Corporate governance during a crisis: Having a well-designed crisis management process is key

Boards of directors play a critical role in helping companies navigate through the unprecedented uncertainty stemming from the COVID-19 pandemic and the subsequent economic shutdown. Their actions and leadership can be decisive in determining how well their organizations survive the crisis – or whether they survive at all.

Crises are nothing new, of course. Crises of both small and large scale have occurred on a recurring basis for decades. Each presents organizations with new challenges and opportunities; however, the unprecedented COVID-19 crisis presents board members with challenges they’ve not previously experienced.

As an existential threat presenting health and economic consequences on a global scale, COVID-19 will test the skills of boards of directors in dramatically different ways from the 9/11 attacks or the 2008 recession. At the same time, it will provide a vivid example of the central value of active involvement by the board of directors in supervising and supporting management’s response to a crisis.

Crisis management as a process

A well-designed crisis management plan helps an organization respond appropriately and provides the board with a reliable standard it can use in helping to guide management’s actions and priorities. While it is too late to prepare for the coronavirus threat, it remains important to anticipate ancillary issues and unintended consequences of the various responses available to organizations.

Many crisis management models can serve as the basis for such a plan. In fact, entire books and university courses have been devoted to the topic. Without pretending to choose among the many alternatives – and without trying to duplicate any of their particulars – it can be helpful to review the basic process of crisis management. In broad terms, this process generally consists of five phases:

1. Preparation

The foundation of crisis management is a playbook containing crisis response procedures, communications templates, checklists and manuals that can be readily adapted to a variety of situations for rapid and effective deployment. Along with internal controls and risk management practices, the plan also should establish early warning systems and communication protocols, and identify cross-functional teams composed of representatives from management, public relations, human resources, legal and finance, along with others as needed.

2. First response

Time is critical at the outset of a crisis, especially now that social media often accelerates public awareness of issues. So the crisis response team should be trained and familiar with the plan in order to begin implementing it the moment a crisis is recognized. For the board of directors, at this stage, the first steps involve gathering as many facts as possible, making an assessment, defining the problem and adopting the right focus. In the case of the coronavirus, it is important to frame the situation accurately, identifying both the nature of the threat and the channels that will be involved. Clear, consistent communication – both internal and external – is essential. All concerned should avoid spin and monitor media coverage for accuracy.

3. Triage

Once the nature of the crisis is identified, even on a preliminary basis, the next step is to contain the situation, recognizing any areas where there are still gaps in information. In the case of the coronavirus, those gaps may persist for a number of months, or even years into the future. Boards should not be micromanaging the effort, but they should make sure management is taking reasonable and decisive action, considering various contingencies and responding to possible scenarios, such as confirmed cases of the virus among employees or government mandates that could affect operations. Boards should not hesitate to engage external advisers and outside counsel, but should also understand that this might result in conflicting advice.

4. Recovery

The objective in this phase is to re-establish business operations as soon as they can be managed safely, recognizing there may need to be changes in the operating systems and procedures. The board should work actively with legal counsel to be sure they understand all the relevant legal and regulatory issues, financial obligations and claims, and necessary disclosures at this stage. This is also the time to begin assessing any reputational damage that could occur as a consequence of the crisis. The goal is to get back to business as usual – or as close to usual as possible. In the case of the coronavirus, it also will be important to continue monitoring for possible recurrence of the disease.

5. Remediation

As business operations resume, the board should ensure management has identified or is working to identify the root cause of any issues that struck the organization particularly hard. Now is the time to revisit the crisis management plan and the overall enterprise risk management (ERM) program, identify any areas where they were deficient, and begin working to remediate any gaps or issues that arose.

Again, these five phases represent only one of many alternative ways to view the crisis management process. Regardless of the specific model being used, the board should be actively involved in crisis management planning. The level of involvement depends on the strength of senior leadership and should not supersede or displace management’s role.