I remember when I first arrived in Korea in 1986. I was a young lawyer, the first foreign lawyer to work in-house for Samsung. It was an exciting time as Korea and Samsung were rapidly changing. Samsung was expanding rapidly and Korea was in the midst of the “Miracle on the Han”. It seemed that we were creating companies left and right. The Samsung group was expanding and I was a part of it. A little cement and water and we had a new company! Growth was everywhere. Not only growth but change as well. I really didn’t think about it but Korean society was changing too. In fact, I realize now that change is constant, even in retirement.

The fact that there is change even in retirement was brought home to me recently. When I first came to Korea in 1986 I went mountain climbing with my Samsung colleagues. We climbed Mt. Sorak..ie Soraksan. Upon climbing up one of the peaks I discovered an old lady who had climbed up with a bucket of magkeoli ( Korean rice wine) to sell to thirsty climbers. I was amazed she had made it to the top to sell magkeoli but later found this to be a common occurrence in Korea. If I recall correctly, the old lady had on high heels too. I would later joke to my friends that once I retired I was going to sell magkeoli on Soraksan. Recently, I made it back to Soraksan and to the top of one of the peaks. I expected to see an old lady selling magkeoli…but no. No one was selling alcohol at all. Why? Selling alcohol had been banned. Things have changed.

Obviously, not only people but companies and organizations have to realize that change is everywhere and must plan for it. They have to be ready to handle the usual legal and risk issues that they normally face as well as those issues and liabilities caused by the pandemic and the Russian invasion of Ukraine as well as supply chain issues. Change means of course that the normal areas of risk whether legal, operational, geo-political or financial will all of course have to be dealt with. Therefore, a company’s crisis management plan must consider pandemics such as Covid. But also, the normal everyday areas of risk that can and will result in loss of business must be addressed as well.

So, even in retirement, I have noticed changes around me. Customs change. Even laws, rules, and regulations governing our lives change. Cities and neighborhoods change as well. Whether you are working or retired, you cannot count on your life to be static as usual. Life is really never as usual. There really is no same old same old. Everything around us changes, maybe slowly and maybe slightly, but it changes. You may be too caught up in work or in life to notice the subtle changes around you. But change is everywhere if you look. Are you ready for change?

Of all the risks facing companies in today’s business world, reputational risk is one of the most serious. Reputational risk can not only damage a company’s brand, but can even lead to the demise of the company. It is of primary importance to executives, in-house counsel and risk managers in many multinational companies and is seen as one of the top risks a company may face. In fact, in Aon’s 2019 t Global Risk Management Survey, it is one of the top risks that are of concern to companies. Deloitte surveyed companies as well and found out that the majority of companies it surveyed rated reputational risk as more important than strategic risk. Many of those surveyed acknowledged they had suffered a brand risk or reputational risk event that resulted in a loss of brand value or a loss of earnings.

Damages caused by reputational or brand risk events are not tied to just domestic related issues. Approximately half of the executives that Kroll polled for its recent Global Fraud Report opined that their companies are at risk of vendor, supplier, or procurement fraud tied to overseas expansion. Many of those surveyed felt their companies were highly or moderately vulnerable to corruption and bribery risks which can of course lead to reputational risk or loss of brand as well as FCPA investigations and fines. According to the respondents in the Kroll Global Fraud Report, ethics and integrity (or lack thereof) was the major cause of reputational risk.

The reputational risk caused by supply chain issues can escalate out of control unless properly managed. Loss of brand value can happen quickly if a fraudulent event becomes public or if a bribery scandal is publicized in the media. Just look at the some of the crisis that happened over the last decade. Many people have been affected (some have died) because of the crises or mega-crises that have happened. Many of them also included reputational risks as well. Examples include:

The financial and housing collapse and major recession of 2008

Toyota implicated in recalls because of brake issues

Major Banks having their credit card customers’ names stolen by computer hackers

Volkswagen was implicated in a pollution emissions scandal

Target’s customers had personal data stolen due to lax security systems. Over 40 million
Credit and debit card customers effected

Sony Pictures- Sony as well as its employees had confidential information stolen

As you can see from the examples above, there are numerous kinds of crises that a company should be prepared to handle, especially in an international context. Among them are financial crises, natural disasters including pandemics, product failures, workplace violence, cyber-attack, or hacking, and, of course, terrorism. However, most if not all have resulted in serious reputational crisis which also led to legal risk.

