The first call comes at 3 a.m. A ransomware attack has locked down critical systems. By dawn, a whistleblower complaint surfaces, alleging misconduct by senior executives just hours before an earnings call. A regulator’s inquiry arrives with a tone suggesting the government already knows more than the company does. A financial restatement looms, threatening investor confidence and board credibility all at once.
These are not hypotheticals. They are the kind of real-time crises that force corporate lawyers—both in-house and outside counsel—to do more than answer legal questions. They must help companies think clearly under extreme pressure, while ensuring their actions hold up to scrutiny from regulators, judges, and the public. The first hours matter, but so do the decisions made in the weeks and months that follow.
Who’s in Charge When the Boardroom Becomes a Crisis Command Center?
When a crisis hits, the first question is rarely about the law. It’s about leadership. Management often controls operations and information, but the board carries independent oversight obligations—especially when allegations involve senior leadership, financial reporting, or regulatory compliance. The challenge is figuring out who should take charge in real time.
The answer isn’t always obvious. Should the full board handle the crisis directly, or does it require a special committee and independent counsel? Directors need enough information—properly documented—to decide when to defer to management and when to intervene. These early decisions shape the company’s legal position, affect privilege protections, and determine whether later scrutiny views the response as thoughtful governance or reactive damage control.
One common misstep is assuming the board’s role is static. In reality, it evolves. What works in the first 24 hours may not apply a week later. Counsel must be prepared to adjust as the crisis unfolds, ensuring the board’s actions remain consistent with its fiduciary duties while avoiding unintended legal or ethical pitfalls.
Preserving Privilege While Finding the Facts
Internal investigations are often the heart of crisis response. But a poorly structured investigation can create new risks. Counsel must decide: Who is directing the probe? Who conducts interviews? How are documents collected? How are findings reported, and to whom? The tension between speed and legal protections is immediate. Business leaders demand answers fast. Regulators expect cooperation. Employees may be anxious, and the media may ask questions before the company has completed its review.
The stakes are high. A rushed investigation risks waiving privilege or creating an incomplete record. A delayed one may appear evasive. Lawyers must balance the need for reliable information against the risks of overreaching, whether by gathering too much (and exposing sensitive data) or too little (and leaving gaps that later scrutiny exploits).
Document preservation is another critical area. Electronically stored information (ESI) must be secured immediately, but the process must follow legal protocols. Deleting or altering files in panic can create spoliation risks. Meanwhile, interviews with employees or executives must be handled carefully to avoid coercion or misrepresentation. The goal isn’t just to gather facts; it’s to gather them in a way that survives legal challenges.
There’s no one-size-fits-all approach. Some crises require a broad, company-wide review. Others call for a narrowly focused probe. The key is structuring the investigation so that its methods, and any resulting reports, can withstand scrutiny from regulators, plaintiffs’ lawyers, or courts.
That said, not all crises follow the same script. Some unfold in days; others drag on for months. The framework must adapt, but the principle remains: every decision, from who leads the investigation to how findings are documented, should be made with an eye on how it will look in hindsight.
When Communications Become as Critical as Legal Strategy
Every corporate crisis is also a communications crisis. Silence can fuel suspicion. Premature statements may create liability. Public companies face disclosure obligations. Regulated entities have reporting duties. Private companies must manage expectations with employees, customers, and business partners. And in nearly every case, someone is watching: regulators, plaintiffs’ lawyers, the media, competitors, or the court of public opinion.
The challenge is shaping messages that are accurate, disciplined, and aligned with legal obligations. That doesn’t mean lawyers should become PR professionals. It means understanding how communications strategy intersects with litigation risk, regulatory exposure, and corporate governance. Inconsistent messaging is a red flag. What the company tells employees should not contradict what it tells regulators. What appears in a press release may later appear in a deposition or enforcement action.
Good crisis management requires coordination. Legal and communications teams must work in lockstep. A misstep in one area can amplify risks in another. For example, a vague public statement might satisfy short-term PR needs but create confusion in later legal proceedings. Conversely, overly defensive language could escalate regulatory scrutiny.
One practical rule: Assume everything will be scrutinized. Even internal emails or board discussions may surface in litigation. The goal isn’t to avoid all communication but to ensure it’s deliberate, well-documented, and consistent across all audiences.
Ethics in the Pressure Cooker
Crisis conditions magnify ethical risks. Lawyers face tough questions about representation, conflicts, confidentiality, and reporting obligations. In-house counsel may juggle roles as legal adviser, business strategist, investigator, and institutional memory. Outside counsel must move quickly while maintaining independence and professional judgment.
Fundamental questions arise fast: Whom does counsel represent when company and executive interests diverge? How should interviews with employees be conducted to avoid coercion? What must be done to preserve documents without overreaching? When does advocacy cross the line into obstruction or concealment?
These issues matter beyond the immediate crisis. Regulators, judges, and plaintiffs’ lawyers will evaluate whether a company acted responsibly. A well-documented, ethical response can improve settlement posture and judicial perception. A haphazard one may invite further scrutiny, or worse, criminal exposure.
Yet the pressure to act quickly often clashes with the need for careful judgment. The best-prepared lawyers don’t just react; they’ve thought through these dilemmas in advance. Playbooks, training, and clear protocols reduce the risk of ethical missteps under pressure.
A Framework for the Full Life Cycle of a Crisis
Crises don’t follow neat timelines, but the planning for them must start long before the alarm sounds. The most effective crisis management begins with preparation: refining governance structures, setting escalation protocols, drafting playbooks, and training incident response teams. The goal is to turn chaos into a structured process.
The first phase is the most critical. In the first 45 minutes to an hour after a crisis is identified, counsel must help the company identify the problem, convene the right decision-makers, preserve evidence, retain necessary advisers, and control communications. These early steps set the tone for everything that follows.
From there, the response widens. Internal investigations run in parallel with regulatory engagement, public disclosures, and employee communications. Insurance coordination, remediation efforts, and litigation strategy all come into play. The work doesn’t end when the headlines fade. Counsel must turn to governance reforms, compliance improvements, and, where needed, the slower task of rebuilding trust.
The best crisis responses aren’t improvised. They’re built on frameworks developed months or years earlier. The lawyers who handle crises well are often the ones who spent time on the unglamorous work beforehand: drafting playbooks, training teams, and ironing out privilege protocols. When the alarm sounds, they’re not starting from scratch.
That doesn’t mean crises can be predicted. But the companies that recover fastest, and face the least legal fallout, are the ones that treat crisis management as an ongoing discipline, not a reactive scramble.
Attendees at the upcoming program will leave with actionable guidance on organizing the first hour of a crisis, determining leadership roles, preserving privilege, handling ethical dilemmas, and coordinating legal and communications strategies. The focus is on avoiding common mistakes that often turn bad situations worse.
One such mistake is assuming the board’s role is fixed. In reality, it shifts as the crisis evolves. What works in the first 24 hours may not apply a week later. The key is flexibility, paired with a framework that ensures decisions are documented, defensible, and aligned with fiduciary duties.
The program will also cover how to recognize when a crisis is escalating, and when it’s time to bring in outside counsel or independent advisers. The goal isn’t just to survive the immediate storm but to emerge with a process that can withstand future scrutiny.
