It has been said that when everything’s a crisis, nothing’s a crisis. But over the past few years, we sure have seen a lot of genuine crises. School or workplace shootings, hateful and violent campus protests, hurricanes, food safety issues, cyberattacks, a pandemic, civil unrest, and getting caught up in a viral maelstrom in our contentious political climate (see, e.g., Bud Light). All have had profound impacts on organizations’ standing with key constituencies. The next crisis could be right around the corner, and the world will not be forgiving if we don’t handle it well.

I have had the privilege of serving as the Burlington County (NJ) Prosecutor, as senior deputy chief counsel to Gov. Chris Christie, and as associate counsel to President George W. Bush, and have learned a few lessons (some of them the hard way) about managing crises. Fundamentally, it is critical that organizations have a crisis management plan and be in position to respond effectively to prevent an emergency from becoming a crisis, or mitigate the consequences of whatever crisis arises.

Effective crisis management involves the following elements:

1. Forge a crisis game plan.

2. Focus on the safety of those directly affected.

3. Overcommunicate.

1. Have a gameplan before the crisis hits. A sound crisis management plan identifies the individuals who will be responsible for responding to a crisis and assigns them specific roles for that response. The group should meet periodically to “game plan” and develop check lists for responding to a reasonably foreseeable event. One important pre-incident focus should be on continuity of operations, addressing how to maintain operations if, for example, the entity has a COVID outbreak, or its facility is shut down for whatever reason. Most entities now are well-versed in remote operations, but COVID is yesterday’s crisis; organizations need to plan for tomorrow’s, and so 2020 plans should be revisited to ensure they will be effective in 2024-2025. Contact lists should be updated, and individuals reminded of their responsibilities if the organization’s activities need suddenly to be performed remotely or at an alternate site. Remote operations should be periodically “stress-tested.”

Having a team in place and a playbook for an anticipated, but not imminent crisis, is one level of effective crisis planning. Another is engaging early with an emerging situation to prevent a crisis altogether. Examples of such “incoming” potential crises include an oncoming hurricane or scheduled campus protests. Gov. Christie used to convene his cabinet and senior staff with roles in storm response as soon as it was predicted that New Jersey was in a storm’s path, and have frequent meetings before, during, and after the event to ensure that lifesaving measures were in place, relief resources were pre-positioned where they needed to be, and any potential bottlenecks to the response were eased. Everyone knew their respective roles.

As for campus protests, over the past year, we have seen good and very bad responses from universities, but by now, many campuses have seen enough protests to enable them to be proactive to maintain order. Institutions that have handled these protests well have engaged with protest organizers to learn about the expected size and what actions are planned (and/or done necessary research online or elsewhere to gain intelligence about the plans), and imposed reasonable time, place, and manner restrictions consistent with the First Amendment. They also have communicated in advance what the ground rules are and that they will enforce them to keep all students safe and the campus open. Gold star to those universities that then followed through and held accountable those who committed acts of violence or intimidation against other students or disrupted classes or other activities. This level of planning and engagement by institutional leadership typically has been the difference between those university communities that have experienced a protest, and those that have endured a crisis.

Sadly, active shooters are common enough in our society that it is institutional malpractice for organizations not to prepare for them. Calling 911 is not sufficient; it will take law enforcement some time to respond in an emergency where seconds, not minutes, count. Schools, synagogues, churches, mosques, and even gathering places for political organizations must maintain close relationships with law enforcement, with frequent communication about scheduled events and potential threats. New Jersey’s Office of Homeland Security and Preparedness (and similar agencies in other states) offers free security assessments, a resource guide including templates for emergency action plans, and grants to religious institutions for physical security enhancements. Federal security grants are also available and too often go unused. As for schools, effective planning for a school shooter includes frequent drills and limited and secure access to the building. School Resource Officers, to the extent available, should not be controversial—they present an effective deterrent and an immediate first line of defense against a school shooter.

2. Safety first. Crises often present a direct and imminent threat to the safety and well-being of community members whom an organization is obliged to protect. When such a crisis hits, it is crucial for leaders to focus all available resources on ensuring people are safe, which includes communicating timely information for people to get themselves out of harm’s way and neutralizing the threat itself. This may seem obvious, but in an ongoing emergency, leaders are beset by competing demands from the media, shareholders, customers, employees, or other constituencies. They all can wait. The most important thing is to minimize physical (or, in some instances, financial or environmental) harm to those most directly at risk.

