Carol is the assistant general counsel and corporate secretary at a public company traded on the NYSE. Her company went public years ago and the board has a strong culture. Most good corporate governance features of board practice are in place.
Carol hired us to help her company create a crisis management plan to be discussed and approved by the board. Most board projects Carol runs herself, but she called us because she did not have the relevant background to devise a crisis management plan for the board. She pointed out that the company pays a lot of attention to risk management and that the senior management team closely supervises each of the business units with an eye toward assessing and managing risk and providing high quality products and services to customers. But management and the board did not have a formal crisis management program.
Risk management is not the same as crisis management. There is overlap, but risk management is the set of actions a company takes to reduce and control risk and assure quality – the steps taken to avoid and manage risks of the business. In contrast, crisis management is the set of tools a company uses to fix problems that may rise to the level of threatening the company. Unless a crisis is handled well, even a strong company with great products and services can have its business adversely affected.
One concept that illustrates this idea comes from the hotel industry. If you stay in a hotel room and everything is fine, the hotel has done a good job. Sometimes, you have a problem with your hotel room. Studies show something called the service recovery paradox, which is that you may end up with a better experience of your hotel stay and be a more loyal customer if you have a problem with the room and the hotel staff listens to your concerns, apologizes and solves the problem expeditiously. In other words, in the hotel room analogy, crisis management can create more loyal customers than risk management.
In a crisis, avoiding damage to the company and to some or all of its constituents requires prompt communication and repair. The classic example of such an outcome is the Tylenol recall that J&J conducted when it removed all Tylenol products from stores across the country, even though the tampering was isolated. Done badly, the repercussions of responding to a crisis can last a long time.
Crisis Management at the Board Level
We helped Carol plan out the crisis management project in advance: (1) specify the goals of the plan, (2) design the key elements of the plan, (3) tailor the plan to the company, (4) test the plan, (5) determine the role of the board, and (6) together with management present the plan to the board.
Crisis Management Planning Goals
Carol considered the goals of that plan. Some of the factors we suggested she consider were:
- the risk of crisis – driven by the complex nature of the company’s business, the speed of change and the need to react to huge volumes of information moving at the speed of the Internet
- the level of corporate staffing in multiple jurisdictions and time zones
- benchmarking to discern how other companies with robust corporate governance are addressing crisis management at the board and senior management level
- how value will be protected or destroyed depending on the way a crisis situation is handled
- crisis management planning represents an investment of time by senior management and the board that can yield significant future benefits when a crisis occurs.
Key Elements of the Crisis Management Plan
Next, we assisted Carol to lay out the key elements of a crisis management plan to be tailored to fit the company. The principal steps we identified were:
- form a core crisis-management team
- identify potential crisis situations and study them
- develop an action framework for significant potential crises
- create a communications strategy
- conduct a crisis response simulation and analyze the results
- periodically review and update the crisis management plan.
Unlike many other corporate governance documents where models are readily available, crisis management plans need to be specifically designed for each company as no one size fits all.
Tailoring the Plan to the Company
We worked with Carol on outlining her approach to the crisis management plan. She convened a meeting of the people she wanted for the core team – CEO, CFO, head of marketing, and head of investor relations. Together, they worked through a few steps.
First, they considered whether to view crisis management planning as a separate undertaking with a formal crisis management plan. They determined that there were definite strengths in their risk management processes that would support the company and the crisis management team in the event of a crisis.
Then, they built the approach to crisis management planning with those strengths in mind. For example, the company’s top risk managers had a comprehensive view of the company’s strategic priorities and the risks associated with accomplishing those priorities. That understanding formed the starting point for preparing a list of potential crisis situations most relevant to the company. Also, the senior management team is a cohesive, well-functioning unit. Carol concluded that many of the types of crises that might arise could be dealt with informally by the senior management team – the planning could be limited accordingly.
The list of potential crises was divided into four categories – (1) corporate and financial, (2) operational, (3) nonoperational, and (4) aftershock or consequential. While there was some overlap among categories, that division helped refine the type of framework needed to address each type of crisis. For example, corporate and financial would tend to involve the board and headquarters more while operational crises would tend to involve the business units and subsidiaries more. The category of consequential or aftershock crises includes things like government investigations that follow a financial or corporate crisis or social media campaigns that can follow a crisis affecting the environment or communities the company serves.
The team worked to identify a manageable number of types of crises that were likely to arise based on the company’s strategic direction and current position. Its business activities, where its operations are located and the business relationships it has all factored into that analysis.
