An ethics and compliance crisis can, and usually does, occur when an organization least expects it. A crisis can take the form of anything from an allegation of sexual harassment against a top executive to evidence of discriminatory labor practices. It can also result from the inappropriate handling of a serious situation or a serious lapse in judgment by a key decision maker.

In many cases, the organization’s initial actions (or lack thereof) compound the problem. In the wake of the 2010 Deepwater Horizon oil spill, BP’s numerous misstatements made it appear that the company was attempting to mislead the public regarding the actual volume of oil dumped into the Gulf of Mexico. During the recent Toyota airbag recall, the problem festered because the company’s internal investigation failed to get to the root of the problem.

An ethics and compliance crisis can cause severe damage to the brand and reputation of even the most highly regarded organizations. For example, revelations that Wells Fargo employees created fake accounts to generate additional fees has caused this once well-respected organization to scramble to salvage its good name. As Warren Buffett so aptly stated, “It takes 20 years to build a reputation and five minutes to ruin it.”

Taking a Proactive Approach to Crisis Management

Even with the increased scrutiny that E & C receives these days, many organizations discover much too late that they are unprepared to deal with a crisis. Consequently, they must resort to taking a “finger in the dike” approach to crisis management, which only makes a bad situation worse. The more ethics-savvy organizations plan for a crisis by developing and implementing a more systematic methodology to identify and address a potentially serious event in the early stages.

Developing a Crisis Management Protocol

Adhering to the belief that the best defense is a good offense, organizations across the U.S. and around the world have taken the step of crafting a protocol for the efficient management of an ethics and compliance crisis, from the time of initial discovery to final resolution. This ensures a prompt, effective response that eliminates the likelihood of potentially devastating misstatements or unclear communication. It also enables the organization to present a unified front that inspires consumer confidence and demonstrates total transparency throughout the process.

The components of a comprehensive ethics and compliance crisis management protocol include:

1. Creation of a Crisis Management Team – A CMT is a multi-dimensional group comprised of top organizational leaders from a cross-section of departments such as ethics and compliance, legal, human resources, finance and information technology. In larger organizations requiring a complex crisis management structure, the chief ethics and compliance officer, along with other key leadership personnel, plays a critical role in the creation of the process. In smaller operations, the CECO educates top executives on the need for crisis preparedness and often spearheads CMT development.

The CMT is responsible for developing an organization-wide crisis management plan and serves as “ground zero” during the outbreak of a crisis. Upon selection of the team, its members should stage a brainstorming session to identify the types of crises that are most likely to impact the organization and tailor the response plan accordingly.

2. Establishing an Incident Assessment Process – A crisis management methodology should include a procedure for assessing the severity of an incident. This entails a careful evaluation of factors such as the risk of reputational damage, public relations issues, the possibility of compliance breaches and any associated criminal/legal liability, financial ramifications and the potential for health and safety risks. It should also consider all likely sources of complaints or issues such as reporting hotlines, audit results and communications from employees, customers and stakeholders.
3. Creating a Communication Plan – Once the CMT has assessed the severity of the crisis, it needs to communicate the information to the appropriate individuals within the organization. Depending on the nature and seriousness of the incident, individuals that should be informed of its existence include key members of the management team and the board of directors.

In urgent situations requiring immediate action, it may also be necessary to issue a company-wide message and notify vendors, consumers, and in the event of possible criminal activity, law enforcement. General counsel should be consulted before issuing any external communication. Another critical component of the communication plan is developing an effective strategy for dealing with the media should the need to “go public” with the crisis arise.

4. Developing Investigative Procedures – Most ethics and compliance crises will require an investigation to uncover the facts surrounding the incident. The CMT has a hand in the development of a comprehensive investigation methodology and the selection of a team to carry out the process. The CMT must also make a crucial decision concerning whether the organization has the resources and wherewithal to execute a thorough, impartial investigation in-house or if it should seek third-party assistance. Additionally, the CMT should establish clear criteria for determining if a full investigation is warranted or if the matter can be handled by the affected business unit.
5. Establishing Reporting/Resolution Procedures – The CMT should also develop clear written procedures that dictate how investigators report their findings. Some organizations have created a reporting template to ensure consistency. The report should serve as the basis for the final resolution of the conflict. At this point, the CMT, along with top management, legal counsel and human resources can make informed decisions on how to best resolve the crisis. This includes identifying if there is a need for self-reporting, which can often mitigate the situation by reducing penalties levied for compliance breaches, and whether it is necessary to take disciplinary action against employees.

Developing a similar crisis management protocol that is tailored to the unique needs of your organization will ensure that the right people will know about the situation before it can escalate – and that proper procedures are in place to deliver the best resolution for the organization and all involved parties.

Lighthouse Services offers access to premium investigation services that can prove invaluable during this critical phase of the crisis management process. We also encourage you to review our informative whitepaper, “Best Practices for Handling an Ethics Hotline Report: Developing Policies and Procedures for Conducting an Effective Ethics Investigation.”