From the courtroom to the game room: seven steps to crisis resilience for law firms

“Pay $40 million bitcoin within 48hrs or we’ll reveal all.” For law firms that hold the keys to sensitive client issues and privileged information, these words may sound like the worst nightmare come true.

But, wait. What if it’s just a game – a crisis simulation to enhance the firm’s capabilities in problem-solving under uncertainty, fear and time pressure? And what if much of the stress is taken out of the experience, with the team role-playing in a law firm retreat?  

Most law firms deal with crises every day. Lawsuits. Court battles. Deals not closing. Anything from fraud charges to privacy breaches. But what if this happens to them? For professional services organizations operating in crisis-ridden environments, a disaster is a matter of “when,” not “if” – and, for the most successful, risk management is a top priority.

Here are seven steps law firms can take to boost preparedness for these “predictable surprises.”

1. Build a capable crisis management team.

Preparedness starts with a well-oiled crisis team, small enough to move quickly without decision gridlocks. It may include the firm’s managing partner, a management committee member, Chief Risk Officer (or their equivalent) and the heads of marketing and communications, HR, IT, and finance. Representing all critical functions, your core team should be able to engage stakeholders across disciplines to avoid tunnel vision and bring diverse perspectives to the table, such as digital forensic experts and a litigation firm that can potentially handle sensitive information under privilege.

2. Define your crisis planning goals.

While a focus on liability may be a default position for lawyers, what happens in the court of public opinion – and in the eyes of clients – is as important as what happens in the court of law. Ahead of putting together any plans, the crisis management team should explore its values. What is it most concerned about? The well-being of the firm’s internal and external stakeholders? Its revenues? Potential litigation outcomes? Finding clarity on these questions will help the team align around the principles that will define its crisis response in any scenario, including media and client crises.

3. Assess the firm’s crisis risks.

Each firm has a unique risk profile that can be defined based on a comprehensive vulnerability audit. In professional services, common risk patterns include high-profile litigation, class-action lawsuits, cybersecurity and privacy breaches, insider wrongdoing, client service failure, an exodus of partners or clients, and discrimination. Once all potential stress points are on the table, the crisis management team can classify them based on their likelihood of materializing and the level of threat they would pose to the firm and its stakeholders.

4. Conduct a needs analysis.

Next, identify any training and support needed to bolster your crisis management team. For instance, do you require external support to fill a gap or expedite your crisis response? External counsel? PR support? Who will be your spokesperson and their back-up? Are they media- trained? If a law firm can’t respond to the media effectively during a crisis, the perception will be that it can’t handle the crisis itself. There are a lot of “war stories” to learn from. For example, the Rogers’ response to the July 8 outage showed that Canadians have little sympathy for companies that fail to communicate in a timely, empathic, helpful and constructive manner. The damage will be measured in financial losses that have yet to be tallied.

5. Develop a crisis plan. 

Now, time to develop a crisis management plan, which will be indispensable in guiding fast and effective decisions when there’s little time to prepare. A crisis plan typically includes:

• Brief introduction and guiding principles that inform all decisions.

• Roles, responsibilities, emergency contact information.

• Crisis level definitions and classifications.

• Scenarios and step-by-step response procedures, including escalation and notification.

• Samples of internal and external stakeholder communications, such as media holding statements, as well as messaging for executive and senior management teams, partners, associates, all-staff and client communications.

6. Work through your crisis communication strategy.

Lawyers are trained to focus on hard evidence. The facts. But, “when the news is bad, people don’t care how much you know until they know how much you care,” said Theodore Roosevelt. Stakeholders favour organizations that take responsibility, communicate early, and show empathy. In a crisis, the firm’s leadership and spokespeople should demonstrate a genuine concern for the well-being of their team and clients. Their job is to facilitate (not obstruct) the flow of information to build trust, even if this needs to be balanced with the requirements of an investigation or legal proceedings.

7. Get creative stress-testing your crisis plan.

There is a reason lawyers simulate the courtroom in mock trials testing their prosecution or defence strategies ahead of time. Crisis managers should take a page from their book pressure-testing their moves in scenario exercises that can be delivered in many formats, virtual or in person. How about a cybersecurity threat or breach simulation game played offsite as a team-building or retreat activity? “Red teams” can be assigned to poke holes in the firm’s crisis plans to see what can go off the rails in a cybersecurity breach. Or how about a virtual role-play – a group of firm lawyers acting as a high-profile client against a team of client lawyers? Each side then delivers their “pre-mortem” to prevent or mitigate future threats.  

Practice and preparation are essential. Ask anyone who has been on the front lines of a crisis to describe the intensity and level of stress they endured. Then ask them if a plan and a crisis simulation would have helped. You can probably guess the answer.