Next, as they worked through a few of the crises, imagining the steps needed to manage them, they identified specific areas that the crisis management team would focus on that were not currently represented on the core team. Human Resources – someone who would focus on the company’s employees and their families throughout the crisis – was a resource they decided to add to the team. Also, they narrowed the list of the core team for all crises – moving the CFO off the list, though on call for corporate and financial crises. The idea was to balance the need for senior management to keep running the business while also managing the crisis.
Another part of tailoring the plan to the company involved trying to find the line between what the routine risk management functions of the company could handle and when the crisis management team should be activated for a particular situation. To do that, the team defined a crisis as a rapidly evolving situation that:
- poses a threat to the health or safety of the company’s employees, customers, or the public
- puts the company’s business operations at risk
- creates significant financial, legal or regulatory risk
- adversely affects or threatens the company’s reputation
And that requires:
- a prompt response
- dedication or diversion of significant company resources to respond.
Based on that definition, training of the risk managers and business units in crisis recognition would be an important step in the crisis management plan implementation.
Determining the Role of the Board
In scoping out the plan, it was important to define what steps should be left to management and what role should be played by board members. The board of directors has a circumscribed role in the running of the company’s business. The board’s fiduciary duties under state law require it to provide oversight of management and the way the business is run. As part of its oversight function, board members should spend time with management to ensure that risks facing the company are identified and assessed and plans to manage and investigate these risks are formulated, including plans to deal with foreseeable crises. Board members are not supposed to, and do not have time to, micromanage.
In developing a timeline, Carol considered the appropriate time in the annual cycle of regular board meetings for the crisis management plan to be presented by management and discussed by the board. While the board was likely to delegate primary responsibility for preparing the plan to an existing committee of the board or an ad hoc committee, given its importance, crisis management is ultimately a board-level responsibility. Therefore, once developed, it would be appropriate for the board to approve the crisis management plan.
Testing the Plan
Working with members of the core team, Carol selected a specific crisis for the simulation. She chose one from the category of corporate and financial crises because they were more likely to involve the board members. Based on recent events for a mid-sized competitor of the company, the team built a scenario around an approach by an activist investor.
The CEO and CFO were intrigued by the idea of a simulated activist investor campaign. They helped adjust the facts from the competitor’s experience to better fit the company, its strategic direction and its liquidity and balance sheet profile.
Carol involved us in planning the process. It was a bit like writing a play – we scripted out a call to the CEO at a management retreat in which an activist investor announces that his firm has acquired a stake in the company’s stock and intends to push for two board seats and significant steps to lever up the company to buy back stock in the market.
The scenario worked well with the company’s planned capital markets activity – they planned to refinance their maturing 10-year investment grade bonds in the beginning of the next year – so the need to approach the capital markets and potentially disclose the pressure to increase debt on the company and buy back stock was added to the simulation.
As the team worked through the scenario, they envisioned developments that would stress the company and the crisis management plan. They discovered that many of the issues presented involved when to communicate, by whom, to whom and how much. They also focused on the need to monitor the media and the stock price and started adding stock watch services and proxy solicitors to the list of resources they might need in the event of a corporate or financial crisis.
Taking It to the Board
When management presents the crisis management plan to the board, the board is likely to want a discussion of the reasons for adopting a formal plan, the importance of crisis management, the dangers to the company if a crisis is not handled well and the role of the board in crisis management. The presentation could also include suggestions for effective crisis management divided into time periods for before, during and after a crisis. In particular, during a crisis, the company may have to focus on:
- convening the pertinent crisis team as soon as possible
- gathering key facts judiciously
- stopping bad practices immediately (if applicable)
- delivering messages accurately, quickly and consistently
- protecting the attorney-client privilege
- continuing to run the business.
When the year-end board meeting arrived, the board members received a special package with the scenario laid out. Management presented the crisis management plan to the board. The board decided that the Corporate Governance Committee would be responsible for the plan going forward. Carol then presented the activist investor scenario, engaging the board members in a discussion of how they would deal with the crisis.
After the board meeting, the core team did a debriefing, reviewing how the scenario played out and added a few resources to the crisis management plan for that type of crisis.
Conclusions and Implementation
Carol got this project done for her board – to great acclaim. She is still working with the core crisis management team to implement the crisis management plan. The board has asked for an update at the end of 2016.
As far as lessons learned, Carol was surprised at the lack of good models of corporate crisis management plans. She thought that she’d be able to copy others the way many committee charters get created, but her crisis management plan is very specific to the company, its business, its management team, and its board.
Adding new oversight steps to the agenda for a board of directors that already has a lot on its plate is not easy. The board is busy with its existing oversight functions. To bolster the performance of a board requires carefully choosing their next project and tailoring it to the company to make it most useful with only the right amount of additional time devoted by the board and management.