Download this article in PDF form

Visit the NACD Website

Find out more about the authors' latest book

Suzanne Hopgood's Bio

Now is a good time for directors to ask this question, especially if it has not received focused attention from the board as a regular agenda item. 2005 was notable for the many natural disasters that struck in the United States and internationally, straining communities, companies, relief organizations, and governments to, and past, the breaking point. The Refco case seemed to be a replay of take down senior managers, armed with the new enforcement tools delivered by the Sarbanes-Oxley Act of 2002. Calpine's board replaced senior management in the middle of a financial crisis. Mass Mutual's board did the same thing in the midst of regulatory inquiries and withering press coverage of allegations of ethics breaches by the CEO.

Wal-Mart Emerges as a Victor, not a Victim, in the Wake of Katrina

Wal-Mart stores are everywhere in the United States, so any large-scale natural disaster is going to strike a number of them. This exposure and experience have produced an understandable, and effective, commitment to crisis planning at a very detailed level. Wal-Mart has established an internal management group charged with crisis preparedness and response, under the direction of a senior officer. The group has developed protocols to be followed by local management to batten down a store in the direct path of a hurricane so as to limit damage, and then to reopen it on an expedited basis. Wal-Mart also had in place a post-hurricane relief program, which in the case of Katrina donated $20 million in cash, 1500 truckloads of merchandise, and food for 100,000 meals to the relief effort, a humanitarian gesture that stood as a stark rebuttal to any possible assertion that Wal-Mart was profiting from the disaster.

Reputational Risk

Imagine for a moment that Wal-Mart's managers had understood their prime directive under the circumstances as protecting their employer's property. If instead of giving away merchandise, they had held hungry, homeless, and desperate people at gunpoint at the door--if the news headline was of a Wal-Mart manager shooting and killing "looters" trying to break into the store looking for food and water in the dark,dark night after the hurricane had passed. The damage to Wal-Mart's reputation would have been tremendous.

Is this the sort of risk that any company wants to leave up to the discretion of its front-line employees, without benefit of guidance from management? No. But if the company does not consider this scenario as part of its crisis planning, that is exactly what it is doing.

It appears that the quality of the individuals Wal-Mart selected as managers, the company's culture and commitment to serving the basic needs of its customers, and assurance resulting from the effective crisis plan in place, combined to give managers like Jessica Lewis the confidence to open their stores and give away thousands of dollars of Wal-Mart's goods to the victims of Katrina. This was not part of their crisis response plan, they were not instructed to do this by any senior manager; they just did it. And hoped that management would support them.

Wal-Mart's response to Katrina shows very clearly that:

• Even a "best practices" level crisis planning program like Wal-Mart's can encounter the unexpected and unplanned-for event.
• The existence of an effective crisis plan will support good decision making under even the most trying and confusing circumstances by rank-and-file managers and employees.
• Companies take on significant risk when they engage in only limited, incomplete crisis scenario planning, preparation, and practice.

The major crises of 2005 and the resulting detailed media coverage have provided the public, including directors, with an opportunity to follow in excruciating detail the steps, and missteps, of the organizations affected. Some were well prepared, and responded swiftly and with success. Others were unprepared for the extent of the disruption they experienced and suffered the consequences, ranging from embarrassment to large shareholder and creditor losses, devastated employees, or the complete loss of the enterprise.

Who is responsible for assuring that a company is well prepared to meet the crises of 2006 and beyond?

The board. This is not to say that management's role is not critical to an effective crisis planning and response process, or that the CEO should not be taking the lead. The primary task of a company's leaders, according to Peter Drucker, is "to make sure of the institution's capacity for survival -- to make sure of its structural strength and soundness, of its capacity to survive a blow, to adapt to sudden change." Assuring that thorough crisis planning has been done by management is an important element of the board's oversight. There is a broad range of possible action by a company in the area of crisis planning -- the board's informed judgment on how much is appropriate should be expressly brought to bear on this question. It is much too important to leave to management without board oversight.

