On this Ropes & Gray podcast, Nitish Upadhyaya, director of behavioral insights at R&G Insights Lab, is joined by partners from Ropes & Gray’s global crisis management & investigations practice—Jim Dowden, Laura Hoey, Josh Levy, Amanda Raad, Ryan Rohlfsen, Robert Silvers and Sarah Walters—to unpack the realities of handling complex, high-stakes crises in an era of global uncertainty. Drawing on decades of experience, the team explores why successful crisis management demands more than just legal maneuvering—it requires practical strategies, an understanding of human behavior, and a strong organizational culture. Listeners will gain actionable insights into every stage of a crisis: planning ahead, responding under pressure, managing business continuity, and emerging stronger on the other side. The conversation covers critical topics such as the importance of having a robust crisis plan, the role of organizational culture and communication, the pitfalls to avoid, and how to turn challenging moments into opportunities for long-term resilience.
Transcript:
At a glance: Click the links below to advance directly to the corresponding sections of the transcript:
Nitish Upadhyaya: Hello, and welcome to this Ropes & Gray podcast. I’m Nitish Upadhyaya, director of behavioral insights at R&G Insights Lab. I help clients manage risk through the lens of human behaviour and culture. I’m joined today by experienced partners from Ropes & Gray’s global crisis management & investigations practice—with global uncertainty and rapidly changing environments, we’re handling more and more complex issues and high-stakes crises for clients. Real-life crises are complex, and they require more than just legal manoeuvring—practical, human considerations are critical. The challenge lies in managing the human experience during a crisis. Between them, this group of partners have decades of experience helping clients plan for, manage, and come out of crisis situations. Now, we know there are so many factors that influence outcomes in a crisis, from those that we do think about all the time (such as getting the right advice) to the things that we don’t necessarily acknowledge (culture, for example), and being flexible to adapt to the inevitable unintended consequences that arise from any action that you do take in a crisis. On this podcast, you’ll hear tips of what to do—but also, what not to do—hard won lessons covering planning for a crisis, what to do when a crisis hits, managing the business while you are in the throes of a crisis and then emerging from a crisis. These are stories and circumstances that have played out—and if a crisis hits for you, hopefully you can take advantage of these best practices. So, let’s dive in.
[1:35] Planning for a Crisis
Your heart rate is up, there’s information coming at you from all directions and what seems like a million people vying for your attention. You’re certainly not used to being on the back foot—reacting rather than driving strategy and planning. Let’s take a pause there, and rewind just a touch—this is a luxury you get because we’re going to be talking about planning for a crisis. Crisis management starts well before a crisis itself actually comes to light. It’s not chaotic if you have a plan and a framework and are able to follow some initial steps to help you really read the situation. It’s about practicing responses to crises before they occur. And, for me, as a behavioral scientist, this is when the many quirks of human behavior really come to light, in those what seem like chaotic situations where things are flying around. Let’s hear from Ryan Rohlfsen, Amanda Raad and Laura Hoey about what they think you should do in planning for a crisis.
Ryan Rohlfsen: If you’re planning for the crisis in the moment, you may have already missed the ship—you may have already missed the opportunity on it. I think there’s an old phrase, I think it was Ben Franklin, “Fail to plan and you plan to fail.” So, in other words, I think a lot of companies that routinely have varying degrees of crises are also thinking about risk mitigation and doing things like tabletop exercises, really engaging not just in an empty echo chamber of people that are repeating the same thing, but really hearing from various constituencies, colleagues, and different groups—external counsel, obviously, internal stakeholders—and trying to talk through and imagine various scenarios and how to respond to them. You’re never going to be able to perfectly prepare or anticipate scenarios, but you can often have a number of shortcuts that get developed as part of those conversations that will make your ability to respond to a crisis situation in certain topic areas faster and more effective, should they ever arise.
Amanda Raad: The key really is to make sure that you have a plan and that you’re able to rely on that plan because instincts alone can often lead to poor decision-making. The plan has to be more than just a very simple policy or procedure that gathers dust on a bookshelf somewhere, because nobody is going to remember to look for that in a crisis. What you really want to do is be able to make sure that you have people sufficiently familiar with the kinds of issues that can come up and then what to do when they come up, whether that be pause, first of all, and don’t panic, or who you should call and what are the right first steps, because those first steps are so incredibly important. I know people are so over bombarded with training on every kind of risk area and every kind of topic, but we don’t really see enough training on what to do when a crisis hits—like, what are those first steps? And so, the key here really is to have a plan. Make sure people are aware of the plan. Make sure people feel comfortable with the plan and that they know it isn’t something you have to panic about. Everyone is going to face some kind of crisis at some point in their careers, and really you can fall back on the plan.
