Crisis Management

FOR DIRECTORS

Crisis Management 277 Wellington Street West

FOR DIRECTORS Toronto, ON. Canada

M5V 3H2

Tel: 416-204-3280

Fax: 416-204-3340

Canadian Institute of Chartered Accountants

Innovations for a changing world

C I C A I n n o v a t i o n s f o r a c h a n g i n g w o r l d
1

preface
The Risk Management and Governance Michael A. Gunns
Board of the Canadian Institute of Chair, Risk Management and Governance Board
Chartered Accountants has developed this Risk Management and Governance Board
Michael Gunns, Chair
briefing to help members of boards prepare Frank Barr
for and handle crisis. It is intended Michel Doyon
primarily to help individual directors but Parveen Gupta
boards may also wish to use it for Fred Jackson
Amy Lee
orientation and discussion. Colin Lipson
Mary Jane Loustel
Two previous guidance documents for Directors Advisory Group
directors, Governance Processes for Control Roy Bennett, Chair
and Dealing with Risk in the Boardroom, James Baillie
Purdy Crawford
address governance under “normal Claude Fontaine
operations” – a continuous process of James Gillies
approving and monitoring plans, resources Robin Korthals
and performance. There are times, however, Giles Meikle
Patrick O’Callaghan
when members of boards must deal with Guylaine Saucier
difficult and complex situations, make hard Written by: Hugh Lindsay, CA, AIIC
decisions and commit a greater amount of
CICA Staff
time to the governance of their organiza- Cairine Wilson
tion. This document is intended to guide Vice President, Innovation
directors through those times of “beyond Gregory Shields
normal operations.” We encourage you to Director, Assurance Services Development
keep it close by and reach for it when you Gigi Dawe
think there’s a crisis in your organization. Principal, Risk Management and Governance
Vivienne Livick-Chan
The Board acknowledges and thanks the Principal, Risk Management and Governance
members of the Directors Advisory Group
for their invaluable advice, Hugh Lindsay,
who wrote this briefing under their
guidance, and the CICA staff who provided
support to the project.

1
 The response by Johnson & Johnson to the Tylenol
tampering crisis enhanced the reputation of the company.
2 Crisis
The events of September 11, 2001 were a
devastating reminder of the need to be prepared
for crises.
Crises are rarely as massive and appalling as the
attacks of September 11, but the possibility of crisis
calls for constant vigilance and readiness. Being
prepared for a crisis involves more than the capacity
to manage the crisis itself; it means having the
resources and resilience to continue operations. The
organizations that survived the immediate impacts
of September 11 were best able to recover if they:
• took prompt, decisive action to deal with the
immediate crisis and resume operations;
communicated promptly and frankly with
employees, customers, suppliers, other important
stakeholders and the news media; and
demonstrated practical compassion for the
injured, frightened and bereaved;
• were prepared – not for such an unimaginable
event but for the more mundane and predictable
problems of business continuity: alternative
computer and communication systems, off-site
backup of vital records, contact information
and more;
• had the financial and other resources to absorb
the effects of the crisis and return to normal –
strong balance sheets, positive cash flow and
good cost control.
Avoiding and being prepared for crises are key
elements of good governance. Well-run
organizations are less likely to have crises and
are better at solving them.
crisis
Be prepared and ask tough questions.
In times of crisis, your job as a board member is to
make sure the CEO responds promptly, decisively and
effectively. This often means staying calm and letting
the CEO and management team handle the crisis.
But letting the CEO manage doesn’t mean that you
ignore the crisis. You must find out what’s going on
and satisfy yourself that things are under control. If
they aren’t, it is your duty to make sure that the
crisis is properly addressed.
You start by asking questions.
Asking questions is a key part of a director’s job.
When your organization is faced with a crisis, be
prepared to ask a lot of tough questions and to
discuss the answers with your fellow directors. The
board may seek advice from its own members and
senior employees or bring in trusted advisers who
know the organization and are available at short
notice. You can start by asking the following
questions:
• What kind of crisis do we have?
• Is the CEO responding promptly and decisively?
• Are we communicating frankly and truthfully?
• Do we have the internal competencies to manage
the crisis, or do we need outside expertise?
• How can the board help?
A crisis need not be a disaster. Organizations that
respond well and are prepared often bounce back
and gain from the experience.
The response by Johnson & Johnson to the
2
Tylenol tampering crisis enhanced the reputation
of the company.

