How should you, as CEO, handle an accusation that your employee(s) engaged in illegal activities? How can you prepare for a crisis where your company’s goodwill, brand and reputation are publicly attacked?
This question hit home to me when I read the news last week about the bribery scheme involving dozens of parents of students applying to prestigious universities. Athletic coaches were accused of taking bribes to give admission to students who were not fully qualified for their particular sports. A response by one of these universities, Yale, showed how to respond to a potentially embarrassing crisis that could threaten goodwill among all constituencies, current and prospective. The lessons apply to businesses and non-profits as well as educational institutions.
1. Risk Management and Resiliency Planning. The Board of directors (or trustees) is responsible for identifying and managing risks that could threaten the enterprise’s value, ability to conduct operations and brand. Any alleged illegality by employees threatens the organization under the legal doctrine of “respondeat superior” as well as loss of brand value. The entity (as “principal”) is liable for the wrongdoing of its agents. Under a risk management and resiliency program, management and the team are responsible for anticipating, defining and planning for risky outcomes. This means scenario analysis, business impact analysis, measuring risk according to severity and probability, adopting insurance and indemnification policies, business continuity planning, disaster recovery planning, corporate governance policies to prevent rogue actions and setting standards of conduct for all employees and contractors.
2. Prepare an Emergency Response Team. As with any form of crisis management, effective brand management in a crisis requires governance by a team of individuals, both internal and external to the organization, to investigate, respond, communicate, rectify (if needed) and reconfigure to avoid a repeat of the disaster. The team should include leaders from different disciplines and points of view. In brand management, this means the Board, the CEO, CFO, Chief risk management officer (if any), Chief Marketing Officer and legal, HR and compliance advisors. The team must have a pre-designated credible spokesman, who would publicly respond in a manner duly authorized by the board of directors (here, a board of trustees). In privacy breaches, a similar team might also include the CIO and IT team as well as account managers. Ideally, the team should have pre-assigned roles and should do “table-top” training exercises in preparation for a real crisis.
3. Listen to the Press. In this case, television newscasters were portraying the alleged bribers as “avatars” of abuse by the super-rich, depriving equal opportunity for all applicants. Being aware of the public policy and slant by the press is essential to a responsive action.
4. Investigate with Confidentiality and Due Process. Both internal and external investigators should be engaged. External investigators lend credibility against suspicions of self-dealing, conflicts of interest by employees or simple incompetence. External investigators under the supervision of an external lawyer (or law firm) can conduct the investigation under the protection of attorney-client privileged communications and privileged attorney work product. (Internal lawyers run the risk of not having full “privilege” because some of their functions are managerial or administrative and thus subject them to inquiry as witnesses). The investigators should show respect for those being interviewed and afford them “due process,” including opportunities to deny, negate claims and present their own side of the story.
5. Don’t allege misconduct till you have proof. Meanwhile, demonstrate you are investigating all avenues. Otherwise, you might accuse an innocent employee and wind up with claims for defamation, invasion of privacy, intentional or negligent infliction of emotional distress, breach of contract, violation of internal policies, civil rights violations, fraud and racketeering (with triple damages claimed).
6. Act Quickly. In the era of viral Internet, delays only aggravate suspicions. Announce early that you are investigating.
7. Be accessible to your constituents. Know their interests and address them.
8. Reaffirm your values. Identify why the situation violates your values and policies and show you intend to act upon the results of the presently incomplete investigation. Under your corporate governance and human resources management programs, adopt policies against reasonably foreseeable types of misconduct. Hold your employees to compliance with written standards. Announce that your investigation is not only about finding guilty parties, but raising the standards by which all employees and contractors are judged.
Investigations and corresponding remedies take time, effort and focus. Used properly, they can deflect criticism and strengthen the loyalty of your constituencies while avoiding long-lasting impairment of brand value. Neglected or improperly pursued or reported could prove detrimental to your operations and ultimately brand value.