Laura Hoey: Organizational culture plays a vital role in both crisis prevention and, eventually, in the response. For example, in the highly regulated environments like health care, ignoring whistleblower concerns can be costly. Think carefully about what channels you have to surface issues before they get to the crisis level. Also, think about the wider context—current whistleblower incentives may reduce employee loyalty and increase the risk of significant settlements, making it crucial for compliance programs to thoughtfully consider what behaviors they incentivize.
Nitish Upadhyaya: We heard there a lot about reacting, sure, to the context, but having a framework to make sure that you’re asking the right questions, thinking about the right things, and doing it from a perspective where you’re not hot and in the moment, but from a cold, logical perspective. People also often want a recipe—something that feels comfortable—but unfortunately, there’s no golden bullet here. Context matters, and there’s often no precedent that the frameworks that are adaptable will win the day.
[6:05] What Happens When a Crisis Hits
Now, feeling a little bit more prepared? Great. Now, let’s get back to the inevitable human reaction in moments of stress. Go back to that scenario—your heart rate is up, and these quirks of human behavior really take over: the action impulse, the desire to do something right now, to meet things head on. And then, so many biases and rules of thumb that govern how we act on a day-to-day basis: confirmation bias, availability bias—things that you may well have heard of, which mean that our brains are trying to take an easy way out in a decision-making situation. With all of this stuff going on, just in and of yourself, let alone your fellow senior management, it can be really, really tough to feel in control when a crisis hits. Let’s hear the tips from Sarah Walters and Jim Dowden on what to do immediately when a crisis hits.
Sarah Walters: Try and take a breath and make a plan. This doesn’t mean that you have to take a long pause before addressing the crisis, especially if it’s a fast-paced and emerging one, but do take the time to think before you act. This will allow you to think about what, if anything, should be handled under privilege; determine what, if any, communication plan needs to be in place; and to identify both external and internal stakeholders that need to be updated and debriefed; and then also think through how best to address the underlying substantive issue that gives rise to the crisis. The immediate response to a crisis is critically important and can have a lasting impact, so taking a moment to make sure there’s a thoughtful plan in place is really critical.
Jim Dowden: I think it’s really important for leaders in a crisis to go back to basics and fundamentals. It is really easy to get caught up in a crisis minute to minute, but what I always advise folks is go back to your mission. Why does your organization exist, and what is your mission statement? And use that as your guiding star on how you’ll respond. That includes both your external and internal communications and the steps that you take. I think if you focus on your mission, it helps you understand, “What are the critical audiences that you need to address to make sure that you resolve the crisis situation?”
Nitish Upadhyaya: And so, now you’ve had a chance to breathe, and you’ve reminded yourself of who the organization is and why you do what you do, and how to bring that authentically in your response to this crisis. Let’s hear from Josh Levy and Laura Hoey about who you surround yourself with when the crisis really gets going.
Josh Levy: I think it’s really important in a crisis to quickly establish who your core team is that’s going to work on that crisis and set up a daily or sometimes twice-a-day cadence depending on the severity of the crisis, where you’re all getting on the phone, all the key participants, and you’re all sharing updates in real time, so you’re not losing pieces of information, balls being dropped, because the left hand doesn’t know what the right hand is doing. So, I think it’s really important to establish a firm cadence of communication. I like to do it before the workday begins and after the workday ends, so you’re avoiding conflicts. And then, you also need to communicate more broadly with your organization.
Laura Hoey: The most important element of managing a crisis is having a high-functioning command center, and the highest functioning command centers enjoy the protection and the confidentiality provided by the attorney-client privilege. The key purpose of the attorney-client privilege is to allow complete candor so that legal advice can be based on the most accurate and complete information available. To that end, whenever a crisis pops—and by its very nature, you’ll have little or no warning—one of the first calls should be to the general counsel’s office.
Nitish Upadhyaya: So, getting the right team around you is incredibly important, and that richness in diversity of perspective, especially people who might give you an opposing point of view to the strategy that you’re considering, can be vital. And you heard also about the importance of attorney-client privilege. Now, of course, trusting lawyers on a legal podcast to talk about how incredible and important their work is, but there’s a really serious point here: it can help protect you; it can help give you the space in which to have conversations; and ultimately, give you a really strong foundation on which to protect the company and the business as a whole. And now, here’s Rob Silvers wrapping it all up about how you take your values, your team that you’ve gathered, and turn it into action and messaging.
