By Weil, Gotshal and Manges, LLP
An integrity lapse by a key executive, an environmental disaster, a compromise of confidential information, a product taint: companies expend significant resources on risk management and internal procedures to avoid such failures. But as important as crisis prevention is, companies must also be prepared to contain and manage crisis situations when they do occur. The board plays an essential role in this preparation. The board needs not only to assure that senior executives are well positioned for crisis management, but must also consider the board’s own preparedness and capacity for addressing crisis. A board should develop a plan that ensures both (1) the strength of its own culture to withstand the stresses that crisis brings, and (2) its ability to effectively manage both the corporation’s business interests and possible litigation consequences when making decisions in crisis-mode.
By its very nature, crisis involves the unexpected, but a board can and must anticipate the occurrence of crisis. Times of crisis frequently create the risk of significant impairment of a company’s operational, financial, or reputational integrity, as well as the risk of related litigation. By the time a particular risk materializes, the board should already have adopted general procedures and policies that prepare it to coordinate with management to address the problem and minimize negative effects. The board should identify a crisis-management team and assign defined roles and create processes for problem analysis, decision-making and communication. In formulating this team and these procedures, the board should keep in mind the effect its action may have in future litigation, which is often brewing in the background during times of crisis. The board must be particularly tuned into issues related to attorney-client privilege. Adopting a comprehensive crisis-readiness plan will enable the board to decide issues with dispatch and in a manner that conveys appropriate concern resolve and credibility, while minimizing future-litigation risks.
The board and management need to be attuned to the most common and likely causes of corporate crisis. While crisis comes in many forms and the likelihood varies based on industry and other company specific factors, common causes of crisis include:
• Concerns regarding management credibility or integrity
• Loss of a key executive
• SEC or other government investigation or regulatory action
• Significant litigation
• Financial reporting issues, financial restatement
• Allegations of fraud
• Poor operating results (over multiple periods)
• Product failure
• Information security or confidentiality breach
• Environmental disaster
• Liquidity issues
• Default on covenants
• Failing labor relations
• Failing shareholder relations
• Systemic ethical issues
• Contest for corporate control
Boards should consider coordination with management to conduct crisis response simulations from time to time. This can be in the form of a discussion of several hypothetical scenarios involving issues that the board and management believe could arise and create significant problems for the company. Where appropriate, the board should consider involving legal counsel, either internal or external, in this exercise, to help the board to identify litigation-control measures that should be adopted in particular types of crises.
Internal Controls, Risk Management & Corporate Governance
The foundation of effective crisis management is a well-developed system of internal controls, risk management processes and corporate governance practices. Periodically, the board and management team should assess the strength of that foundation by, for example:
• Reviewing corporate policies and controls such as specific prohibitions on unethical and illegal conduct, confidentiality requirements and communication policies to ensure that they:
a. address appropriately and thereby decrease the likelihood of the types of behaviors that could raise significant risks, and
b. are aligned with ethical (and regulatory) expectations so as to foster the support and understanding of the public and regulators should a crisis occur;
• Identifying and periodically reviewing significant risks to business operations, financial condition and reputation and considering how crisis might materialize and be addressed in relation to such risks;
• Evaluating the governance culture and considering ways to continuously improve upon it; and
• Monitoring ongoing litigation and considering patterns of litigation risk.
Effective crisis management also requires that the board identify a crisis-response team in advance. This is the team that will activate as soon as the potential crisis has been identified. The function of this team is to provide early assessment, response and litigation-risk management. One misstep companies frequently make during times of crisis is underestimating the seriousness of the problem, including the potential impact for negative public reaction and regulatory action or litigation. A frequent and related mistake is overestimating the company’s capacity to address the problem at the departmental level and without outside expertise. The crisis team should be designed to include a variety of expertise to help quickly determine what else may be needed. The company should identify:
• An internal crisis team: This should include senior executive officers (the CEO, CFO, COO, General Counsel), representatives of key operational departments and the heads of compliance, internal audit, human resources, corporate communications/PR, and sales/marketing. It should also include the appropriate board-level contact point, which may vary depending on the situation but likely will include the independent board leader and/or the audit committee chair. When a specific situation arises, the identity of the crisis team may need to be adjusted based on needs and on recusal of anyone whose integrity or behavior may be at issue. At times the full board may need to become involved.
• A team of external advisors: This should include external legal advisors and communications experts. Having established relations with professionals who get to know the company and the key members of the board and management before crisis occurs can pay dividends when the company must react quickly. The board should also understand under what circumstances the board may need to rely on independent advisors—primarily when the integrity or performance of the CEO or other executive officer is at issue or when management is otherwise conflicted. When coordinating with legal advisors, the board should be particularly aware of issues related to attorney-client privilege and develop procedures to avoid waving it.
