Most business owners appreciate the importance of employee handbooks, posted policies and procedures, chain-of-command reporting and training as means of protecting their company from routine business interruptions such as workplace safety incidents and employee complaints. Yet, no matter how well-drafted and carefully implemented, these routine measures do not always achieve their goals. Even the best-run companies must deal with the occasional emergency or lawsuit.
If we accept that negative events cannot be eliminated, it is still worthwhile to invest in planning and training because it tends to limit the impact of “routine” business interruptions. Companies should apply the same logic to address business crises major interruptions that could threaten share price, market share or reputation. Businesses expend tremendous resources developing and implementing corporate strategy. They should have a plan to protect it.
A crisis is best managed before it ever occurs. A data breach at a small online retailer provides a good and timely example of how a crisis management plan can help protect a business from potentially catastrophic consequences. Without a crisis management plan, our unfortunate retailer will be playing catch-up from the moment it discovers the breach. By then, the stolen personal information will have literally spread across the globe thanks to the Internet. Once the breach becomes public, the Internet will play its second critical role in destroying our retailer’s reputation: social media will drive the story of how the retailer abused the trust of their customers who entrusted it with their names, addresses, and bank account numbers and because it is still trying to figure out what happened isn’t doing anything the fix the problem. Competitors and consumer rights lawyers will then join the chorus. It will get out of hand in an instant.
A forward-thinking retailer would have in place a crisis management plan to address the risks associated with its business. The plan would be the result of pre-crisis critical thinking by the company, its attorneys, and business partners, including vendors. The analysis would have covered topics such as insurance, dealing with the media, delegation of responsibilities, pre-litigation planning, and government reporting priorities to develop a step-by-step guide for dealing with the crisis when it happens. When implemented, the plan will allow the company to focus on running its business rather than dealing with peripheral distractions like managing Twitter.
Attorneys are critical to developing a crisis management plan. Usually, outside counsel is first contacted during or after the crisis to help clean up the mess. Such an approach is shortsighted. Good attorneys recognize risk where others don’t and have unique walking-around knowledge by virtue of their training and experience. A strategic relationship with outside counsel also gives companies an advantage no one else can provide: the use of the attorney-client and work product privileges to protect from public disclosure important discussions and documents.
In our example, a data breach which can be as sophisticated as an online hack or as unsophisticated, but just as effective, as a rogue employee writing down customer information on a notepad is an obvious risk of doing business on the Internet. In heavily-regulated industries, potential crises could include an environmental disaster or government investigation. Other companies may face the risk of product safety recalls, international political issues affecting supply chain or distribution, or workplace emergencies such as a plant fire. We see news stories about these types of events almost every day, often with reporting about the company’s response that makes readers ask, “What are those people doing?” Think BP and Penn State University. The answer is usually that they are flying by the seat of their pants without a plan. Don’t let that be you. An ounce of prevention is worth a pound of cure.
Zac Greene is a member of the litigation department of Miller & Martin PLLC in Chattanooga. He practices in the areas of commercial litigation and white collar criminal defense and chairs the firm’s crisis management practice group.