Ten things with Sterling Miller: Crisis Preparation 101

Sterling Miller

As in-house counsel, you can sum up your priorities in two categories: "Maximize Value Creation" (e.g., M&A) and "Minimize Value Destruction" (e.g., defending "bet the company" litigation). Pretty much all legal work you or the department do will fall under the above. A "crisis" situation falls under potential value destruction and can come in many forms, including major litigation, data breach, government investigation or criminal indictment, environmental catastrophe, social media "meltdown," product recalls, death of the CEO, campus intrusion, FCPA claims, just to name a few. How you and the company respond to a crisis will go a long way in preventing or limiting damage to the company, including its reputation and brand. In-house counsel should play a key role in the strategy and plans to manage these risks should they arise. Ask yourself this question: "If [pick a crisis] happened today, do I know the exact steps the company and I would take in the next 24 hours?" If the answer is "no," then it's time to get cracking.

This edition of "Ten Things" will set out some basics for in-house counsel to manage a crisis situation both before there is one and if one occurs. It is impossible to set out everything you should know or do in a column like this, but you will get the building blocks to put plans in place and do further research yourself. This is also an opportunity to show thought leadership, vision, and strategic thinking to your Board of Directors and your CEO (and other executive team members) in terms of ensuring your company is taking the right steps to be ready for a crisis situation.

Pre-Crisis

1. It CAN happen to you. One challenge in the area of crisis planning is to get the business to understand that bad things don't always happen to the "other guys." You should have a discussion with the CEO, CFO, and head of Corporate Communications (and/or others) about what plans, if any, the company has in place in the event of a crisis and how to go about updating or implementing those plans in a repeatable and systematic manner. It may be an easy sell or it may be a harder sell depending on the audience. If necessary, you can easily find very public examples of crisis situations that went badly and use those situations to stress the importance of having a plan. You want to be the prepared Rob Lowe, not the unprepared Rob Lowe.
2. Evaluate your company's most likely risks. You cannot plan for everything but you should be able to think through and prepare for the most likely five to ten situations that would – given your business – present a crisis to your company. The first step is to create a cross-company team to flesh out the risk scenarios (Finance, TX, HR, Internal Audit, Legal, CIO, Business Units, CFO, etc.). You may be the leader of such a team or you may just be part of such a team. It doesn't matter which. Your job is to help ensure the process of crisis planning gets underway. A broad cross-section of the company will give insight into the risks you should be most concerned about. This will enable the team to prioritize the most likely crisis situations and put together the right plans to deal with them.
3. Have a written plan. The next step is to prepare a written plan. You can have one overarching plan that contains sections dealing with different types of crisis situations, or separate plans for each type of crisis. I would lean toward the former but either option can work. Part of the effort may be gathering crisis plans that already exist in different parts of the organization and bringing them into one document. Regardless, the purpose of a written plan is to give the leadership team basic step-by-step guidance as to what to do in the event of a crisis. Here is a non-exhaustive list of things you will need to cover in your plan:

• Clear definition of roles and responsibilities.
• A process to triage the crisis, i.e., how serious and widespread the problem is, including impacts on customers and other parties, litigation risk, what facts are known, and what needs to be determined.
• Where to meet (including an off-campus location in the event you are not able to meet at your headquarters).
• How people will be notified of a crisis situation: e-mail, phone call, etc.
• Crisis bridge-line number and instructions (including how to call in from foreign countries).
• Who needs to participate (including primary backups in the event someone is not available). Your crisis team will likely consist of the CEO, CFO, the General Counsel, COO, Chief Compliance Officer, HR, Corporate Communications, Marketing, Investor Relations, and Internal Audit. Likewise, the heads of the various business units should be part of the team.
• Who is in charge of any particular type of crisis, i.e., depending on the issue, it may be the general counsel, human resources, CFO, etc. It is not a good idea to have the CEO be in charge of the crisis team. While he or she will be part of the team and may have a key role in communications, the nitty-gritty details of operating the crisis team day-to-day should rest with someone else.
• Contact information for internal people, including alternate phone numbers and email addresses should the company's email server go down.
• Contact information for external people including the Board of Directors and any outside resources you may need including outside counsel, media relations, security, police/FBI, etc. As in-house counsel, you will want to think about who you would call in the event of a particular crisis. It may be a different lawyer for a data breach vs. a litigation crisis. Make sure you have multiple contact numbers for them and have a backup person you can contact. Let your outside counsel know they have been identified by you as someone to help in the event a crisis hits. They will appreciate it and may have useful ideas for you to consider in terms of crisis preparation.
• Communications plan for dealing with external media, social media, employees, investor relations, Board of Directors, regulators, as well as who is in charge of developing the messaging and making contact with each group. While you cannot develop the exact messaging language in advance of the crisis, you can develop standard templates (format, language, etc.) that will save time.
• A clear process and timeline to develop and distribute communications, updates to the team, and other documents. With respect to outside communications, it will be very important to set out in detail how communications get approved, as you can lose valuable time if it's not clear who needs to "sign off" on something before it goes out.
• Where the plan is stored and how it is accessed, and who is the "keeper" of the plan.
• A process to update the plan regularly. Do a health check on the crisis plan at least annually and, ideally, twice a year. Be sure to get a broad set of viewpoints about risks the company faces, in particular if you have new executives joining the company or your business has expanded into new areas.

