A General Counsel’s Guide to Maintaining Ethics and Compliance in

Crisis Management THOMSON REUTERS RISK, ETHICS & COMPLIANCE FORUM

NOVEMBER 2, 2016

The Panel Moderator

Eve Costopoulos, Esq., General Counsel, Turing Pharmaceuticals (formerly Chief Compliance Officer, Eisai Inc.)

Panelists

Jacqueline Brevard, Esq., Senior Advisor, GEC Risk Advisory LLC (formerly Chief Ethics & Compliance Officer, Merck & Co.)

Louise Harris, President, Iron Petal Communications (formerly Chief Global Strategist, Ruder Finn)

The Basics: What is a Crisis? Threatens or could threaten harm to people or property, seriously interrupt business, damage reputation and/or negatively impact share value. Usually: materializes unexpectedly

is seized upon by the media

requires short response time and urgent decision-making

creates a sense of loss of control Routine business operations become increasingly difficult to maintain

reinforces a need for a change

requires specific and focused communications Communications may become difficult to manage

invites public/shareholder/government scrutiny Can impact operational and financial stability

can create short term and long term reputational damage

fosters a need to blame

Most Crisis Prone Industries - 2015 Food

Energy

Automotive Manufacturing

Transportation

Banking, Insurance & Financial Services

Education

Government Agencies

Pharmaceuticals

Health Care

Retail

Source: Institute for Crisis Management – 2015 Annual Crisis Report, issued March 2016

2015 Crisis Categories

Source: Institute for Crisis Management – 2015 Annual Crisis Report, issued March 2016

Examples Volkswagen

General Motors

Toyota

(mismanagement)

Brazil/Petrobras (bribery)

Penn State (mismanagement/criminal conduct)

Amazon (mismanagement/degrading/demean

ing culture)

Hyatt; Hilton; Jeep; Experian; Scottrade

(cybercrime/data breaches)

Starbucks (consumer activism)

Subway (mismanagement/criminal conduct)

Chipotle (mismanagement)

FEMA/Hurricane Katrina

(gross mismanagement/execution failure)

Tylenol (product tampering)

What is Crisis Management? How an organization deals with a crisis. Includes: Plans, process and methods used to respond to both the reality and perception of crises

Metrics that define what constitute a crisis and necessary response mechanisms

Communications that occur within the response phase of crises and beyond

Who should be part of Crisis Management Team?

C-Suite Executives

Operations

Legal/HR

Compliance

Communi-cations

Investor Relations/

Public Affairs

Finance/

Accounting

Security/

EHT

Information

Technology

External Support

Risk Manage-

ment

How to Measure Success

How soon was situation addressed and business operations restored?

Were losses minimized?

Were changes in practices and policy made?

What were lessons learned?

Role of Crisis Management Team (during a crisis) Define issue Assign roles and responsibilities for each team member Identify a spokesperson

Assess risks and business interruption impact Prioritize actions and respond in a timely fashion Speed and efficiency in response time are critical

Retain control Develop a proactive communication plan that shows the company is under control, knows what is happening, and

can resolve the situation Identify appropriate media avenues Communicate accurate information Mobilize third party allies Ensure planning process includes long term effects of decisions

Minimize loss Create atmosphere of “normalcy”

Role of Crisis Management Team (proactive) Preparation is key – an organization’s credibility and reputation is heavily influenced by the audience’s perception of their responses during crisis situations Promote crisis ready culture – develop management support and a highly flexible and functional team Assess risks, likelihood and business interruption impact account for low probability/high consequence situations

Publish plans and conduct training predictable and quantifiable events unexpected and unwelcome events

Test, review, and practice responses create draft communications that can be tailored for specific situations monitor social media for “actionable intelligence”

Establish decision makers and accountability Minimize impact of crisis and resume normal operations Review lessons learned and incorporate into ongoing operations to prevent reoccurrence

Communication Planning Social media has dramatically changed how companies respond to a crisis

Responses on Social Media are a must (Facebook, Twitter, blogs, etc.)

Identify and train spokespersons (preferably in advance of crisis)

Know your audiences

Establish corporate strategy for managing communications notification systems to reach internal and external stakeholders Monitoring systems to track intelligence and feedback from stakeholders

Get well-crafted messages out quickly to establish trust Immediacy is key

Identify those communication platforms that will be used as a primary source of information

Use data analytics to track and predict threats

Maintaining the Corporate Culture (Compliance and Ethics) Critical to have a comprehensive compliance and ethics foundation that is integrated into the day-to-day business and reinforced on a regular basis Tone at the Top

Written guidelines and examples of appropriate behaviors are key

Behavioral expectations defined

Employee behavior and decisions are assessed and monitored

“Safe to Speak Up”

Build management capacity to handle crises and weather the storm

Let everyone know that integrity cannot be compromised

Communicate frequently to reinforce messages

Use the Board and senior executives to convey the right kind of actions and attitude required to get through a crisis

Common Mistakes

Inadequate planning and processes

Failure to bring business into the planning and testing of efforts

Failure to gain support from senior level managers

Failing to identify lessons learned

Failure of leadership: “It can’t happen to us”

Strong leadership is key in a crisis

“The only way Samsung will be able to learn from this experience is to have strong leaders address shortcomings found within the company’s culture and processes. Without proper leadership, Samsung risks having this crisis begin to impact other parts of its business and jeopardize its long term relationship with the general public”. Neil Cybart, Analyst, Fast Company 10.12.16

Strong leadership is key in a crisis

“I went straight to Mojave Desert, where the accident had taken place, which I think anybody who’s running a company must do if there’s an incident. I was able to talk to the engineers, talk to all the wonderful inventors there, and say ‘this was nothing to do with you, it’s not your fault and, if you want, I’ll continue to support the venture and, I think with one voice, they said they wanted to continue.” Richard Branson

Impact of Apologies

Are often limited due to legal and regulatory concerns In these days of social media and reputational concerns, public opinion can trump legal response

Are effective when: Acknowledge what happened

Allow for criticism

Accept responsibility

Explain why it happened

Offer compensation and policy improvements1

1 Adapted from “The Role of Apologizing in Crisis Situations, Organizational Preparedness for Reputational Crises, and How an Apology Might Have Affected Australia’s AWB Controversy,” Peter M. Sandman, 2005.

When apologies work…

“Senior executives from Texaco will visit every major company location in the U.S. to meet with our people. Their mission will be to apologize to them for the embarrassment and humiliation this has created. We want them to understand both our personal embarrassment and our firm resolve to ensure that nothing like this ever happens again at Texaco.” Peter Biljar, CEO, Texaco

…and when they don’t

“Nobody is more sorry than me. I want my life back!” Tony Hayward, CEO, BP

How to Measure Success

How soon was situation addressed and business operations restored?

Were losses minimized?

Were changes in practices and policy made?

What were lessons learned?

How do these companies measure up?

Are You Prepared for What May Come?