Planning is the Key

The extent to which an organization is effective in planning for the occurrence of a crisis will have a very large impact on its success in managing that crisis, and may even result in preventing a crisis. Effective crisis planning requires the commitment of the board and management, and their acceptance of their responsibility to assure the strength and survival of the company when faced with a crisis. It requires them to accept the idea that crises are difficult to predict with certainty, and that no company is immune. Experience has shown that the act of thinking carefully about how crises develop, manifest themselves, and then expand as new problems result, will often result in the adoption of policies and practices that prevent crises from happening in the first place.

There is sometimes a perception that extensive crisis response planning -- evaluation of the full range of risks facing the company, planning for multiple crisis scenarios, using valuable management and director time, and calling on expensive outside advisors -- is an unjustifiable expenditure relative to the perceived level of risk. Management or the board may feel that "that sort of thing won't happen here" or "we are smart, nimble, and lucky and can figure it out on the fly if we have to." Or management may present the board with what appears on the surface to be a crisis response plan, but which turns out to be of limited value because it is incomplete or overly general. Those are precisely the attitudes of the leaders of the companies that have been severely damaged or destroyed by unplanned-for crises that have spiraled out of control.

The authors have identified six compelling reasons why directors should insist that management and board attention be focused on crisis response planning:

1. Even limited planning will help the company to avoid common blunders, particularly in managing communications, that turn manageable crises into disasters.
2. Planning will decrease the number of decisions that must be made in the early stages of a crisis and allow more attention to those that remain, improving the quality of decision making.
3. Organizing the company's crisis response team in advance will allow the necessary expertise to be assembled quickly and begin working immediately when a crisis hits. Good outside advisors are not easy to find; planning will help assure they are available when needed.
4. Many crises begin as manageable problems that then escalate to disastrous proportion. Focused crisis planning makes it more likely that potential crises will be contained before they escalate.
5. Directors are obligated to use ordinary care in their decision making and oversight of the company. Ordinarily careful and prudent individuals buy insurance and make plans to weather personal disasters. Companies should engage in crisis response planning for the same reasons.
6. While the prospect of directors encountering personal liability for failing to engage in crisis planning is generally remote, when a crisis does arrive, ill-advised responses of the board, management, and employees can create liability for individuals and the organization. Crisis planning will identify these risks and how to avoid them.

How to Get Started?

The challenge for a director or board that wants to evaluate the true degree of crisis preparedness of a company is knowing where to start and how to go about it. This can be a particular challenge if the individual experience of the board with crisis planning and response is limited. The authors wrote the recently published NACD Directors Handbook Board Leadership for the Company in Crisis in part to provide an informational base for directors seeking to assess a company's crisis preparedness. Or the board can seek expert advice from a variety of crisis management and consulting firms.

Start by Asking Management

An obvious place to start is to ask management to describe in detail the company's crisis planning process and the resulting planning tools.There is a broad range of activity that might support an officer saying that the company is well prepared for whatever crisis may come.Even if there is a thick binder on a shelf in the executive suite labeled Crisis Response Plan," that may not be evidence that the company is really prepared. A company's written crisis response plan can be the product of anything from a weekend planning session four years ago to several man-years of work by a crack team of crisis-savvy managers and professional advisors that is being updated monthly.In the first instance, the company is at significant risk of being unprepared for a serious crisis; in the second case, the company's management may be reasonably well prepared.

But Don't Finish There

Directors auditing a company's crisis response planning should determine whether the company has the following elements in place:

• "Best practice" corporate governance standards.
• High ethical standards throughout the organization.
• A well-functioning risk management program.
• Regular efforts to identify and evaluate specific risks.
• Well-developed hypothetical crisis scenarios and detailed responses.
• An identified "chief risk officer" or executive in charge of crisis planning.
• A multidisciplinary crisis response team.
• Regular performance of crisis response drills.
• Response skills training, including media relations.
• A written company-specific crisis response plan.

