For lawyers who spend their waking hours advising clients on how to navigate litigation and other significant business and personal matters, having the time to plan for threats to their own firms may seem like a luxury. And in years past, most firms could get by without putting much thought into how they would face a crisis. The endless cycle of online news and social media had not yet upended the way crises unfolded and spread, and there was simply more time to react, making planning for crises exactly that, a luxury.

In the current climate, firms that don't take seriously the very real reputational and business interruption threats that face them are taking on significant risks that could be mitigated—if not avoided altogether—by thoughtful preparation. Major crises such as data breaches and sexual misconduct investigations that have damaged the reputations of U.S. corporations over the past year are just as much of a threat for law firms.

The good news is that the analytic and communications skills that make lawyers successful can also be leveraged to help them and their firms anticipate and navigate a crisis. It's just a matter of having the foresight to take these risks seriously and the discipline to sit down and plan for them.

A Holistic Approach

Law firm management should take a comprehensive view of risk management and mitigation, much as they do when helping their clients. With the risks law firms face becoming more apparent every day, many firms are taking necessary steps to prevent or prepare for the inevitable. This includes developing incident response plans, securing the right insurance policies, conducting forensic assessments and penetration tests and hiring dedicated risk management and chief information security officers.

Although planning for crises is now more commonplace than before, the communications aspect of crisis planning is often woefully inadequate. Even for expert communicators, a fly-by-the-seat-of-your-pants strategy to post-crisis communications can put a firm's entire reputation on the line. An effective communications plan will help firms better manage media coverage by ensuring their messages are being conveyed and that they are equipped to correct any inaccurate information that surfaces. Reputation management is critical to law firms who rely on referrals and their clients' trust for the survival of their business.

Not incorporating a communications strategy into incident response planning also means firms are not taking full advantage of the value of other service providers. For example, forensic investigators can help assess risk, determine the greatest vulnerabilities and prioritize threats. If firms don't use this information to develop a communications plan in advance of a crisis, they put themselves at considerable risk.

Another added value is using a communications plan to tell customers and employees of all the steps taken in response to a crisis. Even if a firm is not in a position to provide details on the scope of a data breach, it can inform key parties and personnel that a top forensics firm has been hired to lead an investigation and it will provide additional details as soon as they become available.

How to Prepare a Communications Strategy

Firms may think they have a handle on crisis preparation, but without a communications plan in place, they are sorely mistaken. Receiving sign-off on the plan from the firm's leaders alone can be a time-consuming process. Starting that process after social media and the press have caught wind of the crisis can be disastrous.

By the time the first reporter query arrives, a firm should already know who the spokesperson is, the message it wants to deliver and the means by which that message will be disseminated. Equally important is preparing communications directed to employees and clients. Keep in mind that messaging needs to be consistent. While there may be different messages for each audience, they must be driven by the same underlying facts.

Some believe that you can't develop a communications plan due to the unpredictable nature of a crisis. That's far from the truth. Without a crystal ball, no one can predict exactly what crisis might befall their firm, but a crisis team can take inventory, incorporating assessments conducted by risk managers and forensic teams to determine a firm's vulnerabilities and tier the risks to determine which are most likely.

Firms can also assign staff to an incident response team so that the responsibilities are clearly delegated in advance and no time is lost when minutes matter most. In addition to spokespeople, other important roles will include the communications team lead, the internal liaison, the client liaison and the social media manager. Each of these team members should have a clear understanding of what is expected of him or her in the event of a crisis and how they will work with each other.

What Should Your Communications Plan Look Like?

In the crisis-laden world in which law firms operate, communications plans need to serve as real-time resource guides that include actionable and clear information to be used by the team tasked with responding to a crisis.

The plan should include crisis response timelines, drafts of internal and external holding statements, strategies and suggested language for communicating with various audiences throughout the life of the crisis. It should outline a plan for monitoring and correcting reports in traditional and social media, and a strategy for announcing the resolution to the crisis. The document should also include an incident response checklist and a list of members of the response team, with clearly drafted roles and responsibilities.

In drafting the plan, consider how different scenarios require a different level of touch and tactics for communicating. Determine how and when to use social media, in which instances to call clients directly, and what agreements to have in place with external service providers to avoid negotiating contracts in the middle of the crisis.

Once a plan is in place, it is important to test that plan with the full incident response team. Tabletop exercises can help identify gaps and uncover weaknesses firms may have otherwise overlooked. They also confirm that the incident response and communications plans work hand-in-hand.

Set Yourself Up for Success

No one can predict the future and know what type of crisis will hit and when. But what law firms can do is learn from the past and the unfortunate fates of others by planning for the bad while they have the luxury of doing so. Those that do will be in a far better position to minimize reputational harm and reduce the risk of related litigation and the exodus of clients, lenders and partners that can topple a firm.

Zach Olsen and Jesse Dungan are senior members of the crisis response and reputation management group at Infinite Global.