At the start of any discussion about crisis management, it is important to first define what crisis means. Crisis events are generally understood to have long-term potential to change the way an organization operates, sometimes threatening its survival, or fundamentally changing its internal or external stakeholder relationships. To best prepare for eventualities such as these, companies must have a crisis management plan that brings together many different competencies: communications, legal, security, forensic, and often political among others. Most companies appropriately recognize the importance of devoting resources to compliance, preventing compliance misses from happening in the first place. But the reality, even for companies with the best compliance programs, is that certain events are unforeseeable (e.g., "black swans"), or unstoppable ("gray rhinos"). The answer is not simply to reactively deal with these events when they come, but instead to implement a plan that can save important time and provide a semblance of order when the next crisis happens.

The Crisis Management Plan Imperative

Gone are the days when crises were limited to emergencies and disasters that left a physical impact on a company. Given the current COVID-19 pandemic, the urgency of managing those types of events is more important than it ever has been. However, the discourse about crises now also includes so-called "soft" or "man-made" crises that may not result in physical damage but nonetheless have a lasting impact on a company's brand, reputation, and employee morale. Consider the impact of problems like these if they happened at your company:

• A whistleblower reports that your longtime Chief Executive Officer, who has presided over a dramatic turnaround at your company but also massive layoffs, worked with your CHRO to underreport the CEO's compensation in securities filings and eventually flees not only the company but the city after he is arrested. Subsequent reports surface that the CEO misappropriated other large amounts of funds, too.
• For the last few years, your company has struggled with certain regulatory inspections, receiving negative grades in several areas. Your company wanted to improve, so it recruited and hired employees who worked for the regulator and instituted a financial incentive system that awarded bonuses to employee teams who found a way to improve the company's grades. Naturally, your company's inspection grades subsequently improved. Years later, it is discovered that the employees your company recruited copied guides and manuals from the regulator, as well as a list of areas at the company that the regulator planned to inspect.
• Your company's industry is highly regulated and its process for promoting middle managers to senior managers into customer safety-sensitive positions requires the successful completion of an extensive exam. One of your employees—the Senior VP to whom those senior managers will report—decides to share copies of the exam with certain middle managers she wants to promote before they take the exam. This is discovered after promotions are decided and announced throughout the company. Disappointed applicants for the promotions sue the company and the applicants' lawyers go to the press, citing rampant favoritism among other problems.

Companies that have experienced challenges like these know all too well that "we'll figure it out when it happens" is not a viable strategy. While it is nearly impossible to script out exactly how a crisis will take place before it happens, companies can plan for when certain critical HR processes are compromised such as those illustrated above: executive compensation, hiring, and promotions. For several reasons, this planning is an important step that leads to effective business continuity:

The Impact of HR Crises Is Real: With lessons learned from Harvey Weinstein in 2017, Carlos Ghosn of Nissan, Renault and Mitsubishi in 2019, and WeWork's Adam Neumann in 2019, companies know all too well the costs of alleged misconduct, reckless management and criminal conduct in the C-suite. Some of those costs are measurable. A noted study on reputation risk published by Pentland Analytics and Aon showed that an average five percent (with considerable variability) of a company's shareholder value was lost within a year after a crisis event occurred. The study also showed company equity beta increased nine percent, impacting the company's cost of capital. Having analyzed the cost of crises for more than 25 years, the study observed "the value impact of reputation events has doubled since the advent of social media" and "neither firm size nor reputation premium offers any protection against value loss."

HR Crises Are Here To Stay: As illustrated by the annual Institute for Crisis Management (ICM) "Global News Coverage of Business Crises" report, more than a third of publicly-reported crises are HR-relevant, including news about discrimination, executive dismissal, sexual harassment, workplace violence, and whistleblowing. Of the 850,000 crisis news stories that ICM identified in 2018, HR-relevant categories amounted to 41 percent. In 2016 and 2017, that number was over 30 percent.

HR Crises Can Make a Bad Trust Environment Much Worse: The 2020 Edelman Trust Barometer, now in its 20th year, shows that in a majority of markets, "less than half of the mass population trust their institutions to do what is right," and nearly half of U.S. employee respondents are worried they will lose their jobs because of causes like the gig economy, looming recession, foreign competition, and automation. Those concerns create a difficult environment for employers to maintain workforce stability, steady production, and retain talent. Imagine throwing in an HR crisis event, a company without a crisis management plan, and poor internal stakeholder (employee) communication. Clearly the situation can quickly worsen.