The presence of these elements at a company will make it much less likely that a serious crisis will develop, or if it does develop, that it will spiral out of control. On the other hand, their absence will magnify the likelihood of a downward spiral scenario.

1. Does the company maintain "best practice" corporate governance standards? The quality of a company's governance will have a direct impact on many of the factors that contribute to business crises. Insistence on high standards communicates itself throughout the organization as a commitment to doing things the right way, and as a refusal to cut corners. A well-qualified, functioning independent board assures that the company's oversight will be given the necessary scrutiny, free from conflicting interests and relationships, and unimpeded by a reluctance to ask the hard questions.

2. Does the company insist on high standards of integrity in the executive office and throughout the organization? Strong ethical standards will increase the likelihood that honest and thorough reports of impending problems are made to senior management and the board as soon as they are spotted, rather than remaining hidden. When a crisis does hit the company, its response will be less likely to be impeded by lying, blame- shifting, withholding of information, and similar behaviors. If the answer to this question is no, the company is at much greater risk of encountering crises that arise from dishonesty or illegal behavior, or which are allowed to grow to unmanageable size as they remain hidden.

3. Does the company have a risk evaluation and management program? Many companies have a formal risk evaluation and management program--an enterprise risk management (ERM) program--while others approach the issue on a much less formal basis. If a company has an ERM program and it is effectively executed, it will identify most if not all of the risks that crisis response planning should address. Without a thorough understanding of the particular risks the company faces, it is not possible to prepare a thorough crisis response plan. If a company has not engaged in a systematic review of the risks it faces on a regular basis, there is a greater likelihood that material risks facing the company will not be identified as objects of planning until they develop into crises. Preparing a crisis response plan will require more work in these companies, and any plan produced will be more likely to overlook subtle and complex sources of risk to the company.

4. Does the company regularly identify specific risks affecting its business that could develop into problems of crisis proportion? Effective crisis planning requires a regular review of the company's business and its environment to identify risks that could develop into a crisis. These risks should be studied thoroughly enough that they can be described in some detail in a "crisis scenario" that identifies the immediate causes and effects of a particular crisis event on the company. It is important to identify second- and third-order consequences of the crisis, inside and outside the company. What is required is enough information to support a detailed crisis response plan that would be effective to manage the situation to a favorable conclusion if it actually happened. Circumstances change frequently enough that this subject should be evaluated annually, at a minimum.

5. What is the current list of crisis scenarios that have been identified for inclusion in the company's crisis planning? Management should be able to produce a listing of possible crisis scenarios on request. For each scenario, the company should be able to identify how specific stakeholder groups associated with the company -- employees, shareholders, customers, vendors, lenders, print and electronic media, etc. -- will be impacted and how the company will respond to them. The scenarios should also address the specific resources the company will need to respond to that scenario, including company personnel, outside advisors, financial resources, material goods, and auxiliary sources of essential services. If a director can off the top of his or her head think of several plausible crisis scenarios that could impact the company, or a stakeholder group or two whose interests and concerns have not been considered, the company is only partially prepared and a more thorough approach is indicated.

6. Who within the company is responsible for managing risk identification, crisis planning, and crisis response? Are they qualified and ready? It is becoming more frequent for companies to have a chief risk officer or a senior executive with another comparable title who is responsible for driving the risk assessment/management function and coordinating the crisis planning and response process. Or it may reside with the CFO or the general counsel. A key question is whether both the CEO and at least some members of the board have experience in crisis planning and response. Management's risk management, crisis planning, and response agenda should be subject to oversight and accountability by the board or a board committee. Some companies have created a distinct risk management committee with oversight for both risk management and crisis response. The absence of clear lines of authority and oversight can result in the subject of crisis planning being short-changed by managers with other priorities, and increased confusion in the early hours of an actual crisis.

