strategic planning for in-house counsel€¦ · 1. two days later, starbucks apologizes in a brief...

© 2018 BLANK ROME LLP. ALL RIGHTS RESERVED. PLEASE CONTACT BLANK ROME FOR PERMISSION TO REUSE.

Strategic Planning for In-House Counsel

Disasters, Security Breaches, #MeTooMinefields…and More

August 8, 2018The Hollywood Bowl


ACC Hollywood Bowl,8 August 2018

DISASTER PLANNING:BEING PREPARED FOR THE CRISIS

Dennis M.P. Ehling, moderator

Cheryl Chang, Allen Chiu, Linda Kornfeld, Laura Reathaford


Overview

3


Overview

• Best practices for business disasters or “crises”

Crisis: An abnormal and unstable situation that significantly threatens the organization’s strategic objectives, reputation or viability.

• Crises are normally determined by how they impact an organization’s people, environment, assets, and/or reputation.

• Disaster preparation goal: Get company back to operating normally ASAP

4


Anatomy of a Disaster in the Making

Examples

5


Crisis:

• A manager at a Starbucks in Philadelphia calls the police on two African-American men waiting for their friend to arrive. The men are taken away in handcuffs.

Starbucks: Racial profiling


Response:

1. Two days later, Starbucks apologizes in a brief tweet.


Image source: Twitter


Response:

1. Two days later, Starbucks apologizes in a brief tweet.

2. CEO Kevin Johnson writes a longer apology to employees, and releases an apology video to the public.

3. Starbucks closes 8,000 stores for a day of racial bias training.


Starbucks Chairman Howard Schultz

Image source: https://www.forbes.com/sites/shephyken/2018/05/10/starbucks-gets-an-a-in-crisis-management/#95f873a7998c


Public reaction was positive.

1. Initial anger at brevity of initial tweet, response time

• #BoycottStarbucks

• Protests

2. Longer apology was sincere; CEO took blame.

3. Words backed by actions:

• Multimillion dollar loss from store closures on May 29.


“Regretfully, our practices and training led to a bad outcome—the basis for the call to the Philadelphia police department was wrong.”

–Starbucks CEO Kevin Johnson

Image source: https://news.starbucks.com/contact/leadership/kevin-johnson


Crisis:

• Cambridge Analytica collected the personal information of at least 87 million Facebook users

• Used data to influence voter opinion

• Facebook learned of data breach in 2015 but did not publicly acknowledge

• No audit conducted

Facebook: Data privacy

Image source: Wikipedia


Response:

• Four days after the news broke, Facebook CEO Mark Zuckerberg posted an apology on Facebook.

• Acknowledged fault

• Described breach of trust

• Listed actionable items

Image source: https://www.ocregister.com/2018/03/20/cambridge-analytica-breached-your-facebook-political-cartoons/



Public reaction was negative.

• Response time was too long

• Anger that Facebook had not acknowledged the problem in 2015

• FB stock went down

• US senators are considering heavier regulation on data companies


Image source: https://www.publimetro.com.mx/mx/noticias/2018/04/10/zuckerberg-asume-ante-senado-ee-uu-toda-la-culpa-la-filtracion.html

Zuckerberg testifies to Congress about Cambridge Analytica and Russia.



Crisis:

• Roseanne star Roseanne Barr

• Roseanne Barr tweeted a racist, conspiratist remark about Valerie Jarrett, one of President Obama’s closest advisers.

ABC: Offensive tweets

Image sources: Twitter, https://www.nytimes.com/2018/05/29/business/media/roseanne-barr-offensive-tweets.html


Response:

• Barr was immediately fired, and Roseannecancelled.

• Bob Iger, CEO of ABC’s parent company Disney, tweeted the following:


Image sources: https://www.theverge.com/2018/5/29/17406038/roseanne-canceled-barr-racist-tweets-valerie-jarrett,


Public reaction was positive.

• Barr was immediately fired, and Roseanne cancelled.

• Swift response

(2 am > next morning)

• Public lauded speed and severity of response.

• Even cast members on Roseanne approved the decision.


Image source: https://www.theverge.com/2018/5/29/17406038/roseanne-canceled-barr-racist-tweets-valerie-jarrett,

President of ABC, Channing Dungeny, discussing Roseanne’s cancellation.


