Crisis management for lawyers

What are the key challenges in-house lawyers and external legal advisors face when crisis hits?

One of the biggest challenges for many in-house lawyers is simply ensuring that they are included in the process. It is difficult to help if you are not in the room.

Issues should not be crudely categorised as ‘legal’ or ‘commercial’. Business decisions have legal implications. And legal advice has commercial repercussions. The two need to work in harmony to achieve the best outcome.

At the same time, lawyers must demonstrate a willingness and ability to step outside their comfort zones. Lawyers have a natural tendency to define themselves as experts in a narrow sense. That can lead to some seeking the safe haven of their specialist area in a pressure situation. A lawyer’s role is obviously to bring their legal insight to bear. But lawyers have other qualities and skills that are useful in a crisis: the ability to assimilate large amounts of information, to triage and prioritise, to remain calm under pressure, to think strategically as well as tactically. You must bring personality and pragmatism to your legal role and your advice must be clear and actionable.

Responding to a crisis requires one to make decisions based on partial information, and working in conditions of ambiguity and uncertainty, as well as under time pressure. For some lawyers, this will be challenging. For others, it may be familiar territory. You must control the urge to know and contain every dimension of a situation. If you give in to that instinct, it can lead to paralysis and impede communication, precipitating an overly constrained and muted public response. This could be costly, because effective communication, both internal and external, is a critical success factor in crisis response.

What specific tasks should in-house lawyers and external legal advisors perform in order to increase crisis readiness?

Preparedness is the key to good crisis management. If you want to effectively prepare for and respond to a crisis, three key constituencies must be represented: business, legal, and communications. Excluding any of these from your crisis planning, or your Crisis Management Team, would be to work against your own best interests.

The issues surrounding a crisis will naturally encompass duty of care, financial cost and a variety of regulatory and compliance issues. Many of these issues stem from legal obligations; all represent substantial legal liability and reputational exposure. If you don’t appreciate them, if you don’t anticipate them and if you don’t understand how to address them, your crisis preparedness and the resulting response may be severely compromised.

In order to plan, you need to anticipate the likely origins of crises and their potential impacts on your stakeholders and the business. You should employ the ‘wisdom of the crowd’ by soliciting the views of a diverse circle of business leaders and experts, both internal and external to your organisation. This will reduce the likelihood of a black swan event blindsiding you. It will also give you the best chance of understanding what levers to pull when crisis hits.

In this process, a dispassionate and independent legal voice can be invaluable. Internal and external counsel should offer a friendly challenge to business assumptions and bring a fresh perspective to help identify all the potential impacts of a trigger event or scenario.

Lawyers are useful in this regard for two reasons: first, they have particular knowledge concerning types of exposure and the likely impacts, and second, they are good at imagining the worst. A natural consequence of a lawyer’s training is the ability to envisage what might go wrong in any given situation. That can make lawyers unduly conservative, but when it comes to the initial phase of crisis planning, it is a useful attribute.

Beyond this, you should introduce your legal and crisis communication teams to each other and have them go through crisis training together. Their rapport will be critical to the efficacy of any response strategy should a crisis arise. Each needs to appreciate where the other is coming from and to respect the valuable contribution each will make.

How should lawyers be involved in the response to a crisis and the recovery and learning phase that follows?

During the response phase of a crisis, the lawyer needs to have a seat at the table so that the legal, regulatory, compliance and policy implications of any piece of information can be fully absorbed. The consequent decisions of the Crisis Management Team need to be informed, even if they are not always directed, by that insight. The TalkTalk cyber-attack is illustrative.

In October 2015, TalkTalk, a UK telecommunications and internet business, suffered a cyber-attack accompanied by a demand for ransom. Personal and banking details of up to four million customers were feared to have been accessed. The company decided to communicate openly and proactively with customers. At that time, there was no legal imperative to do this. Now, the European Union’s General Data Protection Regulation, or GDPR, mandates prompt disclosure to regulators and affected individuals, if the likely impact is serious.

TalkTalk eventually emerged with its reputation tarnished but intact. Its brand proved to be resilient enough to bounce back over time. Even so, the company has estimated that the incident reduced revenues by £15m and that it incurred around £45m of exceptional costs. Next to these losses, the fine of £400,000 imposed by the Information Commissioner’s Office seemed inconsequential.

Now imagine the same scenario under the new framework of GDPR. Regulators can impose fines up to 4% of global revenue or €20million (whichever is higher). In the original TalkTalk scenario, although the brand proved resilient, it became apparent only days after the data breach that the situation was relatively under control. Out of the initially feared four million affected customer accounts, fewer than 160,000 were actually exposed. So, did TalkTalk go public too soon?

That is a difficult question to answer. It is clear that you need to strike the right balance between brand management, maintaining good relations with stakeholders and the authorities, and being mindful of your legal obligations and exposures.

Perhaps, you might think, in the same situation you would choose to be more reticent. But bear this in mind: if a similar breach occurred today, the company’s potential regulatory exposure would increase from £500,000 to £70,000,000. That makes any such decision truly a high-stakes call.

Whilst it remains only one piece of the jigsaw, getting the legal analysis right has never been more important

The importance of working with crisis management and communication professionals

We all need to understand that the appropriate response to a crisis requires the right blend of skills and actions at the right times. That means lawyers must work hand in hand with experts in crisis management, crisis communication, and other disciplines. Management consultancies like C4CS® are comprised of dedicated professionals with a finely honed skill set. Lawyers should show experienced crisis professionals the same respect that we expect and appreciate from our clients and fellow lawyers. We do not act in the best interests of our clients if we place ourselves in opposition to those who are, in collaboration with us, seeking to manage a difficult situation to the best of their abilities.

Even if one does all that is required and to the highest standards, it is in the nature of a crisis to leave a sense that the situation could have been handled better. Whilst criticism and disagreement may be inevitable, we all have a job to do. We bring our diverse skills to bear with the same ultimate objective: return the client to ‘business as usual’ as quickly as possible with the minimum adverse effect on its operations, reputation and balance sheet. In seeking to achieve that, we will address the immediate and pressing concerns of human, environmental and social impact.

As a lawyer, it is vitally important to understand and accept that one’s own analysis of the best way to address those concerns and, hence, to achieve the ultimate objective, may not be the only, or even the best, way to go. Listening to and embracing the valuable contribution of other crisis experts is a prerequisite for any lawyer engaged in crisis management.