Compliance and Crisis Management: Why It Pays to be Prepared

2003
Andrea Bonime-Blanc, Senior Vice President and Chief Ethics & Compliance Officer, Bertelsmann, Inc.

The lessons learned from what might be called the Blackout of the Century (at least for now…) are beginning to roll in. How a company performed often depended on how well prepared it was in advance of the emergency:

• Did it have a building, facility or office emergency plan in place?
• Was there an effective employee communication plan in place?
• Did it have alternative arrangements in place for stranded or hurt employees, customers and others?
• Did it have an executive crisis management plan in place?
• Did it have a business continuity plan in place for the day after?

Some companies clearly had emergency, crisis management and business continuity plans and teams in place, others survived by piggy-backing on their building's or facility's plans while yet others improvised and either did okay or not so okay.

Why care, one might ask, as long as no one was hurt? There are several compelling reasons for caring, the most important one of which is the health and safety of employees and others on or around your premises. While avoiding potential liability from a corporate standpoint might come quickly to mind for some, there is another key reason to care. Employees who are taken care of — given training, instructions, kits, information — will feel good about their company and their senior management at times of crisis while those who don't get such attention may be disgruntled, angry or worse. In today's world of greater uncertainty and vulnerability there are no excuses for not caring about this stuff.

Why should anyone in the compliance function get involved, you might ask? Well, there are a number of compliance or legal reasons why such functions need to get involved - not just tangentially but proactively and centrally:

• Health & Safety. How will employees evacuate? Even if there's a plan in place, are employees aware of what they need to do? Has anyone taken the time to train or communicate with employees concerning possible emergencies? Do people know what to do to assist those who might be disabled, stranded or hurt?
• Environmental Consequences. If a crisis has environmental aspects to it - e.g., an anthrax scare - procedures need to be in place to address such an eventuality and protect employees and others in the vicinity as well as assets from contamination. Needless to say, the possible legal consequences of such an event - especially if it is mishandled - can be enormous.
• Facility Security. If a facility has poor security and a crisis occurs - like an incident of workplace violence, for example - the potential compliance and legal consequences are many - from victims, lawsuits and enterprise liability to the departure of employees and productivity decline, just to mention a few.
• Workplace Violence. A company without a workplace violence policy may coast along when there are no incidents. Things can change in one instant, however, if such an unfortunate incident occurs. The work that a company puts into having an effective workplace violence policy will pale by comparison with the grief, finger pointing and liability that can arise out of just such a terrible moment.
• Company Liability. Depending on the size and structure of the business entity, liability may move in several directions - up the corporate chain and over to members of senior management if gross negligence or criminal misconduct can be proved.
• Business Continuity. Legal and compliance consequences from not having a business continuity and disaster recovery plan in place can also be many and varied. What happens on the day after a crisis when you can't deliver product to your customers? What happens to your financial and other databases and key business information that are wiped out during a crisis for which there was no back up?

Some Basic Steps Companies Should Take. While many lessons can be learned from the recent black-out and are sure to continue to come in, here are a few action items to keep in mind for a possible future crisis:

• Create a Senior Management Crisis Team & Plan. Such a plan should be short and to the point but well thought through for the circumstances of your business. It should identify a team, an agenda checklist and a meeting location and should specify the roles and responsibilities of team members. This plan should serve as the umbrella under which others plans fit - emergency evacuation, business continuity and disaster recovery.
• Provide Employees with Building Access & Emergency Information Cards. Depending on how your premises are organized, in addition to any access cards, employees should be given credit-card-size information cards to keep with them at all times containing basic internal emergency information as well as area emergency numbers and websites to consult in the event of a broader crisis (such as a black-out). Including mass transit and similar local transportation numbers is wise.
• Provide Employees with Emergency Kits. Providing each employee with such a kit is very inexpensive, but it can go a long way to making him or her feel better about the company and senior management, because the plan demonstrates that the company cares about them. Such a kit can include a battery-operated flashlight, dust-mask, light-stick, bottle of water, whistle, etc. The kit can also include a building/floor map showing the closest exits.
• Other Emergency Supplies. Some other optional items you can suggest that employees keep in their offices could include - a battery-powered AM/FM radio, a nutritious snack and comfortable shoes.
• Emergency Hotlines. Provide a toll-free emergency phone number for employees to check in the event of a crisis especially regarding whether their workplace is open for business or closed. The crisis management team should place messages on such a number providing employees (and their families) useful information and update such information as necessary.
• Radio Announcement. Consider striking a deal with a local radio station to provide for public announcements for your employees about the open or closed status of your workplace.
• Fire and Evacuation Drill Participation. Ensure that all employees participate in facility fire and evacuation drills. Everyone likes to make fun of these exercises (or completely ignores them), but if and when something bad happens, no one will be laughing. Employees who participate in these exercises have a better chance of surviving an emergency. Employers who provide proper training have a better chance of retaining their workforce and avoiding liability for providing an unsafe workplace.
• The Safety of Others. Part of any good training is to create awareness about those who might need extra help during a crisis - our disabled colleagues and others who are unable to evacuate the premises without help. Employees should be encouraged to check on their neighbors and colleagues for this reason.

The bottom line on all this is that the financial bottom line is not the only reason to care about crisis management from a compliance and legal standpoint. Crisis management should be proactively practiced because it makes good human sense, preserves lives and livelihoods and provides employees with practical tools and a sense of well being. It is amazing how far a little goodwill and some good planning can go in keeping employees happy and focused on that other bottom line — getting their jobs done.