect to the investigation, particularly if there is a concern that the in-house counsel may have an interest in the outcome or is subject to real or perceived pressure from management. Outside counsel can often bring more expertise to issues, particularly when dealing with complex or obscure regulatory matters. Finally, outside counsel can provide additional comfort with respect to the protection of privileged communications and expert work product.
Disadvantages to using outside counsel include the increased cost and the loss of control of the process. Once outside counsel is retained, any attempts to limit the scope of the investigation could have the appearance of interference. The general counsel can only effectively address this issue at the outset when interviewing the outside firm and discussing their philosophy regarding investigations. Section 10A(m) of the Securities Exchange Act of 1934 provides the audit committee with an open checkbook to retain counsel and advisers.
Another consideration is whether to hire the company's customary outside counsel or to retain an independent outside firm. Again, this will depend to a great extent upon the scope of the matter. If the crisis potentially involves very senior management or the general counsel's office, the relationship between the regular outside counsel may call into question the objectivity of the investigation. In such cases, or where the audit committee or an independent committee has heightened concerns regarding independence, a firm without a material relationship with the company may be preferable. The biggest disadvantage to an independent firm would be the absence of any institutional knowledge by the independent firm, which could adversely affect the quality of the ultimate work product, increase the amount of time needed to reach actionable conclusions and significantly increase the cost of the investigation.
Finally, when considering whether to utilize outside counsel, the company should be reminded that Section 307 of Sarbanes-Oxley and the SEC's Standards of Professional Conduct (17 C.F.R. 205.1 et seq. ) require attorneys to "report up" evidence of a material violation of securities laws and make an independent determination of whether the response by the company was appropriate. Outside counsel is relieved from this reporting up requirement if the attorney was retained for the purpose of investigating such evidence of a material violation, reports its conclusion to the chief legal officer of the company and (unless it is determined that no violation has occurred, is ongoing or is about to occur) the chief legal officer reports the results of the investigation to the board or an appropriate committee. To be certain that this exception is available, the scope of the outside firm's engagement should specifically track the applicable standard. The crisis management plan should make clear the roles played by outside counsel to take full advantage of this exception available under these rules.
Published October 1, 2004.