Robert Silvers: In the throes of crisis, the company should define the message early, shape the story on its own terms to the greatest extent possible, and then ensure everyone internally is staying on message and is receiving the latest messaging points. On the topic of messaging, it’s important to balance speed with accuracy. First takes on complex situations are often wrong. You need to make sure that what you’re saying is grounded in facts because changing your company’s story in front of the public when you’re already in a difficult position can be devastating. The pressure to speak soon, though, can be substantial—rumors fly really fast on social media and elsewhere. You want to find that Goldilocks middle bowl sweet spot of gathering facts quickly and having a fast external response and knowing when it’s time to issue that all-important first statement. That’s an art, not a science, to be able to do it well, but getting it wrong can cost the company its credibility.
Nitish Upadhyaya: Now, one of the ways we learn about how to manage things in the future is by learning about things that other people have done which haven’t worked. So, here are some things not to do, and by observing these screw-ups and hearing those stories, I hope these will also help you better plan for a crisis when it hits. Let’s start with a story from Sarah.
Sarah Walters: It’s really critically important to avoid providing internal and external stakeholders with information that turns out to be wrong. Now, there’s often an instinct to calm and reassure, and to do so immediately, but it’s best to keep those initial communications really high-level at the outset. Providing reassurances, for example, that there’s a process in place to address the situation, as opposed to providing erroneous factual information before all facts are known. Saying something that turns out to be wrong can both lead to more panic or concern, and even creates a risk of liability, often in situations where there may otherwise be none. Now, to be clear, especially when it comes to communications, there’s no one-size-fits-all approach. But by way of an example—and I’m pleased to say that I’ve not had this issue arise in one of my matters—I’ve often seen situations in executive misconduct cases where the company issues statements about standing by their executive team right at the outset. While such statements feel like they make sense at first while the facts are still being sorted out, if it turns out that the investigation identifies actual misconduct, you’ve now created a situation where potential victims feel unheard right off the bat, and don’t trust the process, making the investigation more complicated, and also leading to more communication challenges going forward. A statement making clear that there’s an investigation and that the company takes allegations seriously, but without any more color commentary, is not as satisfying at first to investors and others, but it will provide better protections in the long run.
Nitish Upadhyaya: And now, we have Rob touching on a very recent example.
Robert Silvers: There was recently, of course, the moment that went viral of a Coldplay concert and two executives from a company that were caught in a romantic moment together. The CEO of the company very quickly put out a statement that seemed to point the finger at Coldplay for highlighting them and for invading their privacy, which really struck a lot of people as ridiculous and not owning up to the moment. So, you always want to defend the brand, defend the company, and do so vigorously, but you also want to show that you are taking responsibility and doing the right things—and that’s an art not a science too.
Nitish Upadhyaya: And then, wrapping it up for this segment, Amanda talking about what happens when people do panic.
Amanda Raad: You receive that first complaint, first cyber incident or first crisis for that matter, the instinct may be to panic, and some of the early decision-making that we have seen is often wrong. I have seen examples where important evidence disappears because there weren’t steps taken to preserve it, or people just panicked and deleted things or didn’t turn on the activation for preservation switch soon enough. And all of that, again, is not intentional, but it can look really intentional in hindsight, especially if you have a policy or procedure that outlines exactly what you’re supposed to do, and you do something that’s counter to that.
Nitish Upadhyaya: Senior leaders’ job in a crisis is as a first responder—you’re creating the safe conditions. And lots of people forget, it’s not all on you, even though it seems like it. The team that you create, the pattern of behavior that you create, that setting about how communication flows—who is involved—will likely carry on throughout the crisis. Dave Snowden in his decision-making framework, Cynefin, talks about in these complex situations needing to probe, to sense and to respond. So, think about whether or not those are the levers and perspectives through which you’re thinking of your actions. In a complex environment, no single method is going to give you the full picture. Blend different types of data to spot patterns and recognize the context you’re in. Create those short feedback loops to inform timely action. Even if you’ve got really useful information, if it comes to you two weeks, four weeks down the line, it’s not going to be helpful. Ultimately, creating the right conditions will allow positive outcomes to emerge—this isn’t force of will, but actually careful management.
[16:20] In the Throes of a Crisis
So, now, the immediate crisis has rumbled into managing on a day-to-day basis. You’re in the throes of the crisis, and it’s time for you to, in one sense, make sure you don’t drop the ball, but also, ensure you’re managing the business properly. Let’s come back to Josh and to Laura for their tips on what to do during the course of a crisis.
Josh Levy: I think that leaders need to realize they’re the weather system of their organization, and if they are exuding turbulence, and frenetic activity, that permeates the organization very quickly, whether people see you or not, word spreads. Similarly, if you are upbeat, and projecting confidence, that you have the situation under control, that sends a subliminal message throughout the organization.
Laura Hoey: During the course of a crisis, factors such as panic, poor coordination, and the lack of transparency can escalate manageable situations into larger problems. After the initial response, it’s important to keep these in mind as the intense focus on the crisis turns to day-to-day management. The challenge is to minimize harm while keeping the organization’s core functions running.
