Bloomberg Law
May 26, 2023, 8:00 AM

Five Key Steps for Initial Crisis Management

Jennifer Kennedy Park
Jennifer Kennedy Park
Cleary Gottlieb Steen & Hamilton
Rahul Mukhi
Rahul Mukhi
Cleary Gottlieb Steen & Hamilton
Abbey Doyno
Abbey Doyno
Cleary Gottlieb Steen & Hamilton

In our fast-paced, globalized, regulated, and litigious environment, companies must be prepared to respond to unexpected corporate crises. Crises can arise from business failures, personnel upheaval, legal enforcement actions, whistleblower complaints, cyber-attacks, natural disasters, and other causes. Any of these crises can result in significant financial, legal, and reputational harm to a company.

Adequately addressing a crisis, and any potential consequences, requires a quick, thoughtful, and strategic response. Based on our experience, there are five key steps to take immediately after a crisis emerges.

Build a Response Team

To respond quickly and effectively, a company should create a team of key stakeholders to lead the crisis management efforts. Identifying who will participate in the initial response and who has decision-making authority amongst the group will ensure that those with the relevant perspectives and skills contribute, help prepare the company for potential outcomes and consequences, and assist with preserving transparency and candor.

An immediate response team should include: relevant business personnel, subject matter experts, public relations/communications specialists, and legal counsel, and may include members of the board or their management designee.

Including legal counsel in discussions about responding to the crisis will help facilitate frank consideration of outcomes and consequences, and can protect the crisis discussions from disclosure. Involving legal counsel as early as practicable can help avoid an inadvertent privilege waiver.

Preserve Evidence

A crucial first step after a crisis is taking appropriate steps to preserve evidence and prevent spoliation.

If litigation is anticipated, the company should send a preservation notice to their relevant personnel, usually with an explanation of why documents and data need to be preserved. Routine deletion processes should be paused, and the company should keep a record of measures taken to preserve evidence.

Companies whose employees use their personal phones for business communications should consider applying the same preservation policies for those devices and third party messaging applications such as iMessage, WhatsApp, and WeChat.

Determine the Scope of the Crisis

The scope of the crisis may be unclear at the outset. “Mission creep” can often occur if scoping discussions are elided at the outset of a crisis response. Scoping discussions will be influenced by the type of crisis at hand, for example:

Whistleblower or Media Reporting. When a crisis is sparked from a media report or a whistleblower complaint, the investigation’s scope will likely focus on whether the allegations have substance. Internal scoping discussions may center on how to identify the causes of the allegations and whether any conduct related to the identified issue has taken place.

Regulatory or Law Enforcement Requests. When a crisis is onset by a government subpoena or request, the government authority may provide some guidance on the focus of its investigation. This information can be the starting point for any internal reviews. Scoping discussions with the investigating authority can help the company better understand the investigative focus as well as get a sense of the potential cost and timeline of the investigation.

When No Investigative Authority Is Involved. The scope of a potential investigation may be uncertain when the crisis is not in response to a specific complaint or investigation from authorities, but rather due to other internal or external prompts, e.g., unexpected financial results or an industrywide crisis. In these circumstances, the company may consider conducting an initial round of informal interviews and a limited review of documents, in order to inform the initial scope and next steps.

In many jurisdictions, a company can be held liable for the acts of its employees. And, regardless of the type of crisis, the company should determine whether any individuals, such as employees, officers, or directors, may be subject to personal liability. Determining employee liability is important for understanding legal representation issues and for addressing remediation.

Consider a Written Investigation Protocol

The company may be required to conduct an internal investigation regardless of whether investigating authorities have requested one. A company’s board of directors or management may be obligated to investigate in order to satisfy its fiduciary duties and to mitigate any consequences related to the alleged misconduct. Even if not required, an internal investigation may be important for fact-finding and remediation purposes.

It is essential for the response team to draft an investigation protocol for gathering, reviewing, and preserving information early in the crisis. Having a written protocol is a way to align stakeholders on scope and to make a record of steps taken in response to the crisis for potential future government communications.

An investigation protocol should outline the context and scope of the investigation, identify those responsible for collecting information, determine evidentiary custodians and fact witnesses, how evidence will be assessed, and who will be interviewed. Further, an investigation protocol should provide detailed descriptions for how to identify relevant and privileged evidence.

Notify the Necessary Parties

The initial response team should consider whether any internal or external parties should be notified of the crisis or if public disclosure is required, and when to share the requisite information.

The company’s legal team may be legally obligated to escalate concerns to the board of directors and the company’s officers. Likewise, external auditors who uncover a concern may be required to inform appropriate parties in the company, such as the board of directors or a special committee. In some circumstances, customers or clients may need to be notified, or the government.

Legal counsel should be involved in discussions about notification and public disclosure.


The initial response to a crisis is crucial for mitigating a company’s financial, legal, and reputational exposure. A quick and effective response can demonstrate to stakeholders, the public, and any investigating authorities that the company is thoughtfully addressing the crisis and stabilizing its business.

This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.

Author Information

Jennifer Kennedy Park is a partner at Cleary Gottlieb Steen & Hamilton who focuses on white-collar defense, enforcement actions, crisis management, and complex disputes.

Rahul Mukhi is a partner at Cleary Gottlieb Steen & Hamilton who focuses on criminal, securities, and other enforcement and regulatory matters as well as on complex commercial litigation.

Abbey Doyno is an associate at Cleary Gottlieb Steen & Hamilton who joined the firm’s Bay Area office in 2022.

Write for Us: Author Guidelines

Learn more about Bloomberg Law or Log In to keep reading:

Learn About Bloomberg Law

AI-powered legal analytics, workflow tools and premium legal & business news.

Already a subscriber?

Log in to keep reading or access research tools.