Risk measuring/probability
SEVERITY
High Severity,
Low Frequency.
A Catastrophe.
Activate BCP in full.
Medium Risk,
May still cause a crisis
if not dealt with quickly.
Low Severity, High
Frequency. Unlikely to
cause disruption to key
business tasks/reputation.
FREQUENCY
Source: Department of Trade and Industry, Business
Continuity Management: Preventing Chaos in Crisis.
BCP = Business Continuity Plan
3
Three types of crisis
Businesses survive by providing good
service to customers. This includes
minimizing the number of operational
crises and properly handling those that
are unavoidable.
The spread of big-box stores like Wal-
Mart and Home Depot represents a
potential crisis to retailers in small
communities. The local merchants should
anticipate the arrival of the big stores by
focusing on value to customers and
establishing a competitive edge through
personal service or otherwise.
The arrival of a big-box store in a small
community can be a sudden crisis for local
retailers who are unprepared.
Understanding Crisis
Types of crisis
Crises have many sources, some of which are
common to all organizations. Others are specific to
certain industries. For directors, it may be helpful to
consider them as fitting into one of three groups,
based on their severity, frequency and timing:
Operational crises are the day-to-day, minor crises
of running the organization and serving individual
customers. With good management these can be
avoided or promptly resolved.
Sudden crises are events that occur unexpectedly
and have a major effect on the organization. These
include natural disasters, sabotage and outages of
vital services such as power, water or computers.
The CEO should have plans for managing crises
and business continuity and test the plans through
realistic scenario-based simulations.
Potential crises are serious problems that grow
larger over time and become critical if they are not
addressed. They include declining sales, profits and
share prices, failure to respond to new competition,
investigations by regulators, and financial
difficulties. These problems effect the long-term
viability of the entire organization and should be
addressed by the CEO through the strategic
planning and risk management processes.
These groupings of crises are linked. For example:
• Operational crises may be symptoms of
potential crises.
crisis
• Operational crises can build or blow up into
sudden crises.
• Potential crises may weaken an organization to
the point that it cannot cope with a sudden crisis.
understanding
This briefing focuses on what directors can do when
their organization faces sudden and potential crises.
Directors are not normally involved in operational
crises unless they are symptoms of problems in
executive performance or strategic planning.
Recognizing crises – Do you have a crisis on your
hands?
Recognizing that there is a crisis is often the most
difficult aspect of crisis management. One approach
is to apply a “litmus test”. The following questions
are from Crisis Management: Planning for the
Inevitable by Steven Fink.
1. Is there a good chance that this situation will, if
left unattended, escalate in intensity?
2. Might the situation foster unwanted attention by
outsiders, such as the news media or some
regulatory agency?
3. Is it likely that the situation might interfere with
normal business operations in some manner?
4. Could it make you look bad or cause people (the
public at large, or investors) to lose confidence?
5. How is it going to affect your bottom line?
This test can apply to any kind of crisis.
3
 Examples of different types of crisis
4

crisis
TECHNICAL/ECONOMIC
Sudden Crisis
IT/Systems Industrial accidents. Sudden crises call for prompt, decisive action, What should you do?
breakdown. Government crisis. effective communication and teamwork between the As a board member, you will probably hear about
Contamination. Utilities failure.
Industrial Natural disasters. CEO and board. As a board member, you need to sudden crises quickly – either from the CEO or
know what to look for and make sure that what through the news media.