It is undisputable that a major crisis can pose serious threats to a company, and, therefore, the crisis must be managed. Crises can result in (a) government fines, (b) loss of retailer confidence, (c) loss of investor confidence, (d) loss of employee confidence, and (e) massive litigation, including class actions. In other words, the end of the company! Crises also result in reputational risks or damage to the company’s brand which may have a greater effect on the company’s bottom line than the damage caused by the original crisis itself.

The problem facing any risk manager or in-house counsel is that the media in today’s society has become very anti-business. As this anti-business culture of attack has gotten worse over the last twenty years, a crisis can no longer be handled by a simple PR or marketing statement. A full-fledged crisis management operation must be put in place. Damage control is now a very serious matter for any potential crisis, no matter how small. Today, more and more companies have to consider issues that negatively affect the company’s brand and how best to counteract them.

Key considerations when considering potential brand or reputational risk caused by ethical or fraudulent behavior within the company or within the company’s supply chain:

-Compliance- does the Company have a compliance program and is it up to date?
-Compliance- does the Compliance program and code of conduct promote an ethical culture within the company?
-Supply Chain- has the Company’s vendors involved in the supply chain been vetted? Do they follow the Company’s code of conduct? Do they have compliance programs?
-Are there sound corporate governance and control processes in place?

Major considerations for handling brand risk once a crisis has started includes:

-Is there a Crisis Management Plan in place to handle brand risk once a crisis starts?
-Does the Company have an effective internal investigation process in place that may shorten the time taken to discover internal risks and mitigate reputational harm?
-Have the appropriate decision makers been trained to handle PR and media issues once a crisis has occurred?
-Does the Company have appropriate 3rd party consultants, including risk management companies and media crisis companies in place to help mitigate reputational/brand risk once a crisis event takes place?
-Does the Company have an appropriate international Crisis Management Plan in place in case the crisis is international in scope?

Companies must realize that there are many risks associated with doing business internationally as well as domestically. Brand or reputational risk is very serious and can lead to the loss of money or even the destruction of a company unless the right steps to mitigate or prevent brand risk are in place. So when considering what risks should be addressed on a regular basis, remember reputational risk should be of primary importance.

In the past I have commented on crisis management and the tools needed to handle crisis in today’s business environment. It is clear however, that an international crisis, such as the COVID 19 virus or even a geo-political crisis is harder to deal with than a domestic crisis. Because of international considerations, an international crisis is normally harder to manage than a domestic crisis. As it is more complex, companies caught up in an international crisis have to pay more attention to international, cultural, and communication issues than they would in a purely domestic scenario.

Crisis communications has become very important. Therefore, an international crisis requires a number of steps, including:

• Planning for an international crisis
• Appointing a crisis manager
• Establishment of a Crisis Management Team
• Establishment of a Media Crisis Team to handle international communications

The principle focus of any crisis management strategy, especially in an international contest, is communications. All crisis management plans call for effective crisis communications, which many times are not always executed. Inadequate or failed communications lead to bad publicity, unhappy stakeholders, and potential disaster. An effective crisis communication strategy is necessary for any international crisis. A number of companies and even governments have failed to defuse international crisis because of poor communications.
An effective crisis communication strategy is necessary when dealing with an international crisis. It also requires the establishment of an effective Media Crisis Team that can respond to potential media issues. Who should be on the team? At least 6 people from the following areas or departments:

1. Legal- someone from the GC’s or CLO’s Office
2. HR- HR should designate a staff member capable of handling crisis related issues
3. Outside legal- in the case of most companies, the primary outside law firm should also be on the team
4. PR- if the company has a PR department, someone from PR should be on the team
5. Outside PR- it is a good idea for most companies to retain an outside PR firm if possible
6. QA or Service, etc.- depending on the product or services the company provides, perhaps someone from the Service Department of Quality Control Department should also be on the media crisis team.

A number of processes need to implemented and issues addresses to create an effective Media Crisis Team. Such processes and issues include the following:

• Creation of the Media Crisis Team.

• Identify a key spokesperson or spokespersons on the Media Crisis Team who will speak for the organization. Who are they? What are their roles?

• Training on cultural issues, if the crisis involves other cultures.