Analysis of ABC’s decision

“Golden hour” of crisis response

“If you respond quickly, you get to frame the narrative, rather than allowing other people to frame your actions and motivations for you. That is the key to surviving a crisis on social media.”

–Kaira Alaimo, who teaches public relations at Hofstra University


Image source: https://www.theverge.com/2018/5/29/17406038/roseanne-canceled-barr-racist-tweets-valerie-jarrett,


Crises

• Susan Fowler’s letter

• Poor behavior and emails from CEO Travis Kalanick

• Bleed of senior/executive leadership

• Surge pricing at JFK airport

• “Miami letter”

Image source: Business Insider

Uber: Sexual harassment, gender bias, payment scandals


Response

• Uber appoints Frances Frei to help change workplace culture and fix leadership problems.

• Uber fires over 20 people as a result of investigation.

• Kalanick steps down.

• New investigation: Uber makes 47 specific changes.

Image source: https://www.businessinsider.com/uber-scandal-crisis-complete-timeline-2017-6#june-6-uber-fires-over-20-people-for-bad-behavior-22

Uber CEO Travis Kalanick



Public reaction is generally negative, but Uber is still popular.

• #DeleteUberboycott

• Still dominating the market for ground transport

Image source: Business Insider



Anatomy of a Disaster in the Making

Context

20


Crises in different contexts

• Natural disasters

• Political upheaval

• High-profile #MeToo

• Whistleblower

• Cyber-attacks

• PR explosion

• Bet-Your-Company litigation or allegations, including criminal allegations

21

Image source: https://cdn20.patchcdn.com/users/393328/20160720/105055/styles/T800x600/public/article_images/5572599846_089284edef_o-1469026247-4135.jpg


Why Here, Why Now?Why Is This a GC/IHC Concern?

22


GC/IHC job

• Involves looking out for significant risks to business and bringing to the company’s attention

• Lack of readiness leaves companies vulnerable

•GC/IHC has skills uniquely beneficial to this job

23

Image source: https://st2.depositphotos.com/3591429/5993/i/950/depositphotos_59930061-stock-photo-business-people-and-economic-crisis.jpg


GC/IHC job

•GH/IHC skills uniquely beneficial to this job:•Asking relevant questions

•Assessing risks, seeing risks others might not

•Experience across different business units• Business units trust GH/IHC

• Break down barriers between units

•Attorney-client privilege covering planning process• Considerations discussed in developing a plan

• Issues uncovered in planning process

• Communications with insurance brokers and internally about possible insurance.

24


Planning for Disasters: It Starts with a Plan

25


Planning for Potential Disasters

• Being prepared starts with anticipating disasters, and planning how to address the risk

• More likely to come through the “disaster” well

• Less likely to suffer critical mistakes

• Able to return to normal operations more quickly

• Two components to preparedness:• Preventative Management

• Crisis Management

26


Why have a plan?

•Obtain buy-in TODAY from people who will need to execute the plan during crisis

• Identify resources beforehand

• Identify necessary training

•Reflect company’s core culture and values during crisis

27Image source: https://lh3.googleusercontent.com/--q03uZjkTGU/VgFJo9y7aeI/AAAAAAAAfHE/enRjZt089Q4/s800-Ic42/niche-site-project-planning.jpg


Without a plan:

• No recognition of warning signs• Slow response to crisis

• Company loses “big picture” focus during crisis

• Poor communications• Wrong people with wrong skillsets

handle crisis poorly

• Fear and/or bullying prevents effective action

• Lack of effective post-incident reviews

• No quick resolution

28Image source: https://resources.findmeagift.com/site_media/images/products/p_main/fun145_panic_button.jpg


Accessibility of plan

•Plan must be easily accessible to those expected to execute• Hard copy or

electronic

•Familiar to everyoneinvolved in its execution

29Image source: https://lh3.googleusercontent.com/--q03uZjkTGU/VgFJo9y7aeI/AAAAAAAAfHE/enRjZt089Q4/s800-Ic42/niche-site-project-planning.jpg


Planning for Disasters: Preventative

Management

30


Preventative Management Overview

•Forbes magazine report:

• “[C]ompanies…understand that a strong culture of ethics is also key to helping drive financial performance.”

