These days, it appears there are more and more scandals or crisis resulting in companies having their names in the press far too often. Many times it caused by a company’s failure to properly investigate claims internally before it is too late. If a company investigates claims of corporate wrong doing thoroughly enough it can often resolve any issue before it escalates and morphs into a major crisis.
What Legal Risk Management processes are in place in your organization to handle internal investigations, if any? What should a company’s Legal Office or Compliance Office do when confronted by a claim of wrong doing or unethical conduct? What procedures should be used when handling an internal claim? A company or organization needs to come up with a basic plan or road map that sets forth a proper process or procedure and that satisfies compliance and legal processes. I suggest the following:
a. Assess the purpose of the investigation by determining:
i) What legal questions will be addressed at the end of the investigation?
ii) What are the potential uses of the findings and the work product of the investigation?
b.Categorize the investigation in terms of, among other applicable issues: business issues (e.g. the purpose of the investigation is to guide management decisions) and legal analysis issues.
c. Consider Legal implications such as formulating a response to civil, criminal, regulatory or other enforcement action.
d.Schedule an initial organizational meeting intended to:
i) Review basics of the investigative procedure.
ii) Discuss scope of the investigation.
iii) Determine what issues are raised by the report.
iv) Determine what laws, policies, guidelines, or practices apply to the issues raised by the report and in the organizational meeting.
v) Conduct preliminary legal research of issues.
vi) Brief the Compliance Officer or Compliance Oversight Committee (if your company has one) with respect to interviews and the document gathering process.
vii) Obtain copies of all relevant files (including electronic files, voice-mail, email) and other documents relevant to the issues raised, including:
1) a written description of relevant documents broken down into well-defined categories;
2) speak with employees about the request;
3) prepare a search checklist and an index;
4) create numbers for files and/or an on-site index;
5) consider documents stored on an electronic medium; and
6) determine document processing requirements and capabilities including: numbering, copying, reviewing for privilege, indexing, creating a database, safeguard key documents and electronic data, if electronic data has been erased, determine how it can it be restored and store physical evidence properly to avoid deterioration.
viii) Decide who should be interviewed (note that all individuals with any knowledge that is or may be relevant to the investigation should be interviewed).
ix) Decide the order of the interviews.
x) Outline the questions to be asked/include reminders about confidentiality and anti-retaliation at the outset of each interview.
xi) If Legal is involved, it should take steps to preserve the attorney-client privilege and the attorney work product privilege.
i) Is it a request for help, an allegation of wrongdoing, or both?
ii) Is there a simple resolution for the issue?
iii) What resources are needed to investigate the issue thoroughly?
g.If the report was not made anonymously, have an intake meeting with the person raising the issue.
Only with a well thought out investigation process can an internal investigation successfully handle legal and compliance issues that are raised as a result of an investigation. Only when all issues are properly identified can management allocate the proper resources to handle the issues. Only then, can a company successfully mitigate an internal crisis or claim of wrong doing prior to it becoming the focus of the media. A Risk Manager, In House Counsel or Compliance Officer needs to be prepared to handle a claim of wrong doing brought by an employee promptly and efficiently. An internal investigation process can significantly aid in the proper investigation of a claim.
Just when the financial industry thought it was safe to go back into the water, the French bank- Bank Pariabas announced it was pleading guilty to federal charges of violating US sanctions and hiding $$Billions of transfers from sanctioned countries including the Sudan and Iran. The fine Bank Paribas agreed to pay- $9 Billion. The news of course was all over the media, with the New York Times devoting a major article on the matter, and Attorney General Eric Holder holding a news conference.Even the French Government got into the act by claiming the fine was excessive and could damage the European economy or at least the European banking community. Undoubtedly, the negative press will have a negative impact on the Bank Paribas brand. How can it manage such a crisis?
Major crisis like the one mentioned above, must be properly managed. As today's society has become very anti business ( and perhaps with some justification) because of the various mega crisis that have impacted people around the world, a simple PR or marketing statement no longer suffices. A full fledged crisis management operation must be put in place . Sometimes, damage control involves the use of an outside crisis management consultant such as an outside Crisis PR consultant. Normally, PR consultants that handle crisis or help risk managers or in house lawyers manage a crisis are those who have years of experience with the media. A good PR consultant will know what the media wants from the company, will know the players involved in the media and will also understand how to minimize the media's appetite for bad press. A good PR consultant will help the company embroiled in a crisis navigate the dangerous communication currents of the crisis management ocean . It can help save the business reputation of the company and improve media relations.