• Establishment of communication procedures and protocols for the Media Crisis Team. Who communicates to whom and why? Can the Media Crisis Team members communicate to each other directly?

• The main messages that should be communicated to key stakeholders should be thought through.

• A budget for the Media Crisis Team, should be approved and set up.

• The facts surrounding the crisis should be established as well as the major talking points.

• How will the Media Crisis Team handle the Press? Processes?

• Has a communications war room been set up for the Media Crisis Team in order to meet and handle communications?

• Has a hotline been set up?

Though companies try and resolve the crisis at hand and spend significant sums of money to do so, if they fail to properly communicate to the media and the public, they in effect have lost and can expect outrage and consumer dissatisfaction to such an extent that the very existence of the company can be threatened. So remember, a company doing business internationally has to plan for eventual crisis. If it fails to handle communications properly during a crisis, it faces not only a potential loss of business but a negative impact on its brand. Therefore, I recommend to all companies that now is the best time to create a Media Crisis Team.

There are several reasons why companies find it harder and harder to handle major crisis. These days, because of the internet, companies have to get out in front of a crisis, or the bad PR will kill them quickly. It used to be companies had time to react and get out front. Now they don’t. So, if companies don’t have a strategy in place to address the crisis, it’s hard to get out in front. In fact, by most accounts, a company has twenty-four hours to put a crisis management strategy in place once it becomes aware of the underlying event. This twenty-four-hour period is sometimes referred to as ‘the golden hour.’ If a company isn’t prepared, twenty-four hours is not long enough to think things through. Of course, In-House counsel have to understand their roles in a crisis as well. They have to manage legal liability and balance it with business considerations. They also have to help the PR team educate the public on the issues and make certain all legal regulations are followed. Normally, the In-House team hasn’t really thought about its role and responsibilities in the event of a major crisis. This can be a problem.

Another issue is that sometimes Management refuses to acknowledge the existence of a crisis until it is normally too late. Remember, a crisis unfolds in a series of stages and not in a vacuum. First, there are early indications of a crisis brewing followed then by actual warnings of a crisis followed by the crisis exploding and overwhelming management. It is at this stage that most companies try and resolve the crisis, but it is usually too late. The crisis morphs, PR gets really bad, the impact of the crisis deepens, the stakeholders and shareholders get very worried and upset. The key to properly managing a crisis is to acknowledge the existence of a crisis at the beginning and to have a crisis management plan in place. Legal needs to be heavily involved with Management to help resolve the crisis at this stage.

The major problem with handling a crisis is that communications play an important role. When you look at the timeline of the average crisis: a company not only has to determine what need for communications exist (internally and externally) but also must have the communications drafted and ready to go within twelve hours of the start of the crisis. Within twenty-four hours, Management should have a plan in place including a communications plan and should be talking to the media or have a third party talking to the media for it. If you don’t have a crisis management plan already in existence before the event, you probably won’t get your hands around it in time. Legal must also know what to do and when.

As In-House Counsel What Should Concern You?

Ask yourself the following questions:

-What happens if one of the machines in your company’s main manufacturing line breaks down? How long would it take to come back online? Or, what happens if as a major service provider you are unable to provide the service you are obligated to provide?

-Can you cover by finding alternative sources of supply, how long would that take to do? How long to cover the losses? What about the supply agreements?

-If you lose productivity and can’t supply customers on time you could lose everything. Are you able to absorb the losses? What obligations do you have under your supply agreements?

-Who should be the crisis manager?

-In case of a crisis do you know all of the relevant insurance policies and the appropriate notification deadlines? Or is this left up to the insurance department?

-If a crisis involves regulators, are you aware of the basic time frames in which to notify and/or involve the regulators? And, who are the appropriate regulators? Do you have contacts with them?

-From an in-house perspective have you thought about how to mitigate civil liability?

-So how do you minimize civil liability and perhaps criminal liability too?

-Are you prepared for litigation?

-What steps should you take to mitigate liability?

For In-House counsel in companies that could experience a major crisis, it is vital to have a plan in place. Think about the questions above. Ask more questions too. Be prepared.

The events over the last few days and even months have had a major impact on many companies worldwide, especially those in the US. From the Covid-19 lockdowns, unemployment, stock market collapse to the ongoing riots, companies are realizing that those proactively equipped to handle crisis are in a much better situation than those that are just reacting to the recent catastrophic events.