31

• “[S]tudies show that employees increasingly want to work for an organization that aligns with their own personal values. They are more loyal to such organizations.”

Image source: http://www.worldsmostethicalcompanies.com/honorees/



•Develop policies, procedures and culture

• Allow issues to surface before becoming crises

• Project to employees and stakeholders an ethical company

• Encourage compliance and openness

• Training• Reinforces the importance of an

ethical company• Teaches managers/employees

how and how not to respond

32



•Goals: • Observe and employ “best practices”

• Adhere to company’s core values and/or code of conduct

• Minimize risk of litigation and regulatory enforcement

•Execution:• Policy Development

• Reporting Procedures, and Training

• Investigation

• Assessment

• Action, Reporting, and Resolution

33


Policy Development

•Open Communications Culture• Establish written policies

• Encouraging ethical behavior

• Encourage reporting of potential significant issues

• Reporting unethical/illegal conduct

• Prohibiting unethical/illegal conduct

• Outlining reporting and resolution structure

• Prohibiting retaliation

• Meet with employees/managers to explain policies, train, and encourage reporting

• Reward employees who come forward

34


Reporting Procedures

•Establish reporting structure• Procedure for employees to report

• To whom?• 1-800 number?

• HR? Someone else depending on complaint subject?

• Logging and tracking reports

• Promising Confidentiality?

35


Anti-Retaliation

•Whistleblower, #MeToo claimant, Critical Witness protection• Whistleblower Retaliation Protection

• State and federal laws• Pursuant to California Labor Code Section 1102.5, employees are the protected class of individuals. “Employee”

means any person employed by an employer, private or public, including, but not limited to, individuals employed by the state or any subdivision thereof, any county, city, city and county, including any charter city or county, and any school district, community college district, municipal or public corporation, political subdivision, or the University of California. See, e.g. The Division of Labor Standards Enforcement Whistleblowers Protection Notice.

• “An employer, or any person acting on behalf of the employer, shall not make, adopt, or enforce any rule, regulation, or policy preventing an employee from disclosing information to a government or law enforcement agency, to a person with authority over the employee, or to another employee who has authority to investigate, discover, or correct the violation or noncompliance, or from providing information to, or testifying before, any public body conducting an investigation, hearing, or inquiry, if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employee’s job duties.” California Labor Code Section 1102.5

36


Training

• Train managers to• Recognize when an issue of concern is being raised• Avoid pre-judgment as to the veracity of the complaint• Praise employees for coming forward• Reassure the company takes reports seriously• Not retaliate against employees who come forward

• Train all relevant personnel in Communications Discipline:• Focus on facts—what happened, don’t speculate on why• Stick to areas of responsibility—don’t presume to know or try to

gather facts outside of responsibility• Avoid the CYA

37


Develop Complaint Procedures

38

1-800 number

Internal investigation

Referred to __ for more investigation

Assessment

HR report

Report logged

Report screened

Reporter informed/ action taken


Planning for Disasters: Crisis Management

39


Information Gathering

•Proper intake should facilitate investigation and minimize litigation risks• Channel reports to a single department or officer.

• Allocate reports away from managers, supervisors, or others accused of wrongdoing.

• Strive to maintain reporter confidentiality

• Maintain a basic record that shows corporate sincerity/compliance

40


•Screening preserves company resources• Determine a report’s credibility

• Dismiss meritless reports and document decision• Inform the reporter

• Notify HR to ensure objective monitoring of employee

• Assess the risk of credible further reports

• Rapid determination of need to escalate.

41

Report Screening


•Who performs the screening process?• Consider creating a diverse “compliance committee”

• The committee should contain representatives from a variety of departments (e.g., HR, Internal Audit, Corporate Counsel, Risk Management, etc.) so as to avoid “silos”

• A diverse committee ensures coverage for a variety of report subject matters

42

Report Screening

Image source: https://www.greyhoundfriends.com/wp-content/uploads/2016/01/49033060_thumbnail.jpg


Investigation: Selecting A Team

•Who?• Internally-led

• Third party provider?

• Outside counsel?

•Considerations• Punitive damages

• Complexity

• High level actors implicated

• Cost of provider

• Privilege

43


Investigation: Outside Counsel?