Well before any bad news materializes, the board needs to communicate its expectation to the CEO and key members of the management team (at minimum, the CFO, the general counsel, and the internal auditor) that bad news should be delivered promptly and directly. Everyone should understand that the board wants early warning and does not want to be “surprised” by hearing bad news from another source—especially a public source—because management thought it could manage its way out of a problem and failed to inform the board early.
The board and management should develop an agreed, workable and well understood crisis communications plan. A crisis communications plan should be thought of as a protocol for both internal and external communications in a crisis situation. Since actual communications must relate to the particular circumstances, the crisis communications plan should focus primarily on ensuring that the right people can be called together quickly to determine how to move forward and communicate, together with guidance for ensuring that the company speaks with one voice and confidentiality is maintained until the company has decided to speak. Key elements include the following:
• The plan should call for early communication of the known facts to the identified crisis team and the board for early analysis and response planning.
• Once the right people and expertise are involved, they can decide the time frame and message for communications with regulators, employees, shareholders, customers, suppliers, creditors, insurers, and the media.
• In most situations, the CEO or other members of the management team will be tasked as the spokesperson for both internal and external communications. However, any issues that involve concerns about the actions or integrity of the CEO will require board involvement in communications. In certain circumstances this may extend to situations involving other executive officers.
• Special attention should be given to monitoring social media given the speed with which information and misinformation can be transmitted and to having capacity to come up with strategies for using social media effectively in a crisis.
Note that sensitivity to how information flows in crisis response efforts is important in determining who to get involved and at what point. Even when at first blush an emerging crisis may not appear to have a legal issue at its heart, consideration should be given to whether and at what point there is benefit to having an attorney involved in coordinating the efforts of other advisors to help preserve the ability to assert the attorney-client privilege of certain communications.
Companies with operations and markets in non-U.S. jurisdictions should make sure that there crisis management efforts are sensitive to how different cultures react, so that they can manage accordingly, including by involving relevant experts who can assist not only with tailoring communications to different cultures but who also understand the political, regulatory, and legal environment.
Special Considerations Regarding Social Media and Preparedness for Crisis
Given the speed with which news, rumor, and innuendo can be disseminated through social media and the tendency for social media to be treated as an informal means of communication, it is particularly important that the company has in place and has educated its employees about policies related to the use of social media. When formulating social media policies and thinking about the risks of social media, it is important to differentiate between its uses since the type and degree of risks are distinct depending on how social media is being used:
• Social media can be a significant tool for listening to what customers, shareholders and others have to say about the company and in this respect can serve as an early indicator of issues that may be arising. Much of the risk related to observation or “listening” may be controlled through clear policies about mining public information in legitimate and transparent ways. Companies also need to prepare in advance for a negative message that is broadly repeated. Since the context will drive the appropriate response, and the response will need to be determined in real time, the company should have an understanding about who the crisis communication team is
• Social media can also be a powerful means of spreading a message—but it is in the effort to influence viewpoints where much of the risk lies. Corporations need to have very clear policies about who can speak on behalf of the corporation through social media (and any other media). These policies need to be accompanied by education for those who are restricted from speaking on the company’s behalf as well as for those who are empowered to speak.
In addition, policies should address expectations about how employees refer to the company in their personal use of social media. Clearly, there needs to be a system for vetting official company messages as well, just as for other media. However, since much of the value in social media is its real time and targeted nature, consideration needs to be given to the balance between these benefits and the degree of prudent internal control. Directors should use the same rules for social media that they use for contacts with shareholders and potential investors.
Directors should avoid at all costs any ad hoc communication about the company. Only official and coordinated communication is appropriate.
Because of the complicated and constantly developing legal issues surrounding online communications, a company’s social media policy should be carefully reviewed by legal counsel and updated as necessary.
Crisis Assessment, Investigation, and Mitigation
When a crisis hits, the crisis team—internal and external as appropriate—will have to quickly assess the situation to define the scope of the further investigation and analysis that will need to be undertaken and to fine-tune the team:
- How serious might the problem be and how widespread?
- How much is known and what is known now and what needs to be determined?
- What is the likely impact on liquidity, on customers, key employees, suppliers, and relations with regulators?
- What is the risk of related litigation or other potential for interrelated problems?
The crisis team and the board and management generally should assume that things are worse (or may get worse) than they appear, and bring a healthy skepticism to bear without overreacting. Based on its initial assessment of the situation, the crisis team will need to determine who the appropriate team is to lead the investigation and the response. This should include conferring with both inside and outside counsel about the plan, paying particular attention to attorney-client privilege issues at this stage.