4. Practice the plan. Once you have your plan in place, create "table top" exercises to practice different scenarios over the course of the year. You can eliminate a lot of the uncertainty and confusion that comes with a crisis by running through a training exercise, so people know what to do and what to expect. This is an area where you may want to invest money in having a third-party help you with developing and running the exercises.
5. Invest in media training for your executive team. Communication, both internal and external, is a key element of a crisis response plan. You and your executive team may be called upon to speak publicly, e.g., via a newspaper, trade magazine, or television. Many companies provide basic media training to their executives. If your company does not, you should raise the issue in terms of at least considering it. Moreover, you should consider more advanced media training for those people who are designated as spokespeople for the company in your crisis plan.

During a Crisis

6. Stay calm. When the crisis hits the most important thing you can do as in-house counsel is stay calm. Many in the business will take their cues from you. Even if your stomach is churning with worry, you will need to be a rock and bring perspective to the situation. If you've done the right type of planning, you will already know what to do, who to call, and what to say. You need to set the tone and keep people focused on the task at hand.
7. Follow the plan. You need to trust the plan you've put into place and follow it. There may certainly be good reason to deviate from it, but the first meetings and responses regarding a crisis should track what you already have down in writing. This is especially true when it comes to media and other communications. You need to speak with one voice and stay on message. In these days of instant communication, you and your company will be bombarded with questions about your crisis (from both outside and inside the company). The worst thing that could happen is for someone to ad-lib a response or speculate without knowledge of the facts. And make sure your Board of Directors is properly updated. If the directors are learning of material issues from other sources first, you will be off to a very bad start. If your company is publicly traded, you will need to be on top of any necessary 8K filings.
8. Outside help. In a serious crisis situation, it is highly likely you will need outside help. It can be in the form of experienced outside counsel, a public relations team, or other experts. You should have these resources identified in advance and have their phone numbers on speed dial. Moreover, depending on the nature of the crisis, it may involve litigation or regulatory review. If so, it will be important to ensure that parts of your investigation are appropriately protected as privileged communications. This is an area where your outside counsel can be particularly helpful. If appropriate, you will want either the legal department or outside counsel to direct and lead the investigation as doing so will maximize the availability of various privileges.
9. Communications review. You will need a process in place for legal to review all substantive communications with an eye toward possible litigation down the road. The legal department must work hand-in-hand with corporate communications in this area. Your instinct as a lawyer will be to say as little as possible. In many circumstances, however, this simply is not possible. You will need to be flexible with respect to communications and look to balance as best you can business needs (simple, digestible messaging) vs. legal needs (all the complexity and nuance of litigation). You should explain to corporate communications your concerns from a legal viewpoint and listen closely to their concerns from a business communications standpoint. Working together – with some flexibility on both sides – you will be able to balance these needs. One good way to build a better relationship with your communications colleagues is to provide them with training about legal issues generally and the pitfalls of poorly drafted documents, especially in the event of litigation and vice versa in terms of having communications present to the broader legal team about business messaging.
10. Post Mortem. When the crisis is over (and it will be), you should invest time in reviewing what worked, what didn't work, and how best to revise your plans, behaviors, and other actions going forward. This is a great place for the legal department to take the lead and add value.

At some point you and your company will be faced with a crisis situation. The time to prepare for that crisis is now. Planning will not prevent a crisis from happening but it will make managing the process much easier on everyone (including you) and will help minimize the potential damage to your company. Put crisis planning at the top of your "to do" list this year.

About the Author

Sterling Miller was the General Counsel, Corporate Secretary, and Chief Compliance Officer for Sabre Corporation from 2008 to 2014. Prior to that, he was the General Counsel for Travelocity.com and in the Sabre Corporation legal department, in charge of litigation and regulatory affairs. Before moving in-house in 1994, he was an associate in the Litigation Section of Gallop, Johnson & Neuman in St. Louis. In November 2014, he retired from Sabre and decided to start a blog featuring lessons he learned in 20+ years as an in-house lawyer. Read more from Sterling Miller in his blog, Ten Things You Need to Know as In-House Counsel.

Follow us on Twitter