•Outside counsel• Regular outside counsel

• Familiarity with business, management trust

• “Independent” outside counsel, when:• High-level management involved in crisis• Familiarity prevents truth• Relationship with management is a conflict

• Who makes the call:• To engage outside counsel• To select regular vs. independent counsel

• Who is liaison to outside counsel?• Benefit of someone with public/employee trust• Must be familiar with inner workings of company

44


Investigation: Internal Communications

•Meet with the affected department heads regarding:• The fact that outside counsel has been engaged

• Employees’ obligation to cooperate

• Notifying employees of events

• The company’s commitment to resolving the matter as quickly as possible with minimal disruption

45Image source: https://ghanatalksbusiness.com/wp-content/uploads/2017/02/meeting-peoples-1.png


Assessment

How will real business impact be assessed?

1. Who receives information gathered?

2. Who is involved in assessment of impact?• Legal, HR, Finance/Accounting, Risk Management/Insurance, PR and

Communications, affected production

3. Who is responsible to convene assessment teams/report to decision makers?

• Different for different types of crises

• Ongoing assessment

• Insurance recovery

46


High Risk Issues

•Examples:• Events likely to impact the financial statements

• Insider trading

• Natural disaster

• Bet-Your-Company Litigation

• Management integrity• Sexual harassment

• FCPA

• Events likely to substantially impact company’s reputation• PR explosion

• Cyber-attacks

47


High Risk Issues

•Procedures:• Immediate escalation

• -

48

Notify:

GC Immediately

CFO Immediately

Ethics or compliance officer Immediately

Audit committee If the report complains of financial reporting issues

Board If the report implicates the CEO or CFO in wrongdoing


Action

•Assess situation and investigate findings•Assess potential responses

• Legal• Risk Management/Insurance• PR• Balance Sheet

• Respond/Corrective Action•Notify:

• Reporter• Board• Company at large• Regulator• Insurers• General public• HR, to monitor reporter’s treatment at work

49


Crisis Communications and Public Relations

50


Crisis Communications

•Make a list of known, trusted professionals before crisis hits• Goal 1: Proactively

manage stakeholder outreach

• Goal 2: Limit reputational damage

51Image source: https://www.bok.com.np/uploads/icons/management-team.png


Crisis Communications vs. Public Relations

•Crisis Communications (subset of PR)• Need to quickly understand

• What’s important

• Audience perception

• Who needs to be addressed

• What needs to be said

• Nature of message

•Public Relations• Long-term message

• Rebuilding reputation

• Coaching the company’s representatives

52


Data/Information security

•Controlling access to information• Who needs to have access to what information about the

crisis?

• Who does not need access?

•Data recovery

•Key reporting requirements and contacts• e.g. in event of data security breach

53


What to Avoid

•Uncontrolled communications, even by CEO• Social media

• Slow responsiveness

•Tyranny of Expediency

54Image source: http://www.thenationaladvocates.org/wp-content/uploads/2014/12/retaliation.jpg


Insurance Recovery

55


Insurance recovery…Plan ahead

•Policy summaries• Must know where

coverage nuances exist

• Locations of policies

•Claims procedures

•Principal contacts

56Image source: https://unifiedtitle.com/wp-content/uploads/2017/02/ThinkstockPhotos-656141238.jpg


Insurance recovery…Act

•Do not let policies sit in drawer and gather dust• Involve professionals to gather all policies

• Assess procedural and substantive provisions.

•Assign single point of contact for brokers/insurers• Broker communications not necessarily privileged.

• Include insurance “guru” in crisis decisions.

•Follow claims procedures• Timely

• Consent before hiring consultants/paying to address or mitigate loss

57Image source: https://unifiedtitle.com/wp-content/uploads/2017/02/ThinkstockPhotos-656141238.jpg


Aftermath

58


Aftermath

Build aftermath procedure into crisis plan.

• Log actions taken

• Log evidence gathered

•Prepare a final report to close out event

•Post-mortem/“Lessons Learned” meeting

• Implement needed changes to prevent/improve for next time.

59


Tools

www.ready.gov/business

60

http://www.ready.gov/business

strategic planning for in-house counsel€¦ · 1. two days later, starbucks apologizes in a brief...

Documents