The first decisions in a crisis
In the early hours, the company has to stabilize the situation, gather facts, and avoid statements it will regret. That usually means forming a small response team with legal, operations, communications, and a board liaison, and deciding who speaks for the company. Facts tend to change quickly, so public and internal statements should be accurate, limited to what is known, and updated as the picture develops. Regulators may need to be notified, sometimes within short deadlines that start before the investigation is complete. Insurance policies, including cyber, product liability, and directors and officers coverage, often require prompt notice, and late notice can complicate coverage.
Protecting the investigation
How the internal investigation is set up affects whether its findings and communications are protected. When counsel directs the work and retains outside consultants, such as forensic firms, for the purpose of giving legal advice, privilege is more likely to apply, though courts examine the arrangement closely. Preserve relevant records, suspend routine deletion, and keep affected systems in their current state where possible rather than wiping or rebuilding them before evidence is captured. Employees can be asked to keep the matter off personal accounts and to route outside inquiries to a designated contact, and any such instruction should preserve their right to report to regulators. Interviews with employees should be planned so that witnesses understand whom the lawyer represents.
The board and the longer tail
Directors have oversight responsibilities, and a crisis is a moment when their involvement is tested and later reviewed. Boards should receive regular, documented briefings and decide whether an independent committee is needed. Public companies must consider whether the event requires a current report or other disclosure, and whether trading by insiders should be restricted. A crisis often brings follow-on litigation, regulatory inquiries, and customer or lender questions over months. When we are brought in, we help set the response structure, prepare communications for regulators and stakeholders, and plan for the investigation, disclosure, and litigation steps that tend to follow.