accident. Supplier failure.
INTERNAL EXTERNAL needs to happen, happens.
On-site product Sabotage.
tampering. Terrorism.
Malicious acts. Labour strikes. What should you look for?
Organizational Off-site product It’s the job of a CEO to be prepared for sudden crises
failure. tampering.
and to manage them. A good CEO and management
PEOPLE/SOCIAL team will:
Source: Department of Trade and Industry, Business Continuity
• find out what’s going on and identify what the
Management: Preventing Chaos in Crisis. organization knows and doesn’t know;
• implement the crisis plan;
• appoint a core team to manage the crisis and free
team members from their regular responsibilities;
• make sure that day-to-day operations continue as
far as possible (Business Continuity);
• designate a single individual to handle crisis-related
communications and communicate frankly to
stakeholders and the news media;
• demonstrate commitment to communities directly
affected by the crisis by sending in the appropriate
corporate representative. This may be the CEO, but
We are not able to recognize these decisive moments not necessarily;
and we often do not have the time or information we • communicate directly to the company’s
need to make sound choices. We must often make
stakeholders including employees, customers,
decisions in the heat of battle. It is helpful to think
about crises as a continuum, a process or an unfolding suppliers, shareholders and regulators;
pattern of decisive moments. These moments are • appoint a devil’s advocate to provide a reality check
always connected, but we find it difficult to fully on the organization’s response to the crisis – this
appreciate many of these connections. could include outside experts such as public
relations consultants and lawyers; and
Learning About Risk • give the board regular briefings.
sudden
Your job is to:
• stay calm,
• get the facts,
• assess the situation,
• take appropriate action, and monitor the situation.
Crises often call for the nonexecutive directors to
devote more time to the organization’s activities. This
particularly affects nonexecutive chairs or designated
lead directors who may find they have to devote most
of their time to the organization during the crisis.
Staying calm
Crises are disruptive and threatening events that put
a heavy strain on our ability to stay calm and think
clearly. Most of us want to do something – anything –
to help. As a director, you can help your CEO when
you avoid:
• making the crisis worse by jumping to conclusions
and overreacting;
• interfering with the CEO and crisis management
team. The CEO has enough to do without having to
spend a lot of time with the board;
• talking to the media or anyone else about the crisis
– unless you have been designated and briefed to
do so; and
• letting the board polarize into a disunited group.
Getting the facts
Make sure the board gets the information it needs to

4
 4 Sudden Crisis
Signs that your board and CEO are handling a crisis well:
• You get all the information you wish
• You fully understand the information and explanations you are given
• You get explanations that correspond with your own knowledge and common sense
• You are encouraged to ask questions, and to raise and pursue issues
• You are encouraged to offer informed advice and opinions
• You support the crisis plan and are seeing positive action and results
assess the situation and management’s response.
The board briefing should answer these questions:
• Do we have a crisis?
• What is the nature of the crisis?
• How does the CEO plan to handle it?
• How can the board help?
Assessing the situation
After the briefing, the board should consider meeting
without the CEO and management present to discuss:
• whether the CEO appears to be managing the crisis
effectively;
• what action, if any, the board should take;
• if the board should appoint its own independent advisers to
make sure that the right questions are asked.
If the crisis is severe, the board should appoint the best
qualified and available director to coordinate the board’s
crisis-related activities and consider establishing a crisis
committee of the board.
Taking action
After assessing the CEO’s response to the crisis, the
directors can select the appropriate level of board
involvement. This might include one or more of the
following options:
• Let the CEO handle the crisis, reporting to the board
only if the situation gets worse.
• Let the CEO handle the crisis and provide regular
reports on progress.
• Designate one or more specific directors who have the
relevant experience and expertise to coach and work
with the CEO on managing the crisis.
• Bring in an outside expert to coach and work with the
CEO on managing the crisis.
• Appoint someone other than the CEO to manage
the crisis.
• Bring in trusted outside advisers who know the
organization to counsel and help the board.
Monitoring the situation
Once the board and CEO have agreed on how the crisis
will be managed, they can establish a process and schedule
for reporting and monitoring. Depending on the
circumstances, this could involve the CEO providing the
board with:
• reports at regularly scheduled board meetings;
• reports on an as-needed basis;
• frequent information-only briefings by voice mail,
e-mail, fax, etc;
• frequent briefings by conference phone call that allow
for questions and comments; and
• briefings at board or crisis committee meetings that are
specially called.
As a director, your job is to assess the effectiveness of the
CEO’s response. External sources of information such as
media stories and comments from people you meet reflect
the public perception. They can provide valuable
feedback, and help shape and steer the organization’s
response.
The board or its crisis committee should be prepared to
meet without the CEO after briefings to discuss progress
and assess the effectiveness of the management of the
crisis.
The board should constantly assess the effectiveness of the
monitoring process and be prepared to modify it as
necessary.
The biggest risk for the board is denial.
Directors Advisory
Group comment.
5 Potential Crisis
Although sudden crises make the headlines, they only
represent 23% percent of all crises, according to the
Institute of Crisis Management. The rest typically
occur when a neglected problem flares up. The neglect
of potential crises has become an increasingly severe
problem as the world moves faster, time lines shorten,
expectations heighten and things become more
complex and interdependent. Boards need to be alert
to warning signs and ready to insist on prompt action
if the CEO fails to react. If you practice good
governance, you are less likely to have a crisis and
more likely to survive and profit from it.
What should you look for?
It’s the job of CEOs to recognize the many problems
that threaten the organization and to develop strategies
and plans to monitor, manage and mitigate them.
These problems are not crises unless they blow up as
sudden crises or remain as unidentified or
unrecognized potential crises.
Potential crises can be hard to recognize and harder to
handle because they lack the adrenaline-pumping
urgency of a sudden crisis. Although it’s clear after the
fact that the warning signs were there, managers and
boards can easily slip into denial. “It’s just a one-off
Organizations such as airlines had declining revenues and profitability prior to the events of September 11, 2001. situation,” “Next quarter will be better,” “Our new
This represented a potential crisis in that their resilience was limited. product will destroy the competition.” CEOs are
generally optimists. The board should be prepared to
The loss of business, following the attacks on the United States, turned the potential crisis of a weak financial question the basis for the optimism.
position into a sudden crisis of imminent corporate failure for air carriers around the world.
Experienced directors use their knowledge and
Drugstores must always be alert to the risk of errors that could harm customers. experience of the organization and the world around it
to assess the quality of the strategic plans they are
In addition to procedures to ensure the proper filling of prescriptions,
they have contingency plans in case the system fails.
crisis
asked to review and approve. They pay close
attention to the information and assumptions on
which the plans are based, and look out for
warning signs.
potential
Are you recognizing the warning signs?
For boards of directors, potential crises occur when
CEOs and boards fail to recognize and develop plans
to deal with situations and problems that threaten the
organization’s viability. The following conditions are
common ones in which potential crises may evolve:
• ineffective board of directors or board committees;
• board material incomplete or not timely;
• defensive CEO;
• lack of formal ethical values and code of conduct or
their implementation;
• excessive staff turnover – particularly in key
management positions;
• aggressive management attitude in financial reporting;
• management places undue emphasis on meeting
financial targets;
• overemphasis of quantified targets that are linked to
management compensation;
• deteriorating business reputation;
• no management strategy to respond to rapidly
changing conditions in the economy and industry;
• constant crisis conditions in operating areas such as
frequent/excessive back orders, shortages, delays and
understaffed departments;
• inadequate or inconsistent profitability relative to the
industry;
5
 5 Potential Crisis
• cash flow problems;
• high debt-to-equity ratio, especially as a result of a
recent acquisition;
• insisting on an early meeting of outside directors to
discuss a potential crisis; and
• insisting on the inclusion of outside experts at
• uncompetitive cost structure. board meetings in times of crisis.