7. Who is on the company's crisis response team, and why? Management should be able to quickly identify the core group of individuals, inside and outside the company, who would shape the company's response to a crisis, and their areas of responsibility and competence. Ideally there should be one or more directors who have been identified as having relevant experience. Key outside advisors such as SEC counsel, criminal defense counsel, communications advisors, and the like should be carefully selected before they are needed, and included in the company's crisis planning efforts. The CEO and board should also know who would step in if the CEO is not in a position to lead the company's response. The company should maintain current 24/7 contact information for all of the individuals who may be called on to respond to a crisis. This information should be readily available. The company should also maintain similarly detailed contact information and a communication plan to support the exchange of information with the company's stakeholder groups. Without this preparation, the company is at significant risk that critical individuals will not be available to aid its response if a crisis strikes.

8. Has the company performed crisis response simulations? The crisis management team at a well-prepared company will meet to discuss and update their plans at least once a year, and if there is a designated crisis management function, more frequently. Depending on the nature of the business and the scenarios that have been identified, a well-prepared company will run detailed simulated crisis response scenarios at least once or twice a year. For mission-critical functions that require redundant systems, the tests may need to be more frequent. Companies that have performed these drills frequently encounter unanticipated obstacles to a full response, revealing an unexpected risk of delay, mistakes, and failure when a real crisis hits.

9. Has the company invested in crisis response skills training? Even the most well-spoken,quick-tongued CEO, CFO, or general counsel, when put under the glare of live "News at 10!" cameras in the midst of a fast-breaking business crisis, is not going to be prepared to respond effectively on behalf of the company. The differences between a company spokesman who is media-trained and prepared and one who is not are usually very plain, and painful, to see. A company prepared for crisis will provide media training to its top two or three potential spokespersons. As a small industry has developed around the subject of crisis management, it is now also possible to seek additional training on a broader set of crisis planning and response skills.

10. Does the company have a written crisis management plan? A crisis-prepared company will have a very thorough document, developed internally by its crisis response team, that addresses the full range of subjects described in this checklist, and that shows signs of being kept current. It will include:

• Names and contact information for the crisis management team.
• Identification of key information sources inside and outside the company.
• Developed crisis scenarios, analyses of the resources required to respond to them, and their impact on the company and the interests of the company's stakeholders.
• Instructions and authority for the company's first responding employees.
• Communications plans, including initial drafts of prepared statements.
• Plans and tools for rapid and thorough communication with all stakeholders.
• Legal advice and instruction focused on common issues in crisis response, such as dealing with government agents.

The Evaluation and Planning Cycle

Once there is a base of planning for crisis management, the next question is: How frequently should the process be evaluated and repeated? It will generally make sense for the board's agenda to include regular reports from the managers responsible for the process. Reevaluations should be scheduled on a regular basis that is reflective of how the company has gone about classifying the various risks -- more frequent reviews and reevaluations for significant short-term or particularly sudden sorts of risks, less frequent reviews for longer-term risks. One possible breakdown of responsibility for evaluating particular categories of risk and the frequency of board oversight of this function would be:

Conclusion

There is no better time than the present to ask if your company is prepared to face the sorts of ordeals that were frequently in the press during 2005. Experience has shown that it is prudent for companies to invest time and money on the "three Ps" -- planning, preparation, and practice -- before a crisis hits, in much the same way, and for the same reasons, that buying insurance is prudent. Prepared boards understand that crises can strike any company, even "best practices" leaders with everything going for them. The prepared company is able to respond to crisis events swiftly and surely in a way that minimizes the damage to the company, prevents one or two manageable problems from cascading into a disaster, and gives assurance to employees and other stakeholders. The board and management of a company that is not prepared will have to do all of this same work when a crisis does strike -- only under extreme time pressure, without the benefit of critical resources, and with a much greater likelihood of mistakes and missed opportunities that can damage or threaten the existence of the enterprise.

Suzanne Hopgood is president and CEO of the Hopgood Group LLC and a turnaround CEO. She serves on the board of Acadia Realty Trust.

Mike Tankersley is a partner of Bracewell & Giuliani LLP. They are the authors of NACD's Board Leadership for the Company in Crisis, www.nacdonline.org.