2 Triage – what do I do first?

2.1 Internal reporting

The first and most immediate step in responding to an incident is notifying the right people internally.

This will usually include legal, compliance and communications staff to manage any external inquiries. Serious allegations may need to be escalated immediately to senior management and the Board.

2.2 Crisis management and response planning

Given the range of issues (including those outlined below) that a company must address to respond effectively to an incident, urgent engagement in crisis management and response planning is critical after an incident is first identified. Key stakeholders from within the company – who are likely to include legal and communications representatives, as well as representatives of the business unit in which the incident occurred (if appropriate) – should be brought together.

This working group should identify, scope and prioritise key issues and actions to formulate a plan. It should:

  • assess whether external assistance – eg legal counsel or communications consultants – should be engaged to assist and provide advice in responding to the incident;
  • allocate clear responsibilities for the response to the incident;
  • set clear protocols and expectations for investigating the incident, including the issues outlined below; and
  • establish a communications protocol for communications with all stakeholders, including media, employees and commercial partners.

2.3 Identifying all stakeholders

Companies have many stakeholders, including shareholders, employees, business partners, customers, financiers, insurers and regulators. A company may have legal or contractual disclosure obligations to its stakeholders in relation to an incident involving possible contraventions of the company's legal or compliance obligations. Moreover, such incidents may have legal, reputational and other impacts for stakeholders, as well as for the company.

For example:

  • Shareholders may see the value of their investment eroded
  • Employees involved in an incident may face criminal or civil liability
  • Business partners and customers may be less inclined to transact with a company if they sense a misalignment between their values and those of the company
  • Financiers and insurers may face legal or contractual liabilities arising from an incident

Consequently, a key component of a company's crisis management and response planning will involve identifying key stakeholders and assessing the legal and practical impacts of an incident on its stakeholder relationships.