Susie Giordano is a director of Super Micro Computer Inc. and the chief legal officer of Lime. She also served as interim general counsel and corporate secretary of Intel Corp.
What defines a crisis, as opposed to other weighty issues that boards need to address?
I liken it to the wildfires we’re seeing. A brush fire in and of itself may not be a crisis, but when several small fires get whipped up by the wind, they can meld together into a big fire — which then becomes a crisis. It’s when the narrative gets out in front of you because there’s an additional factor you weren’t anticipating that may not even be connected to the first issue, but somehow the press headline connects the two things. That’s the wind that whips this into something that requires containment. You’ve lost control of your ability to address what is happening, and the headlines are way out ahead of where you are.
Another element is that you don’t have all the facts when you’re trying to deal with it. You don’t know how deep it runs or how pervasive it is. And you’re caught between looking for what started the fire and trying to contain the blaze. You have to do both in parallel.
A classic example was Chiron Corp., when its flu vaccine manufacturing license got yanked. That resulted in British regulators, state AGs, the Department of Justice and the Securities and Exchange Commission, congressional subpoenas and the tobacco plaintiffs all coming after the company simultaneously, and management didn’t yet know the full scope of the problem.
How does a board prepare for a crisis?
You’re never going to be prepared for the crisis that comes. It’s like childproofing your house — it’s never the predictable thing that sends your child to the emergency room. Sometimes it’s a combination of things you aren’t anticipating.
But there are things you can do. You need to know who on your board is going to run toward the flame versus who is not. Board members need to have time. Everybody wants board experience, but not everyone has time to commit to a crisis situation, which is when your board members are most needed. You may be required to drop everything you’re doing and spend long days in the situation room until you have the crisis under control.
You also need truly independent directors. If your crisis involves the CEO and your most prominent board member went to business school with them and they’re golf buddies on the weekend, that’s probably not the person to run the investigation, even if they meet all of the objective Nasdaq independence tests.
It’s also crucial to get your outside contacts in place well ahead of time. The board may want to engage separate counsel from the company’s general corporate counsel. If so, the last thing you want is a law firm taking three days to clear conflicts when you need experienced counsel on calls immediately. Have a stable of law firms ready. Have a PR firm ready — and one that knows your business and your customers. If you know who your first responders are, you’ve saved 72 hours in a process where people are scrambling. Every minute counts.
How do you balance full board participation versus speed and availability?
It depends on the issue. If it’s financial, your audit committee chair is probably best positioned to lead the response. If it’s governance, someone like me, with a strong background in corporate governance. If it’s cyber, do you have a cyber expert on your board?
It’s not practical to bring the full board along every step of the way. Immediately establishing a special committee is a really good practice, and who’s on it should be the intersection of who’s got the expertise and who’s got the time. Working by committee with regular updates to the full board is a good model.
What do you think about tabletop exercises?
Honestly, I’m skeptical of their value in preparing for crises generally, and they require a tremendous amount of time and internal resources. It takes many hours to put these together, and it’s the Mike Tyson thing: Everyone has a plan until they get punched in the face. Then everybody panics, nobody can find the playbook.
But there are ways to prepare. The bigger the organization, the more important it is to know your escalation paths. Whether you need to run the whole tabletop, I don’t know — but everyone throughout the organization needs to know, if something happens, this is who I go to.
Even more important than a tabletop exercise is managing communications for attorney-client privilege. In a crisis, it’s a free-for-all — everybody’s texting, trying to help. The key is to stay calm, keep your processes and protocols, don’t make it worse. Employees, board members, and executives communicating and speculating — that’s fuel for the fire.
You need to know who on your board is going to run toward the flame versus who is not…. Everybody wants board experience, but not everyone has time to commit to a crisis situation, which is when your board members are most needed.
Even if a full tabletop isn’t warranted, would a board discussion about how to approach a crisis be useful — escalation paths, key communications principles, go-to outside firms, who runs point?
