Are you prepared if a crisis happens? A crisis could be government investigations, data breaches, reports of executive misconduct, supply chain disruptions, and so much more. Here are some key steps to consider before a crisis occurs.

As reported by NACD on December 13^th, 2023, by Karen L. Dunn and Scott A. Barshay.

A Day Late and Many Dollars Short: Start Crisis Management Before the Crisis

While private companies today may face any number of enterprise-threatening events (e.g., government investigations, data breaches, whistleblower complaints, reports of executive misconduct, supply chain disruptions, employee discontent), they can still prepare in advance. Effective crisis management plans have a lot in common despite the diversity of threats and the variety of private company governance structures.

Proactive preparation and having a plan in place that takes a private company’s unique organization and setup into consideration are essential for staying ahead of the curve. If companies wait to act until the bad news hits, even minor missteps can have damaging consequences.

Here are some key steps private company directors can consider before a crisis occurs.

Define and align on company values. Decision-making under pressure is always easier with a well-defined value system in place. Moreover, if an organization’s corporate values are well-known within the company and externally, the decisions made will be easier for stakeholders to accept as long as they are consistent with those values. Trying to make everyone happy in the face of a crisis can sometimes be less effective and appear more defensive than remaining steadfast with an approach that management and the board have identified as in the best interest of all the company’s stockholders.

Identify key stakeholders. Of course, shareholders are key stakeholders. But who else could have an impact on the success or failure of a crisis response strategy? Regulators? The media? Policymakers? Employees? Increasingly, we have seen company workforces drive change. Sometimes key stakeholders are inside the company, not outside. A good crisis management plan will take all key stakeholders into account and manage risk from all fronts.

Make sure the right response team is in place. During a crisis, an efficient, effective decision-making team will maximize speed and agility. Having too many people will bog down the response; too few and there won’t be buy-in across key internal stakeholders. Management and boards will want to identify their decision-making team in advance.

It will then be important to expressly determine how decisions will be made. Will there be a war room? If so, where will it be? Who has final decision-making authority? What is the ideal meeting cadence? How will teams communicate quickly and efficiently?

Having the right response team means that all the needed roles will be identified and the roles will be filled with people who work well together. We recommend getting this team together to talk through issues before a crisis hits. It may feel unnecessary to convene an organization’s brain trust in the absence of a crisis, but this is the best way to make sure that the team will be comfortable with one another when it matters the most.

Do not wait to identify outside advisers. It is costless to identify outside counsel, communications advisers, government affairs professionals, and other outside advisers in advance. It may not be necessary to engage firms prior to a crisis, but the last thing any organization wants to be doing under pressure is casting about for help.

Because crises often involve government inquiries, media scrutiny, and litigation, outside counsel should be “multilingual,” bringing not just traditional litigation, regulatory, or corporate expertise, but an understanding of media, public relations, and government affairs. Drawing on their diverse professional experiences, board members can provide invaluable guidance to management in identifying the best outside advisers, whether they be lawyers, public relations consultants, or others.

Think about who will play quarterback. In addition to outside advisers, it often helps to have a senior-level internal quarterback: someone with the internal relationships and heft to call the shots and make things happen when time is tight.

Find potential allies. Management and boards can position their companies for resilience by taking an inventory of where the company operates including any local, state, and federal government relationships or potential allies in a crisis. Some useful information to collect includes government representatives from the company’s geographic area and what committees they are on, the regulatory and political environment of each state or jurisdiction, potential allies in industry groups who could support the company in a crisis, and others outside of the company’s industry who may be experiencing similar problems.

A good offense is the best defense. Many of today’s most damaging crises originate inside a company, whether the incident involves employee data theft or a security breach, insider misconduct, or allegations related to workplace safety or a hostile work environment. A core function of boards is working with management to identify the most urgent emerging threats, think through potential risks and weaknesses in a company strategy, and put preventative, proactive measures in place before any lurking risks escalate into a full-blown crisis.

Regularly pressure-testing crisis plans and thinking through scenarios and potential responses is critical. Companies may consider conducting “tabletop” exercises around the most likely crisis scenarios, helping those in the response chain develop the muscle memory needed to respond appropriately when a crisis strikes.

Crisis situations pose challenges unlike anything an organization faces in the normal course of business. While every crisis is unique, a sustained focus on advanced planning, spotting vulnerabilities, and assessing enterprise risks can give boards and their companies an edge when faced with even the most complex crisis scenario.

Additional Crisis Management Resources

Crisis Management and Business Continuity Planning for CEOs

Leading Through Turbulence: A CEO’s Guide to Effective Conflict Resolution

The Role of CEOs in Ensuring Cybersecurity: Best Practices and Strategies