At the recent Association of Corporate Counsel annual meeting, one panel discussed the role of in-house counsel in their company's emergency preparedness and response planning
As corporate legal departments are being asked to manage a higher degrees of risk for their companies and a myriad of new challenges have emerged — from the pandemic to civil unrest and catastrophic climate events — more emphasis is being placed on the role in-house counsel plays in a company’s emergency response planning.
During the recent virtual annual meeting of the Association of Corporate Counsel, I was part of a panel, Are You Prepared to Handle an Emergency? that discussed how in-house counsel must ensure that their company is prepared to handle any emergency. Other panelists included Laura Stevens, Executive Vice President and General Counsel of Cengage Group; Michelle-Kim Cohen, Deputy General Counsel of Dassault Systèmes; and Sarah Gatti, Corporate Counsel at Drift.com.
Here are some of the questions discussed by the panel and panelists’ responses.
How broad should your emergency response plan be for addressing any type of emergency?
A one-size-fits-all-approach may not always be feasible for company-wide emergency response planning. When preparing or updating an emergency response plan, a company should account for reasonably foreseeable emergencies that may occur, rather than addressing every possible emergency regardless of actual likelihood. This assessment depends on various factors, including geography, the company’s industry, the company’s products and services, and the nature of the workforce and whether it includes remote employees.
Geography plays a significant role in the risk assessment process and may result in different types of risk depending on location. For example, one region may be prone to certain types of natural disasters (such as earthquakes) that are unlikely to occur in another region where the company operates. Using this example, the emergency response plan for a worksite in that region must account for the possibility of those natural disasters occurring, whereas a plan for a worksite in a different region may not.
A company should also survey its existing resources and determine whether a plan already exists for a particular emergency situation, even if the internal distribution or use of these resources was limited. Existing resources can help identify reasonably foreseeable emergencies and provide a starting point for developing more comprehensive emergency planning.
Even if a company tailors its emergency response planning, certain components may be universal regardless of the type of emergency. For example, a company may use the same communication systems for alerting its workforce of an emergency, even if the extent of notification varies by the type of emergency.
How accessible should your company’s emergency response plan be?
A company must account for whether an emergency could impede access to the emergency response plan itself. A company should have copies of the emergency response plan printed out in hard copy format and kept at the company’s offices or work sites. In addition to hard copies, a company should have the emergency response plan electronically accessible, such as a version securely stored on a shared drive. Obviously, the inability to access an emergency response plan should not create an emergency in itself. For example, if there is a foreseeable risk of an emergency rendering an office physically inaccessible (such as from civil unrest), the company should not have the emergency response plan only kept in hard copy format at that office.
A company must take the proper steps to ensure that the plan’s needs are accessible to stakeholders and the persons responsible for implementing the plan. The company should also consider whether and to what extent to share the emergency response plan with its outside counsel.
Should the emergency response plan be shared externally?
A company should carefully determine to whom it discloses its emergency response plan and, if required, how much of the plan to disclose. This issue periodically comes up when customers or vendors want to determine if a company has a plan before doing business with the company. Sometimes limited disclosure of a company’s emergency response plan may be unavoidable.
A company should hesitate to fully disclose its emergency response plan to third parties unless absolutely required. Instead, a company should consider other ways of satisfying the needs of third parties that want to confirm the existence and content of the company’s emergency response plan. For example, a company could inquire whether providing a copy of the plan’s table of contents satisfies a third party’s needs. Alternatively, a company could require a nondisclosure or confidentiality agreement before disclosing any part of its emergency response plan or limiting disclosure to answering a questionnaire about its emergency response plan.
What is in-house counsel’s role in emergency response planning?
In-house counsel plays a central role in a company’s emergency response planning. Aside from serving on the crisis management team, in-house counsel often acts as a project manager in emergency response planning. As a result, in-house counsel communicates with a company’s departments and external and internal stakeholders, such as the company’s IT and communications personnel. In-house counsel also ensures that training and assessments of the plan regularly occur. In-house counsel may need to determine if the plan is current and accurately reflects up-to-date operational practices, the company’s business, and legal requirements.
In addition, in-house counsel serves as a subject matter expert with issues related to a company’s emergency response. This includes asking “what if” questions when reviewing the plan, conducting a post-mortem response to any testing of the plan or actual emergency, determining who to notify about the company’s emergency response, and ensuring that any emergency response is legally compliant.
How should your company prepare for implementing its emergency response plan?
A key component of emergency planning involves testing and training employees on the components of the plan that are relevant to their respective roles. To test the plan, the company should perform tabletop exercises to simulate reasonably likely emergency scenarios to better ensure that key personnel know their role and can implement the plan. These exercises can also identify any necessary changes for updating the plan. For example, if key personnel are unreachable during a tabletop exercise, the company should consider updating its plan by replacing them with more accessible individuals.
The company should test its emergency response plan in real-time. This may involve testing the plan after-hours because a real-life emergency occurs at any time.