Extremely useful. And I’d add that boards need to know the company’s values and ethos, because when a crisis hits, that is not the time to be talking about what really matters to us: Do we care more about the CEO’s reputation, or about doing the right thing? Do we care more about margins, or about safety? Boards should have those conversations early and often.
When the crisis happens and the advisers come in, everyone focuses on the stock and shareholders. But the customer element is huge, and that can get ignored. You have to look at all the recipients of the information — how you want to communicate and what actions you want to take.
Isn’t there tension between the attorney-client privilege and the need to communicate with employees and customers?
There’s real tension. Outside counsel may caution against breaching the privilege by saying too much, while the CEO and board are saying, “We have employees and customers to think about. We need to get information out there.” But if you leap to conclusions without knowing what you’re dealing with and conveying those thoughts, that’s a problem.
On the employee side, if there’s a communication lockdown, the next level down doesn’t know what to believe. Nobody can talk to them, and they start looking for their next job.
The practical advice for boards: Know who your key performers are, and not just those who figure in your CEO succession planning. If a crisis hits, who steps into the gaps to keep delivering on the business? Identify culture carriers you can trust in a privileged conversation, so they can help keep things calm and stabilize the team.
What about management’s role in communications versus the board’s role?
It’s fact-specific. Management won’t want to run everything through the board, but the board will feel uncomfortable with external communications they haven’t seen. Maybe the board nominates one person to review communications so that, as long as that person has looked at it, the board is comfortable. The board’s role should be oversight.
If the crisis involves malfeasance of senior people, the chairman or lead independent director would naturally step in to communicate. That’s one of the key criteria for the chair or lead independent — that they can communicate and step in.
What other issues can you expect to come up in a crisis?
First, you may need to cooperate with law enforcement. You may have Southern District of New York or the SEC making inquiries. Making sure the board understands how the company needs to engage with law enforcement is important. That might be a new skill for many board members.
Second, maintain communications security. Before the crisis hits, have an understanding of how the board will communicate. Diligent board software is the most secure, but it’s clunky. Text is easiest. Many people use Signal. But the time will come when devices are collected and imaged. Directors need to understand that, if there’s ever a crisis, their devices may be taken. In a law enforcement situation, you can’t control what happens to that information.
Third, there’s always a risk that internal investigations turn up other, unrelated damaging information — for example, salacious photographs are found on an executive’s computer. Those issues come up through outside counsel’s report to the special committee, and it’s up to the committee to figure out whether the company needs to take action on now another new fire.
Any tips on engaging with outside auditors during a crisis?
The auditors want to know everything, but if you tell them everything, you’ve blown attorney-client privilege.
In managing a crisis, you need to involve the auditors as a partner. The problem may arise right before your 10-K filing, and the auditors will say they’re not releasing their consent until they understand what happened. I can’t tell you how many times I’ve heard about a whistleblower complaint coming five days before a filing, and you’re trying to figure out whether to hold up the filing and watch the stock crash, or not.
Involving the audit partner and understanding their parameters ahead of time is something you can prepare for. Have a session with them. Understand their internal processes, timing and structure. For example, you could have a junior audit partner who has three levels to run through before anything goes to national, or you may have someone very senior. Getting that lay of the land ahead of time is helpful.
View other articles from this issue of The Informed Board
- It’s Time to Start Preparing for Congressional Investigations
- SEC Forms Beefed Up Enforcement Unit to Focus on Public Companies
- The SEC’s ‘Hands-Off’ Policy Alters the Calculus for Excluding Shareholder Proposals
- A Guide to Coping With Divergent State AI Regulations
- Activism Update: Fewer Proxy Contests, More AI-Focused Themes
- Podcast: State AGs Step In Where They Think Feds Aren’t Doing Enough
- Delaware Court Reaffirms Deference to Directors in Risk Management Cases
See all the editions of The Informed Board
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.