There a few well known crisis media consultants or PR managers. These consultants, if used in a timely fashion, can help a company weather the crisis storm. Normally, they need to be brought in at the beginning to effectively do their job. I suggest therefore, to have one on retainer if and when a major crisis develops. One such PR consultant is Gillott Communications. Their blog website address is as follows: https://
Remember, an effective crisis management plan must be implemented within 24 hours of the crisis event ( or as some say within several hours because of the explosion of social media platforms) or the company may not survive. As a legal risk manager or in house counsel, you need to develop an effective crisis management strategy prior to the crisis itself. You will need to use all of the risk management tools available, including outside consultants that can help manage and even resolve potentially negative events that result in major attacks on the company. Unless managed, a crisis can and often does lead to catastrophic results that not only damage a company' s brand value but its very existence. Using a Crisis Management Consultant skilled in media relations is one of the most effective ways of managing and minimizing risk.
During the lazy days of Summer, companies or organizations tend to slow down. People go on vacation, customers or vendors go into Summer mode, business slows and organizations think less about crisis risk management and more about company picnics or other fun events. People start thinking business is uneventful- maybe everything is calm and serene like the Buddhist Temple in the picture. (more…)
I am always asked how a company or risk manager is able to identify legal risks that a company faces. Obviously, many companies face a myriad of legal risks due to the industries they operate in or for that matter, the environment they exist in. (more…)
In Korea, the news covers some aspect of the Sewol Ferry tragedy on a daily basis. The Korean Government denounces the owners of the ferry or the lax safety inspection by the Korean Coast Guard,etc and promises to rectify all perceived wrongs. Some are beginning to point fingers at the Koreans' themselves for allowing a culture that is willing to promote lax safety regulations to encourage the "bali bali" society that created the Miracle on the Han. Though it is obvious that risk management processes were not followed or adequately implemented, the main issue is not one of culture nor is it crony capitalism. The main issue facing Korean society is the same issue facing other societies and companies as well- namely, risk management itself.
To successfully minimize and control risk, one must first anticipate it. Not react to it. But that is precisely what many companies and /or governments do. Many simply wait for disasters or crisis and then try and resolve them by creating processes that are in essence a "reaction" to the risk already encountered. To properly minimize and control risk, one must first anticipate the risk and then plan accordingly. How does a company or government anticipate or foresee risk you ask? Through the use of risk management tools created during an audit. A broad Legal Risk Management Audit not only uncovers potential areas of risk that can be planned against but it provides the company with a blueprint on going forward, on how to effectively operate in today's environment with an eye toward the future. Most companies have failed to internalize the concept of risk management across all divisions and in the board room. Such failure normally leads to a atmosphere of "reaction" instead of anticipation.
There are many kinds of risk that companies must anticipate if they want to prosper and flourish. Among them:
1. Currency risk
2. Political risk
3. Product risk
4. Financial risk
5. Environmental risk
6. Regulatory risk
7. IP risk
8. Customer risk
All areas of risk must be thoroughly examined and anticipated including potential internal as well as external risks. When a company or government promises to rectify past wrongs it may mollify the general public or even shareholders. But the failure to implement processes and procedures that promote the anticipation of risk will lead once again to catastrophe or tragedy. Of course risk assessments must be done on current procedures in order to identify areas of potential risk. But in order to properly anticipate areas of great risk, organizations must internalize the risk management process. Enterprise Risk Management or ERM ensures that risk management becomes strategically part of the management structure. The implementation of a Legal Risk Management Program ( LRM) is the main step needed to foster an environment that allows ERM to succeed.
As today's world is much smaller than it used to be with information flowing immediately around the world, it no suffices to react to risks or events. In order to weather the storm of any crisis, the risks must be anticipated. Crisis management plans must be developed, scenarios examined, internal and external risks including potential risks must be identified and planned for. Only when you truly understand the nature of the risks you have anticipated can you properly and diligently control, minimize and yes, even transfer them.
Organizations that structurally implement risk management processes within the organization itself can control their future. Only by anticipating risk and then managing or controlling risk can an organization stay in front of the crowd, protect itself and prevent or minimize the impact of crisis. Therefore, it doesn't pay to react to a crisis and hope it is enough to handle the impact of such an event. An organization, whether public or private, must anticipate the numerous risks that we now face in this world. Failure to do so will end up in tragedy.
How a lapse of risk management processes doomed over 300 people
Normally, the waters around Korea are very calm and quite beautiful- such as in the picture of Gwangili Beach, Busan. However, over 6 weeks ago, Korea experienced a disaster of tremendous consequences that has also had a direct and immediate negative impact on the Korean economy. (more…)
