Crisis management is an increasingly pressing issue for company boards. If a crisis is handled badly, it can swiftly leave a company’s hard-earned reputation in tatters.

Dealing with threats quickly as they happen and having a well-constructed strategy in place ahead of time are fundamental.

In an increasingly complex and uncertain world, crises can take many forms: from cyber-attacks to data breaches, and natural disasters to poor behaviour from employees.

“In the heat of a disaster, you need to act decisively,” says Matt Dalton, a partner at Mazars, where he is responsible for internal audit and risk management. “Each crisis situation is different from the next. If you get it wrong, you can lose your customer base overnight. Crisis management is about protecting the value you’ve created in the business.”

The advent of social media means that a situation that might once have been contained is now viewed by thousands, if not millions, often in a matter of minutes.

Take the recent example of United Airlines. Social media outlets such as Twitter and Facebook quickly amplified appalled public reaction to the treatment of a passenger who was dragged off an overbooked plane. The response of the airline’s CEO, Oscar Munoz, turned a PR mishap into a full-blown business disaster. Munoz initially sided with his staff, before doing a U-turn several days later and admitting the airline was at fault.

By then, the damage had been done. The airline’s share price took a hammering, and Munoz—while he kept his job—had his ambition to become company chairman curtailed.

To fend off such potential dangers, crisis management should form part of an effective risk mitigation strategy, says Dalton. By putting in place risk management frameworks and strategies, companies can be alert to potential threats across the business and so deal with them in good time.

But crisis management comes into its own when a company confronts a “black swan” event from left field. “There are a lot of external risks that you can’t control, such as terrorist attacks or natural disasters. How you respond is critical and depends on having a sound crisis management strategy in place,” says Dalton.

Human error

Sometimes those unaccounted-for risks can be as simple as human error, as was the case with British Airways’ recent IT meltdown at Heathrow Airport, which left its flights in disarray and cost the airline millions of pounds. The carrier later admitted that a technician switching the power to BA’s data centre off and on was at fault.

Dalton believes that a company’s reaction to an unexpected event can act as a differentiator that benefits the business in the long term. He cites the example of US sportswear retailer Nike, which was dogged by accusations of child labour in the mid-1990s.

The company’s response was to tackle the issue head-on by rooting out child labour practices from the factories it used. Over time, Nike gained a reputation as an ethical and sustainable company. Today, it regularly appears in the top 10 of the Fortune Most Admired Companies List.

In practical terms, how a company handles communications is a significant element in minimising the impact of a crisis on its reputation.

“Communications is critical, both how you respond and how quickly. Even if it doesn’t have all the answers, a company needs to be fast, honest, and transparent in its response to a crisis situation,” says Dalton. “Many smaller companies think they will deal with a crisis when it happens—but by then it’s too late.”

For starters, management can decide well in advance who will face the cameras and speak on behalf of the company. A social media strategy is vital, especially for companies whose customer base is made up of internet-savvy millennials. But an effective communications strategy should take into account all stakeholders—including suppliers, employees, and investors—and tailor appropriate messages for each group, says Dalton.

Contingency planning

Contingency and scenario planning are equally important in ensuring companies are fully prepared in the event of a crisis. Through crisis preparedness simulations, managers can perform role-playing exercises and realistic run-throughs of social media crises, cyber-attacks and other reputational challenges. The aim is to improve how employees ultimately behave when faced by the real thing.

Business continuity and disaster-recovery plans—which are intended to limit the effect of a crisis on business operations—should also be a part of any company’s crisis management tool kit, says Dalton. They address issues such as ensuring data is properly backed up, making sure employees know where to go and what to do in the event that their main office is no longer accessible, and safeguarding communications with key stakeholders.

Audits, either conducted internally or by an external firm, can be a very effective way of making sure such plans are water-tight and include all significant eventualities.

Boards can ensure their companies are properly prepared by questioning contingency plans and making sure crisis management strategies are robust. Dynamic risk management practices—which actively monitor risks rather than being a box-ticking exercise—can “help drive the conversation” in the boardroom, particularly among large companies, says Dalton. This approach can force boards to actively focus on the risks the company faces, how to avoid them, and whether to exit certain business areas as a result.

Looking to the future

But where boards can really earn their money is by looking well into the future to see what’s coming down the track. “Boards ought to be asking the tough questions. They should be looking 10 or 20 years out, and asking ‘what could really disrupt us?’, ‘what could put us out of business?’,” says Dalton. This could include the advent of a major disruption in the marketplace, the emergence of a competitor, or an existential crisis such as the BP Deepwater Horizon oil spill.

Having a diverse board—rather than one composed exclusively of white middle-aged men—is one way to avoid group think and ensure boards are asking searching questions. But equally importantly, boards need to be leading by example, shaping the culture of the business, and determining its code of conduct. In the absence of a strong board, cultural audits often show very different cultural standards operating at board level, at senior management level, and among the staff themselves, says Dalton.

In the wake of the misdemeanours of the financial crisis, creating a healthy and robust culture is particularly pertinent if companies are to nip poor behaviour in the bud and avoid a potential crisis. “Boards have a critical role in setting out what a company stands for. Things are moving in the right direction, but there’s still some way to go,” warns Dalton. 

This article has been prepared in collaboration with Mazars, a supporter of Board Agenda.