Crisis Management in Unprecedented Times

For companies and boards managing crises or cross-border matters, the COVID-19 pandemic has brought unprecedented challenges that in many ways fundamentally change how we think of crisis management. However, managing through COVID- 19 has illustrated the importance of many of the fundamentals that underpin good crisis planning and management in any environment: preparedness, transparency, engagement with regulators, clear and timely communications and proactivity.

COVID-19: Our Perspectives

The COVID-19 pandemic has been a crisis unto itself. As many companies have had to find safe ways to continue essential work and move nonessential employees to work from home, companies’ contingency planning has been put to the test. One of the most notable aspects of managing through the pandemic has been how crisis management planning done in anticipation of external-facing crises has, for many companies, formed the foundation for managing internal constituencies. This is particularly the case in the area of crisis communications, as companies work to provide transparency and predictability to employees while themselves working with limited information and substantial uncertainty. Crisis communications planning has always been the hallmark of a well-managed situation, and the importance of clear, action-oriented and transparent communications to employees has taken on increased importance this year. The risks of poor communication have never been greater, as companies increasingly face scrutiny (and potential liability) for poor or untimely communications regarding the impact of the pandemic on their business or business planning.

While many companies have fallen into a routine regarding operations under COVID-19 restrictions, the prospect of multiple effective vaccines suggests that the watchword of the coming year will be “reopening.” There may be a tendency to view this as a “return to normal,” but we anticipate that the challenges many companies will face as part of the reopening process will be no less significant than those faced to this point – and many of the risks, both to companies and their boards, are less than obvious.

As part of their contingency planning for the coming year, companies would be well-advised to adopt a formal plan for managing potential outbreaks of COVID-19, if they have not already, and for vaccination policies. That includes clear policies for:

• Quarantining employees;
• Notifying those potentially affected;
• Making testing available;
• Confirming whether reporting to relevant public health authorities is required (as it is in many jurisdictions); and
• Documenting steps taken to establish a record of following applicable protocols and how the company will handle vaccinated and non-vaccinated employees and customers.

In doing so, companies should continue to consider their own potential liability. While laws vary by jurisdiction, in the event that employees, customers or others contract COVID-19 at a company’s premises, a company may face claims for negligence, misrepresentation, violation of employment contracts or work rules, or violation of common law or statutory duties to maintain a safe working environment. Likewise, in implementing policies regarding quarantines, failure to adhere to public health guidance and vaccinations, companies should consider risks under anti-retaliation, anti-discrimination and similar regimes.

Our experience advising leading companies on their contagious disease planning suggests that there is an important role for the board to play in managing all of these risks. COVID-related risk is now a fundamental environmental, social and governance (ESG) risk. How companies anticipate addressing COVID-related risk; what mechanisms are in place to ensure clear, timely and accurate communications; how the company intends to comply with existing or new public health guidance; and the occurrence of any unexpected events that lead to operational disruption are all matters that directors should consider as part of evaluating corporate readiness for the coming year.

Success Stories in Crisis Management

While COVID-19 dominated the headlines in 2020, companies have continued to face many of the same types of crises that existed in prior years. In advising our clients, we have found that success stories of companies that have successfully weathered crises in the past can provide invaluable insight into planning for the future.

Crisis management is “the process by which an organization deals with a disruptive and unexpected event that threatens to harm the organization, its stakeholders or the general public.”[1] What differentiates a true crisis from more standard, even if problematic, events is the level of unpredictability, potential to affect multiple aspects of a business and size of the potential impact.

A company may face a crisis as a result of a triggering event (a cyber-attack, harassment scandal, environmental disaster or something similar), regulatory action, internal escalation or whistleblowing, media reports or escalation from another source. Understanding sources of crises most likely to impact a company can assist in deciding what preparations would be most useful. A company may be vulnerable to certain types of crises because of its industry. For example, food companies are more vulnerable to crises related to disease outbreaks, while manufacturing companies are more vulnerable to product liability and product recall issues. All companies can be susceptible to public relations and employee misconduct crises. Identifying potential sources of crises can be done through good partnership with risk management, focusing on high, medium and low risks under the assumption that even small events can balloon into larger crises, particularly in the area of social media. Another important way to identify potential sources of crises is to learn from what other companies experience and continually ask whether something similar could happen at your company.

