Search
By: Scott A. Coffina
Organizations can face a crisis at any time. It can be specific to them, such as a food recall, a data breach or workplace violence, or it can be a crisis from the effects of a situation beyond its control, such as a hurricane or other natural disaster. In the immediacy of a crisis, an organization can effectively manage the situation with (1) advance planning and having a team in place with assigned roles; (2) focused attention and sufficient resources to minimize the impact on those for whom the organization is responsible; and (3) frequent communication by organizational leaders with clear information about what has occurred, the present status, and how those impacted can connect with resources to help them recover.
An organization’s leaders’ work is not finished once the immediate crisis subsides. There is still work to do to help the organization and those affected by the situation recover and transcend the crisis and refocus on the organizational mission. This article discusses how an organization can move beyond the “acute phase” of a crisis and navigate through the “recovery phase” to successfully put the entire matter behind it.
While it is difficult to generalize, because each situation is different, successfully managing the aftermath of a crisis typically involves four specific elements: (1) Support those affected; (2) investigate what happened and how the organization responded; (3) take corrective action to avoid similar issues; and (4) liaise with local, state, and federal authorities.
1. Provide Support. Whether or not an organization technically is “at fault” in the crisis, making an effort to support those who have been affected by the incident is another important element of crisis management. It is common to see organizations step forward and help those who have been impacted. Examples: Schools routinely provide counseling to students and staff following acts of violence, and credit card companies provide free credit monitoring services after a security breach.
It is especially worthwhile to provide assistance and/or support proactively for victims of incidents caused by the organization. To the extent feasible, doing so before the inevitable lawsuits are filed and being compelled to make amends can accelerate the recovery of the organization, in addition to the victims, and ultimately save litigation costs and rebuild goodwill.
If the organization is not in position to provide direct support itself, or the situation does not place that onus on the entity, it is still advisable to provide information about available resources and help connect those affected by the crisis to those resources. The bottom line: Besides the inherent desirability of helping those who have been harmed, it is essential that the organization and its leaders demonstrate that they recognize and care about what happened and those most directly impacted by it.
2. Investigate. One common theme of crises is that there are always lessons to be learned. It is important, therefore, that the organization conduct an after-action investigation to determine (a) what caused the crisis, and whether and how it could have been avoided; (b) even if unavoidable in the first instance, whether changes in policy, procedures, or infrastructure are needed to avoid a repeat incident; (c) whether anything that occurred in the incident is reportable to regulatory authorities; (d) how the response to the emergency was handled; (e) how the communications about the crisis were handled; and (f) what if any continuing obligations are there to those impacted by the incident.
A prompt, effective investigation allows the organization to understand what happened and take corrective action, and to assess, prepare for, and effectively respond to potential litigation or governmental investigations or enforcement actions, without being caught on the proverbial “back foot” when the subpoenas or summonses arrive. It also enables preparation for the next crisis—with weather-related emergencies, for example, there’s always another storm coming.
Like many internal investigations, the post-crisis investigation should be conducted under the guidance of counsel with the protections of the attorney-client privilege. This approach can promote more candor by witnesses and give the organization time and space to assess its liability and how to structure its response to the incident, particularly while the facts are still being uncovered.
Nevertheless, with many high-profile crises, it will be necessary to report to stakeholders, regulators, and/or the public what happened and why. Transparency is often a crucial element to reclaiming the public’s trust in the organization. In such circumstances, the investigation can be approached at the outset with the expectation that a non-privileged report will be prepared and released to the public, and if thoughtfully handled, this report can be issued to sufficiently address stakeholders’ questions while preserving the privilege covering the investigation.
3. Take Corrective Action. The next element of navigating through the aftermath of a crisis is taking whatever actions are necessary, based on what is learned in the investigation and other aspects of the incident and response, to ensure it doesn’t happen again. Even if the organization handles every step in its management of the situation flawlessly, its overall response will still be a failure (and the public and regulators will be especially unforgiving) if it does not hold those responsible accountable for their failures (if applicable) and/or does not take the corrective actions necessary to avoid the incident from recurring. Food manufactures are not given much grace for a second listeria outbreak if they did not take sufficient corrective action after a first.
To cite an example of effective corrective action, consider the University of California, Los Angeles. UCLA was beset by pro-Palestinian protests over the Israel-Hamas war in the spring of 2024 that in some instances turned violent and/or blocked Jewish students from accessing the library and other areas of campus. Over the summer, a federal court ruled that UCLA is required to preserve Jewish students’ access to all campus activities (including instruction), or may not conduct those activities at all.
The university then took responsible corrective action. At the start of its fall semester, the school issued new rules for protests with reasonable time, place, and manner restrictions that were widely communicated to students. These new rules designate free speech zones on campus and prohibit blocking access to campus buildings or walkways. The Board of Regents also approved more non-lethal weapons for campus police, to help maintain order if protests escalate to violence.
There are no guarantees, of course, that new campus protests won’t escalate and cause harm to UCLA students, but the university’s new rules for campus protests provide an example of prudent corrective action that should help keep students safe and the classrooms open and put the menacing spring protests behind it. In the fall of 2024, while UCLA has continued to see protests related to the Middle East war, the campus has not experienced the disruption it had previously seen.
4. Liaise with Law Enforcement. Routine communication with law enforcement and other first responders is a critical part of crisis prevention and management; they usually have an important role in addressing a crisis at the height of its impact. However, when the “acute phase” of the crisis passes, it remains valuable to have ongoing communication with government officials, specifically now regulators or agencies that have enforcement authority over the entity. Some crises, such as a data breach, require notification to law enforcement as a matter of law. There may be other disclosure obligations revealed in the organization’s after-action investigation. Having open lines of communication with the relevant regulators could have a positive impact on how such disclosures are received and obviate or mitigate enforcement action.
Particularly after a high-profile, man-made crisis, an investigation by federal or state regulators is to be expected. McDonald’s, for example, will be spending time with the Food & Drug Administration in the near-term over its recent E. coli outbreak. How to respond and defend the organization in such an investigation is a discussion for another day. But maintaining active communication with the government can avoid time-consuming collateral battles about the conduct of the investigation, and could help streamline the path to a positive (or at least final) resolution of the crisis.
Conclusion
When a crisis recedes, there is a tendency, and certainly a desire, for an organization to want to quickly put the matter behind them and restore a sense of normalcy. That reaction is natural, but to truly advance beyond the crisis, it is imperative that organizational leaders see the matter through the recovery phase by assisting those who have been affected and addressing the causes and the consequences of the crisis, particularly when the situation arose from some action on the organization’s part. By handling the aftermath strategically and compassionately, leaders not only can put the immediate crisis behind it, but also refocus on the organizational mission and help restore and perhaps even enhance the organization’s standing in the community.
Scott A. Coffina is a partner and the co-chair of the government enforcement, compliance & white collar litigation practice group of Pietragallo Gordon Alfano Bosick & Raspanti. He is the former Burlington County Prosecutor, and a former senior deputy chief counsel to Gov. Chris Christie, and associate counsel to President George W. Bush.
Reprinted with permission from the December 5th issue of the New Jersey Law Journal. © 2024 ALM Media Properties, LLC. Further duplication without permission is prohibited. All rights reserved.
Original article can be found here, Navigating the Storm: Pulling Through a Crisis When The Worst Is Over (Part 2).