Companies that successfully manage crises have used risk management processes that contain four or five basic crisis management steps in order to prepare for a crisis. They include the following steps:

1. Identify the major areas of vulnerability the company faces.
2. Develop a plan for dealing with potential threats.
3. Form a crisis management team to deal with or handle threats.
4. Simulate crisis scenarios of potential threats to prepare the company.
5. Learn from the experience of managing the crisis.

Other companies have used a variety of processes or steps to handle crises, including:

Avoiding the crisis through proactive steps
Preparing for the crisis through preparation and planning
Properly reacting as soon as the crisis exists, and
Resolving the crisis

To help put everything into context, a company should realize that many crises, including international crises, occur in stages. The crisis management strategy should be prepared to deal with the stages as they unfold. Each stage requires certain responses from the company, and each stage has a certain impact upon a company. Typically, however, a company does not have a crisis management strategy in place, especially one that can handle the various stages of a crisis. Many times, a company is caught sleeping without a strategy and fails to adequately manage or resolve the crisis, which may severely impact the company. Usually, a poorly managed crisis follows a similar pattern:

-Early indications of a crisis starting—perhaps reports from the Service Department indicating product failure or serious defects.
-Warnings of the upcoming crisis are ignored by company management. Maybe the Service Department’s warnings go unheeded by management.
-The crisis explodes, overwhelming management as deaths or serious injuries are reported due to product failure or product defects.
-Management tries to resolve the crisis quickly but without success as it failed to consider the ramifications of the crisis and how to handle it.
-The company fails to take adequate measures to handle the crisis as the crisis continues to unfold as reported by the media.
-The company suffers the consequences of an outraged media, public, and even some or all stakeholders.
-The company’s existence and brand is severely threatened or put into jeopardy as its stock plummets and lawsuits are filed causing its reputation to be severely tarnished.

Though not all crisis unfold in the stages I describe above, all crisis require a strategy to deal with them. It’s best to work on crisis management strategies now instead of dealing with them during a crisis. Dealing with a crisis as it unfolds without a proactive strategy in place can be very costly and time consuming. And of course, a well thought out proactive strategy increases the chances of success.

Before a crisis breaks out, it’s always a good idea for the company’s risk manager or the risk management department (RMD) if one exists to review his or her role, or in case of the RMD, its role within an organization. In today’s environment, including COVID 19 virus issues, it is very important. In order to understand the risk management department’s area of responsibility within an organization, I think it best to for the head of risk management to work with his supervisor in drafting corporate guidelines covering the risk management’s area or responsibility which can then be disseminated throughout the organization. No only should the RM or RMD’s are of responsibility be covered but each individual within the RMD should have his or her position and are of responsibility described in detail as well. It’s best to have everything outlined before the RMD has to contend with a crisis, especially a pandemic.

Areas of responsibility should include the purpose and policy of the RMD in the organization, the functions and execution points of the RMD (who does what, when, how, reporting lines, etc.) as well as a detailed outline of the procedures and processes of the RMD. Procedures and processes can include:

-conducting risk assessments of the organizations’ divisions and departments
-developing solutions for the various risk management issues
-developing business continuity plans
-coordination with various departments to assist with compliance issues
-oversee loss control concerns
-develop training for the organization’s employees covering various risk related areas of concern such as product safety, etc.

Besides managing risk, risk managers must also have a knack for good stakeholder management. In fact, in order to provide effective leadership in today’s corporate world, risk managers and those who have a risk management function, must understand the significance of good stakeholder management. The first step in leadership for any risk manager when looking at stakeholders is to ask the hard questions such as:

(I) Are you prepared to handle risk events relating to your stakeholders or not?
(II) In a crisis management event, such as a pandemic, are you ready to address your customers?
(III) Do you have the right information to communicate to your regulators?
(IV) What are the risk management process to use in case you have major employment related issues?
(V) Do you have a business continuity plan in place?
(VI) Have you coordinated your plans with Legal?

Providing effective risk management leadership requires the risk manager to understand what his or her role within the organization is as well as who the major stakeholders really are and what risk management reporting processes actually exist or should exist. Once a risk manager can answer the questions, the manager as well as the RMD itself is ready to provide effective risk management leadership.