At some point in your company's lifetime, you will encounter a problem that turns into a crisis. The extensive news coverage that such events garner often results in public scrutiny that can affect business, operations and financials and subject a company to political, governmental and legal consequences. Several recent crises at large corporations, including data security breaches, corruption investigations and product safety issues, have brought greater attention to risks and raised the potential for boards to be held legally responsible for failing to account for and address these risks. A developing crisis might not kill a major corporation, but the resulting legal liability and reputational damage may compromise the ability of many smaller biotech companies to survive. Indeed, it is not uncommon for companies in the biotech sector to lack the corporate staffing and capital resources to plan for or weather the storm that a crisis can bring. As a result, biotech companies are at a heightened risk of events that could spin out of control and be memorialized and disseminated through the Internet.

Credit: Ridge Carpenter

Many crisis situations reflect a failure of management and the board to be sufficiently prepared. Here we discuss how management and boards of biotech companies should plan for and deal with crises to mitigate adverse consequences.

Crisis events are ever expanding

What are the possible events that could cripple a company? Some are inherent in the business and are readily apparent (Table 1). But the potential damaging events, some uncontrollable, are legion and can become more difficult to address when partners and cultural differences are involved (Table 1).

Table 1 Potential crisis events facing biotechs today
Full size table

In addition to the exposure a crisis could bring to a business are the ever-present class-action lawyers waiting to pounce on a company or its board for allegedly failing to recognize and address potential risks associated with the firm's operations—particularly where warning signs may have been ignored or inadequately pursued. As a general proposition, the oversight responsibilities of the board oblige it to discharge its duties in good faith and accordance with the best interests of the company (while acting with due loyalty and care). The board's oversight role includes considering material risks facing the company. No biotech company, however large or small, is immune from legal scrutiny by plaintiff lawyers.

Crisis-management plans

Biotech companies that already have a crisis management plan should consider updating it, as events that were considered 'black swans' in the past may be commonplace today. There may also be new or altered risks associated with changes in the company's operations or advances in technology, creating potential vulnerabilities in networks or cloud services. If your company has not yet taken steps to create a crisis-management plan, consider doing so. As an event and its fallout can happen so quickly that the company has little time to prevent it from becoming a crisis, the degree to which it can be contained depends to a very large extent on how management and the board handle it. One of the benefits of a well-handled crisis is an enhanced ability of management to maintain its focus on running the business during its pendency.

There is a growing number of events that could affect a company operating today (Table 1). As regulatory processes and the global economy become more complex and companies rely increasingly on cloud storage for sensitive information, the quick dissemination of negative information in crisis situations has become more widespread, and there is more scrutiny of board members than ever. Indeed, even Institutional Shareholder Services, based in New York, has gotten into this realm by including risk oversight in its recommendation criteria to shareholders in voting on director elections. Given all this, companies—both big and small—need to devote time and resources to crisis management, at the senior management and board levels. Think of it as an insurance policy, wherein the premiums consist of management and board involvement.

Crisis-management planning

A clear objective of creating a crisis-management plan is to ensure that resources are used effectively to resolve a crisis as quickly as possible. Although there are some common elements to effective crisis-management planning, one size does not fit all. Each company should consider its various constituents when developing its plan: employees, customers, suppliers, regulators, shareholders and the communities in which it operates. In addition, a company should evaluate at the outset the extent to which the planning process and crisis-management team formation should be formalized and what role the board should play. Although the board of directors is not in a position to be engaged in the day-to-day management of a crisis situation, it should, through its oversight, at least assure itself that the company has procedures in place to appropriately manage a crisis.

In determining whether to adopt a formalized crisis-management process, a company should evaluate: (i) the events that have a high likelihood of creating a crisis for the company, given the nature and extent of its operations (for example, being dependent on a single clinical trial or financially dependent on a single collaboration both carry a great potential downside, should the trial fail or the collaboration be terminated); (ii) the extent to which, given its management team and available resources, the company will benefit from committing executive time to a formal crisis-management plan; (iii) whether to commit resources to crisis management, given the company's other priorities; and (iv) whether existing risk-mitigating procedures can be leveraged.

