Lessons From a Year in Crisis: Do's and Don'ts of Crisis Management.

• Author: Zogby, Michael C.

The views and opinions expressed within this article are the authors' own and do not necessarily reflect the views of their employers.

CRISIS loves company. Like many of the readers of this publication, we transitioned from trials and in-person litigation activities to spend the last 18-plus months focusing and counseling on crisis management issues. Unlike others, however, we had occasion to do so not only in light of the COVID-19 global pandemic, but because we partnered with ten in-house counsel and forensics/public relations professionals throughout 2020 and 2021 to dissect, publish, and speak on issues related to effective crisis anticipation and resolution techniques, as well as on the intersection of crisis, cross-border disputes, and litigation.

Through this process, we have identified a collection of pragmatic "dos" and "don'ts" for organizations faced with business crises. We share these recommendations as a reference guide as we approach the two-year anniversary of many of us working remotely. These can be applied to any business or risk management crisis, and they should be incorporated into our regular practices and response processes.

1. DON'T Take a One-Size-Fits-All Approach

   In a pie chart tracking the general discourse regarding crisis management strategies, crisis management plans--or CMPs--would take up a significant slice. (1) In the cybersecurity space, via Executive Order No. 14028 ("Improving the Nation's Cybersecurity"), the White House recently tasked the U.S. Cybersecurity and Infrastructure Security Agency (CISA) with developing "a standard set of operational procedure (i.e., playbook) to be used in planning and conducting cybersecurity vulnerability and incident response activity." (2) In November 2021, the CISA published the Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, once again putting crisis management planning documents in the forefront of minds considering crisis response techniques. (3) While it is true that the importance of planning for crises cannot be overstated, the phrase "crisis management plan" suggests that with enough foresight, focus, and resources, a company may divine one plan ready to be implemented at the first hint of any crisis to neutralize the threat entirely.

   However, don't think that a single crisis management plan will do the trick for each and every crisis on the horizon. Adopting a one-size-fits-all approach to crisis response planning will not only produce an inadequate strategy for future crises, it will set unreasonable expectations for the nature of business crises themselves.

   Crises are fluid, and the best crisis management plans are flexible and made to change in response to the nuances of a given problem. Rigidity is the enemy of effectual crisis management. (4)

   CMPs with built-in flexibility, adaptable to the particular variety of challenges that may arise for a given company, are key. Multiple avenues of action, some to be implemented parallel to others and some to serve as alternative options, are part of an effective CMP, which should set forth the list of viable options that may best respond to a particular crisis. Each crisis is unique, and the company's approach to managing the crisis should be specifically tailored to the problem presented. Put another way, crisis management should always be bespoke--not off the rack.

2. DO Anticipate & Avoid

   Planning for a crisis is only half the battle--and a reactionary approach might eliminate options or put you behind in the response plan. The best crisis-related strategies involve anticipation of potential catastrophes as a means of avoiding them altogether. Anticipation and avoidance are the hallmarks of premier crisis management. (5)

   Without intention, the human mind is not inclined to see, let alone foresee, problems. Thanks to a phenomenon known as normalcy bias, the mind has a tendency to expect things to continue to occur in the future as they typically have in the past--to assume that matters will proceed "normally." (6) This bias may lead one to underestimate both the likelihood of a crisis occurring, and how bad the disaster may be when it does arise. (7) We are familiar with examples of normalcy bias from recent history and popular culture. For example,

   Normalcy bias was demonstrated by the statements of BP's ousted CEO, when he stated that "the Gulf of Mexico is a very big ocean. The amount of volume of oil and dispersant we are putting into it is tiny in relation to the total water volume." Normalcy bias [was] further exemplified by the response of the Costa Concordia crew. After the ship struck the rock near Giglio Island, passengers were reportedly told to return to their staterooms. About an hour passed before the order to abandon the ship was issued, possibly contributing to the loss of thirty-two lives as well as the $570 million vessel. Thus, normalcy bias...