Your best warning of a crisis may be your experience- Valuable sources of information and confirmation
based intuition – the little voice that wakes you up in include audit committee meetings with external and
the middle of the night to warn you that something is internal auditors and human resources
wrong. Intuition alone isn’t enough to cry “crisis,” but or compensation committee meetings with
it’s valuable if it gets your attention and prompts you HR executives.
to ask questions.
If the board and CEO have a good trusting
What should you do? relationship, they can work together to identify
You can help the organization recognize and address potential crises. If not, the board should take a close
potential crises by: look at its relationship with the CEO.
• insisting on periodic evaluations of board and CEO
performance and on action if they are ineffective;
• speaking up at board meetings when your
knowledge and experience lead you to question the
information and assumptions on which strategic
plans and decisions are based;
• insisting that the information on which the board
will make decisions is timely and based on
comprehensive analysis;
• insisting on receiving continuous early warning
briefings from management;
• insisting on periodic board briefings to confirm
that the organization has a generic approach to
handling any crisis, and scenario-based plans for
the most likely crises;
• paying close attention to briefings and information
from management, then testing what you learned
Consider appointing a subcommittee of the board to study crises after the fact and come up with a white paper. against your own personal observations,
Use it as a discussion document for making changes in processes and systems for the future. experience, general knowledge and intuition;
 6
The safety of hydroelectric dams is
critical. BC Hydro’s Director of Dam
Safety reports annually in person to
the board on the status of dams and
emergency preparedness.
You should be concerned if your CEO:
• has no crisis plan
• fails to inform the board about crises
• doesn’t consult or take advice from the board
• fails to respond quickly and effectively to crises
• fails to learn from crises
Is your CEO part of the problem?
As a director, you may be faced with the question “Is this
CEO the right person for the job?” Good governance
requires a strong, experienced CEO in whom the board
has confidence. If the directors have reservations about
the CEO’s performance and ability to avoid or handle
crises, the board should act decisively to resolve the
problem, preferably before a crisis hits. Before
acting, it’s useful to consider the overall board/CEO
relationship, which may involve one of the following:
• the board has confidence in an experienced CEO;
• the board has confidence in a less experienced CEO
who seeks and accepts advice, guidance and training;
• the board has little or no confidence in a CEO, and
does not expect a change for the better;
• the board has confidence in a CEO who is temporarily
in a conflict of interest – as when a potential solution
to a company’s problems is a management buyout.
Does your CEO need help?
CEOs have a tough job and are expected to cope with an
amazing range of challenges. Even very competent and
experienced CEOs can face situations they’ve never met
before. The best CEOs are not afraid to ask the board for
advice and guidance. Others may need the help but are
reluctant to ask for it. The board should monitor the
CEO’s handling of the crisis and offer help if necessary.
problem?
Is it appropriate to replace the CEO?
Sometimes replacing the CEO is the only solution – but
only sometimes. It is generally necessary if the CEO is
involved in fraud. However, if the problem is one of poor
performance in handling a crisis, it’s usually much better
if you can keep the CEO. A crisis is a bad time to make a
the
change. If coaching and helping the CEO through a crisis
isn’t enough, you could:
• send the CEO on a leave of absence;
• accelerate the CEO succession plan; or
of
• use another executive or a director to lead the crisis
management team.
part
Try to defer assessing the competency of the CEO until
the worst of the crisis is over. You don’t need the extra
stress of firing and hiring, on top of everything else. If
CEO
you need to replace the CEO in a crisis, go for the
strongest and best-qualified person possible. Give full
consideration to strong inside candidates who know the
business and its people and can get up to speed quickly,
your
but appoint an insider only if that is the best choice.
When the CEO is temporarily in a conflict of interest, the
board must intervene and ask the CEO to step aside
is
regarding the area where the conflict is operative, then appoint
another person to act until the conflict has been resolved.
6
7