HR-Specific Components of the Crisis Management Plan

The benefit of a crisis management plan is not that it eliminates the costs that a crisis may bring. Rather, a plan gives companies a better chance to survive, successfully manage through the crisis, and more quickly stabilize operations. The plan should be closely tied to the stages in the crisis management process:

• Detect that the incident has reached crisis status, determine its severity, and communicate quickly and transparently with stakeholders, both external and internal
• Investigate the matter thoroughly to understand the cause, disclosure obligations, and other responsibilities the organization may have
• Take steps to contain the damage from the crisis and prevent its immediate recurrence
• Start the process of business recovery
• Learn how to prevent the next crisis of this type – stakeholders may forgive the company's first crisis, but they rarely forgive the second of a similar nature

When drafting a crisis management plan for HR issues, a few considerations are worth noting:

1. Identify Where HR Crises Originate: The crisis management planning process starts with an assessment of the company's risks, understanding what certain of those risks would look like if they reached crisis level, and identifying the company's internal and external stakeholders (and the "owners" of those stakeholder relationships). Each internal stakeholder group should have a representative at the table in this assessment. Consider questions like: what HR crisis scenarios do you believe to be the most likely to strike your company? Have other employers in your industry faced crisis scenarios that would endanger your company? What HR crises, or serious incidents just short of crises, has your company experienced that could resurface in the future? In drafting this list, it is important not to make perfection the enemy of good—the list need not be exhaustive, but it is very important that, with multidisciplinary engagement, the company start the process of drafting it and continue to revisit it.

2. Establish the Governance Structure of the Crisis Management Team: Typically, the crisis management leadership team is comprised of the company's C-Suite leadership, among them the CEO, COO, GC, CHRO, CCO and Chief of Security, along with a liaison to the board (often from the Audit Committee). They are responsible for determining when an incident has reached crisis level; declaring it as such and activating the appropriate crisis management playbooks; deciding on the company's strategy and response; and, making the tough decisions throughout the management of the crisis. The voice of the company will come from one person (often, the chief executive) on the leadership team. That person, along with other members of the team, is responsible for final approval of communications to internal and external stakeholders.

Selecting the right members of the crisis management team is more complicated when the crisis involves someone on the team or a direct report of someone on the team. It is exponentially more complicated if the incident involves the chief executive, which is one of the reasons we suggest CHROs should have at least a dotted line report to the company's board of directors. Companies should decide how they will resolve this conflict before the crisis comes for a host of reasons, not the least of which are maintaining the integrity of the crisis management team and crisis investigation, and determining the right resolution regardless of one leader's interest. One way to do that is to temporarily remove the conflicted leader from the crisis management team, at least until it is established that the person had no direct or indirect role in the crisis.

3. Activation Guidelines. An important part of the planning process is empowering certain middle managers to escalate crises to the crisis management team. This is especially true with a whistleblower complaint, which middle managers are likely to discover before the company's leaders learn about it. There are several questions that can help in this regard, among them: (1) does the situation endanger the safety or welfare of one or more of the company's employees? (2) is it a localized incident affecting your company only, or is it regional, national, or international? (3) are one or more of your facilities at risk? and (4) does the situation present a threat to the company's reputation? If the answer to any of these questions is yes, the manager should notify a member of the crisis management team. Once that happens, the crisis management team member should gather the appropriate members of the team, assess the initial scope and potential impact of the situation, and make the final call on whether it is, in fact, a crisis.

4. HR-Specific Playbooks. Crisis scenario playbooks are activated when the crisis is declared. Among other things, they include a list of who the internal and external stakeholders are for each type of crisis, a list of who "owns" the relationships with each of those stakeholders, and current contact information for those stakeholders. They will include checklists and visuals that lay out a roadmap of the first 24 to 72 hours of the crisis, establishing key action items that need to happen, who needs to do them, and in what order. They will also include a list of attorneys, communications experts, forensic analysts, and other professionals that the team may need to hire. The company will need advisors who have credibility and experience with its external stakeholders. For a domestic HR crisis, external stakeholders can include labor, employment, and financial regulators, and, on occasion, criminal prosecutors.

Closing Thoughts

At his speech the Convocation of UNCF in 1959, the great President John F. Kennedy reflected on some of the perils of the day and said, "Along with danger, crisis is represented by opportunity." Which one of those outcomes your company chooses in the face of a crisis starts with appropriate planning and skilled management by your team throughout the crisis event. On one hand, a fast, thorough, thoughtful and effective response can provide an opportunity to enhance the company's reputation and loyalty to its brand. Indeed, the Pentland study showed a company's value can actually increase when it handles a crisis in the right way. On the other hand, a slow response that fails to meet the needs of the company's internal or external stakeholders can create significant dangers, blocking the path to future success.

Preston Pugh is a member in the litigation department at Miller & Chevalier in Washington, D.C. Recognized for his work in corporate investigations and whistleblower allegations, he represents employers and has significant experience with boards of directors and C-suite leaders in multiple stages of crisis management. Contact: [email protected], (202) 626-5842; 900 16^th Street NW, Washington, D.C. 20006.