It is important to make sure that adopting a formal plan is worth the effort. An informal process may be adequate for a smaller, less complex company if the board determines that the senior management team is conversant with and can meet the challenges that a crisis might present. In each case, a board should be briefed periodically by management on the company's crisis-management plan so that the board becomes knowledgeable about the specific risks facing the business and operations, as well as the extent of the crisis-management process. In an actual crisis, to satisfy its oversight responsibilities, the board's level of involvement can be expected to increase.

The basic ingredients of a crisis-management plan are as follows: (i) a 'core' crisis-management team with defined roles and responsibilities; (ii) the identification, understanding and prioritization of potential crisis situations; (iii) an action plan or framework for addressing the most significant potential crises; (iv) an effective communications strategy; (v) periodic update of the plan.

Management might also consider whether it is possible to benchmark its plan against what are considered best practices in the biotech industry or other sectors and adapt the practice to the company's requirements. It can be a good place to start the process and avoid some typical mistakes. These best practices can be identified through crisis-management consulting firms, discussions with colleagues or in business literature.

Some training, including a simulated crisis, would be useful so that the core team can gain the experience of working together and identify deficiencies and make adjustments.

Form a 'core' crisis-management team. Effective crisis management requires the right team and coordination. A well-constructed crisis-management team will have representation from the key functional areas in the company. Although its composition will vary by company, the team should generally include the CEO, CFO, counsel and people in the areas of human resources, information technology, public relations and investor relations. In large corporations, the heads of principal business units, the chief risk officer, the chief compliance officer, the chief privacy officer, the chief security officer and the heads of other functional areas are often included. This team needs to establish realistic objectives and the path toward achieving them to avoid the confusion that often erupts when a crisis confronts a company. Establishing clarity on the decision-making process at the outset allows each member to understand who has decision-making authority and who is responsible for communicating with the affected constituencies. As part of the planning process, it will be useful for the team to create a crisis-management checklist that delineates immediate items to consider, the individuals responsible for them and contact information for each member of the team.

A core crisis-management team needs to be sensitive about engaging the right members for the tasks at hand. For example, efforts to identify events that could give rise to crisis situations and to assess their potential impacts are led by those most qualified to fulfill this role, but when a crisis is raging, engagement falls to members that interface with internal and external constituencies. It is important for all members of the team to understand their roles to enhance the effectiveness of planning for and handling a crisis.

Leadership of the crisis management-team is critical. The person selected must have leadership skills and the authority to marshal the appropriate internal and external resources. In addition, it must be someone whom others will follow. In a major crisis, the CEO needs to be in charge; for lesser matters, it can be someone who has the clear support of the CEO and the rest of the senior management team. In most situations, it is not advisable for a person outside the crisis-management team to take on the leadership role.

This leads us to the retention of external advisers, such as special counsel, crisis-management, public relations, investor relations or proxy solicitation firms, forensic accountants or investment bankers. Large companies with established crisis-management plans have identified and retained some advisers in advance and designated company personnel with the authority to involve them in the crisis.

In the United States, with its litigious environment, management and the board of directors should recognize that constructing a crisis-management plan may expose a company's weaknesses. Plaintiff's counsel might exploit these weaknesses in claims against the company and its board should the company's market value decline significantly after a crisis. Therefore, in constructing the plan, management and the board should consider the inclusion of counsel in internal and external communications for purposes of preserving the attorney-client privilege.

Identifying potential crisis situations. To use time effectively, management should identify the events that are most likely to occur and their potential impact on the company. A review of events that have had a major adverse impact on biotech companies of similar size may be useful. Further, an acceptable level of risk tolerance needs to be established by management and approved by the board so that resources are used efficiently to resolve a crisis and to fulfill the oversight responsibilities of the board. A few areas that have been of increasing concern to boards of biotech companies are discussed in Box 1 and Table 1.