crisis?
What did you learn from this crisis?
Reflecting and learning
Now that the crisis is under control, it’s tempting to put it
behind you and return to normal. But this wastes an
opportunity to learn and profit. A well-written crisis plan will

this
include the requirement to review and reflect on how the crisis
was managed. The board should ask the CEO for the results of
the review and conduct a review of its own response to the
crisis, including the work of any board crisis committees.

from
Points to consider are:
• Did we stay calm and united, get the facts and assess
the situation?
• Was our involvement timely and appropriate?

lear n
• Did we stay on top of the situation?
• Were we helpful to the CEO?
• Did the crisis reveal any weaknesses in our strategic planning
and risk management processes?
• How might we apply what we have learned to improve the

you
way the board functions and relates to the CEO?

The review will be most valuable if it leads to an action plan

that the board implements and follows up on. It is even more

did
valuable if it is part of an ongoing board discussion of risk and
crisis. This could include making time at board meetings to
talk about other organizations’ crises and ask the CEO how the

what
organization would have handled them.

You can find more information on the board’s role in Risk

Management in CICA’s publication – Guidance for Directors:
Dealing with Risk in the Boardroom.

7
Where can you find more information?
Canadian Institute of Chartered Accountants publications,
——, Guidance on Control, 1995.
——, Guidance for Directors: Governance Processes for Control,
1995.
——, Learning about Risk: Choices, Connections and
Competencies, 1998.
——, Guidance for Directors: Dealing with Risk in the Boardroom,
April 2000.
——, Managing Risk in the New Economy, 2000.

Department of Trade and Industry (United Kingdom).

Business Continuity Management – Preventing Chaos in Crisis

Emergency Preparedness Canada.

Business Resumption Planning: A Guide
Ottawa: Minister of Supply and Services Canada, 1995.

Fink, Steven.
Crisis Management: Planning for the Inevitable
New York: American Management Association, 1986.

Harvard Business Review on Crisis Management

Boston: Harvard Business School Press, 2000.

Harvard Business Review on Corporate Governance

Boston: Harvard Business School Press, 2000.

Toronto Stock Exchange, Joint Committee on Corporate

Governance. Interim Report:
Beyond Compliance: Building a Governance Culture
Toronto, Spring 2001.