GCs are becoming increasingly involved in identifying and managing risk – but is it possible to prepare for an unthinkable situation? Yes, says Dominic Bacon, as he explains the steps to take before and after a crisis hits

No matter how prepared you think you are, when the proverbial actually hits the fan, your first reaction is most probably to panic.

It's how you deal with the 'panic' that will not only determine the success or otherwise of your – and hence the company – response, but will also define you as a GC (and as an individual).

You may, however, question how you can prepare for the 'unthinkable' when the definition of unthinkable is something along the lines of 'impossible to imagine' or 'inconceivable'.

While they are technical definitions of the word, as a GC you would not be doing your job if you left it there.

If you were to explore that thought further, you would find there are actually very few, if any, unthinkable events (despite what Donald Rumsfeld might have said about "unknown unknowns").

Furthermore, one of the activities that GCs are becoming more frequently involved in is helping to identify and then manage risk (even where there is a head of risk). This is partly because lawyers tend to be both independent (to an extent) and cautious, and so are thought of as good at identifying (and managing) risk.

It is also partly because if a risk does materialise, how the company addresses it does touch upon your day-to-day responsibilities. Can you name a risk that, if it materialises, would not require the GC to address at least one related legal/regulatory/compliance issue?

Preparation

So, if you want to be prepared for the unthinkable, the first thing you need to do (before that unthinkable event happens) is review the company's risk register and match it against the company's policies and procedures.

When doing this analysis, however, remember the reality – particularly in a smaller company – is that your policies and procedures, while addressing several externally mandated obligations, risks, events and/or behaviours, will probably only address additional obligations, risks, events and behaviours that the board/risk committee believe are most common for your particular company.

Indeed, even regulators accept that your risk register/risk appetite statement cannot address every conceivable risk and therefore you should not worry if the policies and procedures do not cover, in detail or with any degree of specificity, every risk.

But you must ensure they cover all of the risks on your risk register and that there aren't any risks missing from the register.

Integrally linked to this is making sure that you know, in general terms at least, what your policies/procedures actually say and cover.

Ideally, when you are drafting, reviewing and approving the policies and procedures before circulation, you should ensure they are drafted so they are natural in how they define the issues and their resolution.

On the day the proverbial hits the fan you will not have time to keep referring back to the actual wording of the policy/procedure.

And then disaster strikes… Having recently been in a situation that on first view seemed unthinkable, and having initially experienced the panic I referred to, I now know what I thought of at the time as unthinkable, was, on reflection, a series of (smaller) events that when broken down into their constituent parts were actually covered by various policies and procedures.

As a result, when you are first in the middle of such a crisis, remember that a policy will not tell you precisely how to address an accounting fraud involving the CFO, or a sexual relationship between the CEO and one of their direct reports, or where non-business related personal expenses have been claimed by a group director.

However, when you take personalities out of the equation (and/or the sums of money involved), you are likely to find that you do have either a policy that addresses what you do in the event of someone discovering a fraud, or a policy that requires the most senior person in the relationship to disclose that relationship to the HR director as soon as it begins, or even a policy that sets out what expenses can be claimed.

Simplify and focus

Therefore, the first practical step you should take is to distil the issue down to its constituent parts – to simplify it.

For example, an accounting fraud involving the CFO is still a fraud, and the involvement of the CFO and/or the fact that it could lead to the demise of the company are merely complications to be addressed in how it gets resolved and which other policies/procedures need to be invoked.

The second practical step (note that the issues get steadily harder to deal with) is to accept that it is irrelevant who is involved. It does not matter if it is a CEO or the graduate trainee who initiated the relationship or the sum of money fraudulently included on the expenses form.

The fact is that the policy exists and it has been invoked/breached. Therefore, as best you can, take the personalities/money/impact out of the equation and look at the underlying issues. This is easier said than done.

The third practical step is, especially if the unthinkable does involves the CEO, CFO or any other director, probably the hardest: determining and agreeing the scope/extent of the response.

However, before you do, there are a couple of standard practical steps, including taking a few minutes to step back (this should not be a time for navel gazing, no matter how tempting that is), working out how best to apply common sense to the situation – both of which may be difficult if the panic levels are rising – and also understanding who else is going to be affected by the unthinkable itself and the response, either directly or indirectly.

Teamwork

Once you have determined/agreed the scope/extent of the response, the final practical step is to work out who is going to be responsible for which aspects of that response and, therefore, how the policies and procedures link together – most big issues will always be the subject of several different policies.

So, think about:

(a) The make-up of the team that will lead the response (and whether you need a team to investigate the cause, as there may need to be separate teams);

(b) Who will lead the team(s);

(c) Who else needs to be told (and when) – ie the board, regulators, the market, executives, staff, clients, suppliers; and

(d) The role that communications (internally and externally) will play, including what should be said to journalists who call having heard something has happened.

Remember, your response will involve a number of other policies including those covering (if the company is listed) what to do if, and when, there is a market notifiable event (if the company is authorised and regulated by the Financial Services Authority); when, and how, to contact the company's regulator(s); and compliance with laws/regulations as well as more general policies (and procedures) regarding staff, clients and suppliers, including any overarching code of conduct.

At the same time, clarify what your role will be and who you will be reporting to in relation to the issue. Will your role be an advisory one or one that requires action from you? Will you report to the board, a committee or a designated individual?

In summary, the key to reacting to the unthinkable is to understand that nothing is unthinkable.

First, be familiar with what the policies/procedures say (at least in general). Then, when the unthinkable happens:

(a) Focus on the underlying issues and distil them down to the constituent parts;

(b) Don't let the personalities/roles of the individuals or the potential magnitude of the impact affect how you address the issue;

(c) Determine the scope of the response – but don't forget the basics such as applying common sense to the situation; and

(d) Think about the correct composition of the response team and ensure that you and they follow the appropriate sections of all of the relevant policies.

When you find yourself in an unthinkable and stressful situation, take time to listen to your instincts. As Malcolm Gladwell says in his book Blink, what you may think of as a snap decision is often a decision that, unbeknown to you at the time, is actually backed up by highly considered, but subconscious, thought.

And don't panic. You are the GC for a reason.

Dominic Bacon is managing director at consultancy Squaring the Circle and the former general counsel and group head of compliance at WorldSpreads Group.