One goal of crisis-management planning is to determine the potential downstream consequences of a crisis. This will inform who at the company should be involved in dealing with it and who is responsible for managing a particular crisis. In assessing the potential downstream consequences, it is important to distinguish short-term from long-term consequences. Several factors should be considered, such as: (i) potential reputational harm, (ii) the effects on the company's brand, (iii) whether the purchase of the company's products or services will be adversely affected, (iv) whether access to the capital markets will be impaired or the stock price negatively affected, (v) how relationships with employees will be affected, (vi) whether there will be a supply chain reaction, (vii) how the company's regulators will react and (viii) whether there will be an impact on the communities in which the company operates.

Another goal is to determine the likelihood that a particular risk will occur, thereby giving the crisis-management team some lead time to prepare. Warning indicators can be developed by mining the company's data to look for anomalies and abnormalities, analyzing past crises, and looking at issues faced by competitors. It is also helpful to analyze how other companies have addressed crises to determine whether there are any lessons that can be learned. Outside advisers should periodically review with management and the board current issues affecting the biotech industry and developments affecting other similarly situated companies.

Develop an action plan or framework for significant potential crises. After the company identifies the most likely crisis situations, it should develop an action plan specifically adapted to each. These plans may have common elements, but the response to a major cyber incident, for example, will differ from a response to an approach by an activist shareholder.

Communications strategy. In any crisis-management plan, development of a communications strategy is one of the most crucial components. The importance of communicating the company's messages effectively during a crisis cannot be overstated. The company should be aware that its messages will be received by several constituencies, all of which are relevant to a particular crisis-management plan. Potential constituencies include customers, suppliers, employees, strategic partners, securities regulators, stock exchanges, federal, state or local regulators of the company's business, significant shareholders, holders of indebtedness, proxy advisory firms, rating agencies and the company's external auditor. Notwithstanding this complexity, the guiding principle should be for a company to deliver its messages accurately, promptly and consistently. It is crucial for a company to 'speak with one voice' during a crisis. This should be achieved by designating a spokesperson, usually the CEO, who can then convey confidence and control, especially if the facts and plan of action are clear.

Although a company might prefer retaining an outside firm to deliver messages, this should be done only in extraordinary circumstances, as it can give the impression that the company is unprepared to deal with the situation. The company will need to determine the extent of its communications strategy depending on the nature of the event. For example, if the event relates to a failed clinical trial, then employees will need to be addressed in an internal communication, but investors, analysts and shareholders will be addressed with press releases and conference calls. Meetings with key stockholders may need to be held in person or over the telephone.

Periodic review of the crisis-management planning process. An indispensable element of a robust crisis-management plan is its periodic review. A company's situation evolves over time, and key personnel take on new responsibilities or change jobs, meaning the crisis-management team should be re-evaluated. If a company conducts a periodic risk-management review, it is desirable to reassess the crisis-management plans that have been prepared. Do the plans continue to address the key risks? Are the right people involved (have key personnel joined or left since plan was last reviewed)? If a comparable company has faced a major crisis, what lessons can be learned from how it was handled?

Finally, when your company has weathered a crisis, you should sit down with the board and senior management to assess the company's risk management and crisis-prevention and response systems. This will enable you to determine the areas in which they functioned properly and those in which they need improvement.

Conclusions

Biotech companies can be exposed to a seemingly endless list of events that may adversely impact businesses. However, crisis management can mitigate the consequences and liability that result when events spin out of control. By establishing even an informal crisis-management plan, your company will be better positioned to react promptly and effectively in the face of a crisis, thereby establishing that the board has fulfilled its oversight responsibilities. A review of your company's crisis-management plan should be part of the board's regular oversight process and be conducted periodically to ensure that it is appropriate for the company's ongoing business and operations.