A recent article, Crisis prevention and readiness by Claudia H Allen, David A Brown, and Patrick A Lee, published by the Harvard Law School Forum on Corporate Governance, is timely. It proffers a good deal of advice on how boards can be more alert to potential crises and more effective in response if one occurs. It is worth close study by boards of a wide range of organisations. The emphasis is very much on crisis prevention, with an underlying theme that demonstrates how corporate culture holds the seeds of a crisis if not tended properly.

The authors invite readers to reflect on both external and internally generated crises.

1. Are the board’s eyes open to what seems to be an increasing likelihood of externally triggered crises? For example, cyber-attacks, natural disasters, terrorist acts and supply chain failures are frequently in the news. How well prepared is the board and the operational organisation to prevent and, if necessary, respond to these kinds of events?
2. Given the potential for deep and long-lasting reputational impacts from self-inflicted crises  (eg, product quality failure, workplace safety disasters, sexual harassment and other forms of cultural dysfunction, unethical sales practices and serious deficiencies in legal/regulatory compliance), how alert is the board to the generation of these crises and how effective is the organisation in preventing these?

To help think through these challenging demands, Allen, Brown and Lee offer an extensive checklist of talking points, questions and guidance on crisis prevention and readiness.

The content is aimed at board members but may also assist executives to help their boards shape the kind of framework that will clarify mutual roles and responsibilities. Except in extreme circumstances, boards should not usurp management’s role in crisis prevention and readiness. The authors suggest, however, that the lessons of highly publicised corporate crises point to the desirability of boards reassessing (and increasing) their level of engagement in this critical area.

In this review, we follow the broad structure of their article and offer glimpses of the content but refer only to a sample of the material the authors offer to help boards explore this important topic.

Does the culture make it safe for people to do the right thing?

Allen et al suggest the aim should be to create an open, comfortable atmosphere that encourages people to come forward and speak up about problems—even if those are not yet fully formed. The ideal is to eliminate conditions that would deter people from asking questions, disagreeing and bringing up difficult subjects. To support this ideal, boards should:

• be clear about the behaviours for which the organisation has zero tolerance
• create a culture of accountability. All employees need a sense of what is expected and what is rewarded.
• emphasise values and purpose in the decision-making framework. They should make it clear that the organisation will stand behind employee decisions that are grounded in the company’s values. The authors note that corporate loyalty is now less of a motivator for millennial and other younger generations who may care more about the larger purpose behind their work.
• recognise the importance of how employees are onboarded, core values are communicated, and expectations set. The board should ensure the organisation supports new employees to live up to those expectations with training and regular reminders. There should be direct board-level involvement in this induction process for new senior executive hires.
• recognise the influence of performance targets. Most people will aim for the targets they’re given but setting performance targets linked directly to rewards can have unintended consequences by stimulating the kind of behaviours that can lead to a crisis.

Boards should closely monitor culture and incentives enterprise-wide

Spotting potential problems early enough requires a combination of probing dialogue in the boardroom and exposure to the everyday culture of the company, for example:

• Focus on outliers. Insist that the board be informed about anomalies both negative and positive. The board’s job is to be sceptical about management explanations for these, and not be fobbed off.
• Send a clear message that preventing workforce harassment and abuse at all levels is a top priority for the board and senior management. Specify the types of complaints that must be brought to the board’s attention. Inquire actively about culture and how it relates to instances of alleged sexual misconduct or inappropriate behaviour, in particular. Assess the suitability and soundness of relevant policies, processes (eg, employee hotlines), training and enforcement.
• Ensure the board understands culture-related risks and how they are being addressed. Make specific inquiries. For example, as remuneration has the potential to drive the wrong behaviours, conduct a formal risk assessment of incentive programmes.
• Use a ‘reputation lens’ to assess, manage and oversee risk. And do not focus only on financially material risks.
• Ensure a robust risk and control culture is in place and check there are effective controls for key operational risks. Be open and sensitive to early warning signs.
• Have board members involved in determining their information needs and when additional information is warranted for effective oversight.
• Ask the auditors and others with a line of sight into the business what they are seeing.
• Have directors (in pairs) spend time outside the boardroom and corporate headquarters. Get a first-hand feel for what’s happening on the ground in the business.

Calibrate board and committee processes and communications for a better line of sight—particularly into culture, ethics and compensation risks

Standing committees often have different lines of sight into culture, ethics and incentive risks, and different views as to potential vulnerabilities. Standard board committees such as, for example, those dealing with audit and compensation, also usually incorporate outside experts in their processes. Any committee dealing with chief executive succession may also have a unique perspective on talent and incentives. The authors also suggest it is worth bringing the committee chairs together periodically to coordinate and calibrate.

Have a crisis response plan in place—and practice it

What are the categories of crisis that could occur? Ask the board and management to identify the five worst things that could happen to the business. It is worth verifying these from the perspective of key stakeholders. Also check if alert systems are in place for escalating issues quickly to the appropriate levels in the organisation.

Identifying crisis scenarios and actively practising suitable responses is well worth the investment. One approach proposed is to conduct ‘tabletop’ exercises on specific risks. For example, ‘what would we do in the event of a major cyber breach?’ For each category of crisis, develop a response plan and assign responsibilities. Among other things, clarify the role of the board vis-à-vis management. Test if the critical elements in place for successfully managing, say, a cyber breach, could also be applied to other kinds of potential crisis.

When a crisis does occur, be transparent, accountable and clear about who is calling the shots

Whether the news is positive or negative, transparency and speaking with a single, clear voice is essential for an effective response and quick recovery—particularly in the eyes of customers, employees and the public. The authors suggest every board should ask three key questions:

• Have we determined the full scope of the crisis?
• Are the board and management all together/of the same mind on what’s being done?
• Are there reference points to check on progress as the crisis management and mitigation efforts progress?

The board’s role is to stay informed and oversee management’s response—without getting in the way. The authors suggest that guiding principles to support this include:

• making sure everyone knows what the company’s values and priorities are when a crisis happens
• being as transparent as possible
• being clear who is ‘calling the shots’
• supporting management, while ensuring the board takes independent advice if necessary
• then, focusing on the finding the root cause of the crisis and the measures needed for recovery.