The level of board involvement will depend on the nature and scope of the problem, including the extent to which members of the senior executive team are implicated. In most crises, the current CEO and key members of her team will be best positioned to provide the crisis management required. In such circumstances, the board should be fully and regularly advised and should provide guidance with sensitivity to the need for management to focus on the issue at hand. However, if the issue relates to, or could potentially implicate, senior management’s credibility or integrity, the outside and independent directors may need to oversee the crisis response including potential investigation with assistance from independent counsel. Is a special board committee needed to look to investigate allegations of wrongful conduct? Is independent outside counsel required? Is forensic expertise required? The board will also need to assess whether there are specific additional resources and expertise needed to help guide the company through the problem.
When company management has lost credibility with external constituents, the board may need to assess who is best positioned to give regulators, investors, creditors, customers, employees, and the public comfort that the board and management are engaged and focused on protecting the corporation’s assets.
The board also must be mindful its own public perception. In some instances, for example, where the issues raise concerns about whether the board was appropriately engaged, governance reforms or even changes in board composition may be helpful or necessary to send the right message to key constituents and investors.
Effective Board Culture
An effective board culture is essential to effective crisis management. A strong board culture will prevent the board from wasting time getting its own house in order when it should instead be taking decisive action.
The board culture to strive for is one in which confidentiality is protected and independent viewpoints are respected and valued, but consensus can be readily achieved after opportunity for full and informed discussion. Well-functioning boards usually are able to achieve a consensus that all directors can support, with only rare resort to a majority position that a minority of directors oppose. A corporation should embrace governance structures that support this type of culture.
A board’s ability to achieve consensus in an efficient manner is a function of its success in developing trust and mutual respect among members, creating shared expectations of how individual members should behave and contribute, and adopting a common understanding of the what is in the company’s best interest. A healthy board culture is one in which directors understand one another’s styles and strengths. Effective boards agree on the rules of engagement and accepted behaviors while valuing distinct opinions. Directors trust and rely on one another and at times defer to one another’s judgment. Well-performing boards reach consensus without significant conflict or tension. Dissent and disagreement are expressed and resolved.
A particular challenge for the board as a team is that it is charged with overseeing management but must at the same time rely on management for information and to otherwise support the work of the board. The board must be mindful of its relationship with management and should seek a “constructive tension” that balances attentive oversight and a critical review of management’s strategy and performance with support and guidance for management.
• Discuss and agree on the role of the board and management, clarifying as necessary the extent of delegated authority and expectations about board information needs and board involvement in decision- making.
• Emphasize the value and the limits of “constructive tension” in board/management relationship.
• Discuss and agree on valued behaviors—behaviors that are consistent with an environment in which “constructive tension” can thrive:
– Respect for fellow directors’ and managements’ expertise and viewpoints – Constructive skepticism in questions directed to management
— Opportunity for, and ease of, open discussion and debate
– Commitment to achieving consensus after engaging in an informed and deliberative process
– Commitment by all participants to listen and to self-control (not everyone needs to be heard on every issue)
– Trust among directors and between directors and management
– Protection of confidences
– Attention to schedule, but in a manner that ensures time for important discussions
• Periodically evaluate board culture along the lines outlined immediately above
• Remind directors of confidentiality requirements and privilege issues.
Board Strategies for Avoiding/Addressing Potential Problem Behaviors
Note that boardroom confidentiality is critical if a board is to create and maintain an atmosphere in which full and frank discussion can thrive, and consensus can ultimately be reached. A failure of board confidentiality can undermine the ability of a board to make timely and deliberated decisions. It also may signal more significant difficulties within a board. And it may exacerbate or even lead to crisis situations.
A director must keep confidential all matters involving the corporation that have not been disclosed to the public. Directors must be aware of the corporation’s confidentiality, insider trading, and disclosure policies and comply with them.
Although a public company director may receive inquiries from major shareholders, media, analysts, or friends to comment on sensitive issues, individual directors should avoid responding to such inquiries, particularly when confidential or market-sensitive information is involved. Instead, they should refer requests for information to the CEO or other designated spokesperson.A director who improperly discloses non-public information to persons outside the corporation can, for example, harm the corporation’s competitive position or damage investor relations and, if the information is material, incur personal liability as a tipper of inside information or cause the corporation to violate federal securities laws. Equally important, unauthorized director disclosure of non-public information can damage the bond of trust between and among directors and management, discourage candid discussions, and jeopardize boardroom effectiveness and director collaboration.
Confidentiality: Excerpts From ABA Directors Guidebook, 6th Edition (2011)
Every company is susceptible to a crisis—whether from a single event or from a confluence of circumstances. The board plays a key role in positioning the company to weather crisis by acting to prevent the crisis from spiraling out of control and by establishing credibility with key constituents. The board also plays a critical role in positioning the company to deal with any litigation that may arise out of a crisis situation. To do so effectively requires both crisis preparedness and the development of a board culture of cohesion, respect and confidentiality.