A company’s ability to respond to a crisis moment is inevitably influenced by the extent to which the company has prepared itself to address a crisis ahead of time. Examples of well-managed crises teach that companies should consider the following factors as part of their pre-crisis planning:

• Creating a culture that is favorable to crisis management: A favorable corporate culture is one in which there is acknowledgement and commitment by senior management, where people are encouraged to accept constructive criticism and where employees’ interests are aligned with those of the company. Such a culture is one in which employees are encouraged to bring risk forward, to raise their hands, and where both policy and practice are such that employees are rewarded for identifying potential risks – even in cases of false alarms. Boards should be asking management for reporting on the culture of the company with these points in mind.
• Integrating crisis management into the company’s strategy: Planning for a crisis should be a formal part of corporate strategic planning. Successful companies have thought through the preparation of a crisis management plan, engaged in employee training in crisis management and emergency preparedness and often have engaged in tabletop exercises around crisis response that help to identify weaknesses and ensure a smooth response. Importantly, crisis management strategies should not confine a company’s ability to respond dynamically: a strategy is a plan to respond to a crisis, not to conform a crisis to a pre-ordained plan. The companies that are most effective in responding to a crisis are those that learn from prior experience, develop guidelines and tools, empower those on the front lines who often have the best information and ability to act and reward creative and responsible problem solving. Boards should periodically be briefed on the crisis management plan.
• Having the right communication tools: The best messaging is only as good as the ability to get it out. Companies should consider and re-evaluate the effectiveness of internal and external communications mechanisms. In doing so, companies should focus on making sure that the communications channels are user-friendly, relevant (including channels likely to be accessed by differing stakeholders, e.g., company website, Twitter, Instagram) and ready for off-hours communications. Communication channels should be monitored to hear what the market is saying: robust brand monitoring is one way that companies can get ahead of potential risks by understanding how their products or services are being discussed in the market and on social media.
• Integrating crisis management into the company’s governance structure: To ensure prompt, efficient and clear communication, lines of authority should be developed ahead of time, and authority should be appropriately delegated (i.e., not centralized) so that messaging can be managed even if senior managers are unavailable or consumed with management of the crisis itself. This is particularly critical in the area of cybersecurity and data breaches. On average, companies take 197 days to identify and 69 days to contain a data breach; companies that are able to respond more quickly limit their risk and that of the data subjects by allowing proactive remedial action to be taken more quickly. Practicing this governance structure in tabletop exercises is critical, and boards should be asking what kinds of tabletop exercises management does and whether the board should be included.
• Updating disaster recovery and business continuity plans: The COVID-19 pandemic has only highlighted the importance of having up-to-date policies, procedures, sites and resources to reallocate personnel and resources in a time of crisis. As companies move to the next phase of COVID-related planning, it is advisable to consider remote working as part of – but not a substitute for – a robust business continuity plan and, perhaps, long-term working structures.

Having a good plan is important, but so is executing on it. In our experience, the companies that respond best to crises, whatever their source, are those that approach the issues as part of a six-factor framework:

1. Respond Strategically. Consider the issues, assess priorities and ensure well-defined roles.
2. Get Counsel Involved Early. Managing legal risk and privilege protections are critical.
3. Preserve Documents and Protect Data. Avoid any perception of cover-up or spoliation.
4. Communicate Strategically. Manage a consistent message across constituencies – including governmental agencies, shareholders, employees and the media.
5. Be Open to Reassessing Strategy. Constantly look ahead to where the company would like to be post-crisis and think through the steps necessary to get there, including how to potentially turn the crisis into a positive, such as companies that changed product lines to support COVID-19 relief.
6. Learn. Get to the root cause of the crisis and put in remediation to prevent it from happening again, communicate that learning to stakeholders and, critically, reassess the crisis management response plan after the crisis abates to determine what worked and what can be improved.

All companies are likely to face a crisis at some point. It is critical to know how to prepare for, handle and learn from a crisis. Understanding the types of crises most likely to affect your company can help you prepare effectively. Decisions about the early response can have a lasting effect on the risk profile to which the company is exposed and its ability to manage/mitigate risks.

Cleary Gottlieb’s Global Crisis Management Handbook is designed to be a useful, practical desk reference and contains helpful checklists keyed to particular phases of crisis management and incident response, cross-referenced to substantive and up-to-date guidance written by Cleary Gottlieb lawyers around the world.

The current version of the handbook is available to download here.

[1] Marie Mikušová & Petra Horváthová, Prepared for a crisis? Basic elements of crisis management in an organisation, Economic Research-Ekonomska Istraživanja (2019).