Some suggestions for maintaining focus on safety:

• Limit the noise: In the worst-case, the most urgent scenario of a workplace shooting, law enforcement is trained to immediately confront and neutralize the shooter to minimize the loss of innocent lives and there is not time for contemplation. In scenarios where the threat is less imminent but still urgent and significant, such as an oncoming hurricane, an environmental accident, or a food recall, the safety threat must be addressed methodically and efficiently. To maintain focus on mitigating safety risks, leadership should have its pre-designated crisis management team “in the room,” supplemented by people with the relevant expertise to address the problem. Everyone at the table should have a role in addressing the crisis, and no one without a function should be present. This enables the group to work the problem without unnecessary distraction.
• Draw upon relevant expertise: Depending on the nature of the incident, it may be necessary to draw upon specialized expertise from outside the organization to address the problem. To the extent a type of crisis is foreseeable (however unlikely), a list of potential resources should be prepared ahead of time. For instance, a food manufacturer should have pre-established relationships with food safety experts, public health experts, supply chain experts, and a crisis public relations firm to draw upon in the event of, for example, a listeria outbreak threatening consumers’ health and demanding a recall.

• Bring the necessary resources to bear: Somewhat related to the prior point, an organization should ensure that it has sufficient resources on hand to keep safe those it is bound to protect and, to the extent possible, fix the problem. Revisiting the campus protest scenario, a university expecting a protest should ensure it has enough campus police or public safety officers on hand to keep its students, faculty, and staff safe. This may mean authorizing overtime or drawing upon mutual aid agreements with nearby law enforcement agencies to supplement its force. In another context, such as a chemical spill, the company must deploy sufficient resources to stop, contain, and clean-up the spill and protect people, wildlife, and the environment from further harm. In both examples, it is best to err on the side of deploying too many resources, not too few. You can always scale back, but if the situation overwhelms a paltry response, more people may be hurt, or worse, and a manageable crisis may spiral out of control.
• Communicate to those in harm’s way: When an emergency hits, communication is key to enable those in danger to protect themselves while help is on the way. Organizations should leverage technology to establish an effective early warning system with information people can use to limit their risk. Universities typically have effective alert systems to notify students of safety threats through an application on their cell phones. Financial institutions also handle this well with notifications of suspicious charges that enable their customers to respond and protect their assets. This model should be adopted elsewhere. For example, multi-unit housing developments and apartment buildings should have a similar notification program to notify residents of a gas leak or a fire so they can promptly and safely evacuate; a chemical company should establish and enroll members of its community into a notification program in the event of a chemical leak that might put those nearby at risk.

3. Overcommunicate. There are two levels of communication during a crisis. One, mentioned above, is providing information in-the-moment to those in harm’s way to reduce their risk. The other, less immediate level, is keeping stakeholders informed about what happened and what the response is as soon as practical.

With an emergency of any magnitude, the organization’s leader should be present at the scene of the incident or at the “command post” for the response. Employees and others with more direct responsibilities for the response—and the public—need to see that their leaders are in command of the situation and concerned for all who are affected by it.

Whenever practical, the organization’s leader should also be its chief spokesman for the crisis, or at least available to respond to questions from stakeholders at the appropriate time; this is no time to hide behind a public relations firm, although their guidance could be valuable. Seeing the leader at the podium inspires confidence in the response, while a lack of visibility can send a terrible message of a rudderless, uncaring organization that the public (or regulators) may want to punish for what went wrong. In this social media age, that “punishment” can be immediate and durably damage the organization’s reputation.

When and how much to communicate to the public can be a delicate balance. The cardinal rule, however, is to always be truthful. An organization or leader that lies to their constituencies during a crisis may never regain their trust. This may result in a series of periodic “this is what we know right now” hedges, or alternatively, “we are unable to provide more information right now because we do not want to compromise the ongoing investigation,” but even that is better than silence.

What type of information should be communicated? This will vary by the circumstances, but once appropriate, the organization’s leader, in regular updates, should state clearly and concisely:

• What happened;
• What is the present status of the situation, and the condition of those directly impacted;
• Where those directly affected can find (1) information, and (2) resources to help them recover; and
• What the organization is doing to rectify the situation, to the extent it is ongoing.

Recently, McDonald’s president Joe Erlinger appeared on the “Today” show to address an E. coli outbreak in Quarter Pounders, one day after the outbreak was announced. Erlinger did a good job, explaining that two ingredients—the beef patties and slivered onions—were being investigated as possible culprits in the outbreak; noting that McDonald’s had taken Quarter Pounders off the menu in the affected states; reinforcing that food safety is the company’s highest priority; and pledging to work closely with the CDC in its investigation of the outbreak.

Conclusion

It may be a cliché that “failing to plan is planning to fail,” but there is truth to this expression. With a crisis of some nature becoming ever more predictable, anticipating what incident(s) could happen, taking steps to prevent that which is preventable, and enlisting the key individuals and resources that may be necessary for an effective response will put the organization and its leaders in the strongest position to limit the harm from an incident, and perhaps prevent an emergency from becoming a crisis at all.

Scott A. Coffina is a partner and the co-chair of the government enforcement, compliance & white collar litigation practice group of Pietragallo Gordon Alfano Bosick & Raspanti. He is the former Burlington County Prosecutor, and a former senior deputy chief counsel to Gov. Chris Christie, and associate counsel to President George W. Bush.