Ten top tips for crisis management

Introduction

When an issue first arises, how a company responds in the early stages can be critical in protecting both its liability position and its reputation. It is important to be prepared, so that managing an unfolding crisis is not a purely reactive process and the correct first steps can be taken.

Immediate actions

Assess the situation to understand the key issues, materiality of the risks and potential liability in all relevant jurisdictions. Identify any immediate steps required to contain or mitigate damage. It is important not to prioritise speed over a thorough and robust approach, but actions to restrict further fall-out or isolate an issue should be taken where possible.

Formulate a team with expertise in the relevant jurisdictions and with knowledge of the business areas affected: this may include internal and external lawyers, forensic accountants and IT personnel. An investigation plan should be formulated in consultation with that team to ensure a robust process which upholds confidentiality and privilege, preserves key evidence and complies with applicable laws.

Clear procedure

The investigation plan must take into account timescales: are there any immediate reporting obligations or is there an imminent court deadline, or a need to respond to information in the public domain? Consider which employees within the business hold key information and take steps to secure their cooperation. Use discretion to maintain confidentiality: deal with sensitive information on a need-to-know basis outside of the team.

The plan should cover preserving and capturing data, reviewing evidence, conducting interviews with key custodians where necessary and producing an interim report so that further decisions can be made on any additional work or expert input required for the purpose of producing a final report.

Contemporaneous evidence can be crucial for establishing a claim to privilege, so retain a record of the client group in respect of the issue at hand, together with instruction letters and terms of reference for any legal advice obtained. Ensure that all personnel within the client group are aware of how to protect and preserve privilege so they do not inadvertently waive it.

It is also important to keep under regular review the potential outcomes of the investigation and consequences that would flow from those, together with any remediation steps or loss recovery action.

The investigation plan should set out clear reporting lines so that the decision makers within the business are appraised of ongoing developments to minimise surprises. Be flexible: as the matter evolves it may not be possible to stick rigidly to the investigation plan, so be prepared to update it.

Managing stakeholders

Think about the different stakeholders who have an interest in the unfolding issue and how to manage relations with each of them. In addition to regulatory authorities, is immediate engagement with the company’s insurers or auditors required? In terms of shareholders, if the company is listed, the crisis may trigger disclosure obligations. Suppliers and customers may also need reassurance (see PR strategy below).

Data preservation

Consider what data and documents are relevant to the matter at hand and issue document-preservation notices to relevant stakeholders. Put auto-deletion processes of central data servers and individual devices on hold. Where it is necessary to image devices or hard drives, it is crucial to ensure the process followed is forensically sound and conducted to an evidential standard which is acceptable in the relevant jurisdictions (external experts are usually required) and that there is a record of the process. Failure to follow a robust process may be costly if the veracity of material which supports your case is later questioned and the supporting paper trail does not exist. Assess relevant data privacy and employment laws before accessing, capturing or transferring data.

Exercise caution before producing new documents

The wider team should not create unnecessary documents, given that all documents relevant to the matter (whether historic or newly created) may later be disclosed. Be mindful of sensitive issues and the language used.

Cross-border considerations

When dealing with different jurisdictions, keep in mind that the privilege and data protection regimes will not necessarily operate in the same way as in the United Kingdom. Where multiple jurisdictions’ laws are relevant to the matter and it is unclear which jurisdiction (or jurisdictions) proceedings may be brought in, it may be necessary to meet the highest watermark in order to maintain privilege. Local advice should be sought at an early stage and incorporated into privilege and data protection protocols.

Third-party advisers

Privilege may apply to the work product of third parties, depending on the circumstances. For example, in the recent ENRC litigation, the Court of Appeal held that privilege applied to materials generated by external accountants as part of a "books and records" review carried out to identify systems and controls weaknesses and potential improvements, as the review was undertaken for the dominant purpose of resisting prosecution. Instructions to thirdparty advisers should preserve arguments about privilege by clearly describing why they are instructed and the purpose of the work to be carried out. Consider whether advice from non-lawyers should be communicated verbally in the first instance and ask that they avoid any speculation regarding possible legal implications.

Correspondence

Decide who will correspond with any counter-parties and avoid multiple channels of communication to prevent inconsistent messaging from different areas of the business. Obtain full instructions as to business objectives and factor that into correspondence, in addition to the relevant legal issues. For example, a continuing business relationship will necessitate a different tone of correspondence from one where relations are hostile. Focus on your best points and resist a scatter-gun approach by putting your case theory simply and consistently. Take care not to pre-empt any other party’s arguments or motivations. Correspond in a manner that keeps possible settlement opportunities open, and refer to the applicable pre-action protocol and practice direction on pre-action conduct where appropriate.

PR strategy

Consider whether you need to engage a specialist public relations agency to manage any reputational concerns, for example through assisting with drafting an external statement or fielding press enquiries. Pause before making external communications to ensure that the immediate PR and the medium/long-term legal and business strategies are aligned.

Have a plan

Processes for dealing with a crisis should be established and tested. Implementing an escalation process and appointing a designated internal core crisis team (and substitutes) can help to focus responses and allow for quick decision-making in an evolving and time-critical matter. Putting protocols in place in advance, familiarising team members with them through training, and reviewing and improving them based on test scenarios and real experiences enable effective and efficient crisis management when an issue arises.

This article was first published in the IBA litigation newsletter