[17:30] What to Do at the End
Nitish Upadhyaya: And then, probably after what seems like an age, the crisis itself, the real risk—the proximate risk, maybe—is coming to an end. What you do now, however, can really impact how the crisis is perceived, and where you go next for the next issue that arises. How do you create capability for the future and how do you create resilience in the organization in those lessons learned? Let’s see what Ryan has to say about that.
Ryan Rohlfsen: I think that once a crisis has passed, that might be the last time you ever have that particular scenario emerge, and it might be the start of many scenarios—many aftershocks may come along afterwards. So, that crisis might be the end of the issue and it also might be the start of a series of aftershocks or other smaller crises or even larger ones that come along with it. So, I think once the immediate crisis or fire drill, however you want to say it, has largely concluded, I think just like how you do some planning exercises ahead of time, I think you need to sit down and take stock of where you are. At least do a preliminary root cause analysis into what happened. What went well in the response? What went poorly? What caused the issue? What have we done to correct it? How are we going to correct it going forward? Should we think about other sort of scenarios that might come up, even if we think that we’re done with the issue or the particular crisis of the moment? Are there logical or predictable things that may be brought up that we can start planning for now that it’s fresh, now that we understand the matter? And then, beyond that, are there adjacent or other issues that might come out? Collateral consequences, if you will, that are not directly related to the crisis you just concluded but may actually be caused by either the crisis or your response to the crisis. And so, again, sitting back, taking stock, and not just viewing the matter as closed and moving on with your life, but trying to prepare more in advance.
Nitish Upadhyaya: Now, here’s a great story from Rob about how companies can come out of a crisis stronger.
Robert Silvers: Often, companies are not judged by whether they’ve had a crisis, but by how they responded to that crisis, and whether they were seen as standing up and doing the right thing for their customers, for their employees, for the general public. And if you can do that well, you can actually earn a lot of points. I’ll give an example from an area that’s close to my heart, cybersecurity. In 2020, the cybersecurity company Mandiant, a leading company, was hit by the Russians as part of the SolarWinds cyberattack. Now, ordinarily for a cybersecurity company to be the victim of a cyberattack is not going to be seen as a good thing, but Mandiant stood up. They disclosed what happened. They worked with all their customers and the government to share information and make sure others were protected and showed that they were doing all the right things, not just for themselves, but for those that they serve and the community that they’re a part of. At the end of the day, that company’s stature came out improved, in my judgment, from that incident. So, you always want to be trying to find your way out, and seizing the opportunity where it exists, and while the public and your partners are focused on you.
Nitish Upadhyaya: And finally, from Amanda, about processes and creating the right frameworks for the future.
Amanda Raad: All of these are examples to learn more about the business and to learn about how the controls are or are not working. And if the investigation is done the right way and in a thoughtful methodical way, it can really be an exercise that helps the business in the long run. It can be more than just observing potential harms from fines or penalties. It can actually be something that makes sure that the business is running as effectively as it can be and that you have the right people running the business, making the right decisions for you. Small tweaks sometimes can be made that actually protect you from a regulatory legal perspective, but also from a business perspective. And we see that time and time again in some of our reviews with the initial fear and reluctance. A lot of the people that start off most intimidated and most scared of these reviews, particularly on the business side, end up being some of the best advocates for conducting these reviews in the future because they see the benefit of how a well-run response to a crisis can really turn it into a positive long-term benefit for the business.
Nitish Upadhyaya: Max Boisot says that “Just because you can look back and connect the dots, it doesn’t mean that you can look forward with the same certainty.” When you’re learning these lessons from a crisis, remember that not every single crisis is going to be the same, not every single action is a checklist or a playbook, but thinking about the bigger picture, the questions that you are asking, the people that were involved—those are going to be some of the most important things. And then, of course, there might be frameworks and things across your organization that need to be remedied in preparation for anything else that comes. And so, there are so many different lessons coming out of this, from having different perspectives at the table, to being able to confront the harsh realities of the situation at hand. But there’s hope because there are so many stories about shaping circumstances that allow the business to emerge stronger, more resilient and ready for anything else that’s thrown at you.
If you’re interested in hearing more, we run another podcast called the Culture & Compliance Chronicles, where we get leaders from across the world in various fields to come and talk to us about how culture and compliance can help drive value for business. Of course, if you’ve got any questions about today’s topics or anything related, feel free to reach out to us. For more information about what we do more generally, visit our website at www.ropesgray.com. And if you enjoyed our discussion, please subscribe and listen on Apple Podcasts, Spotify or wherever you get your favorite podcasts. Thank you all for listening. Wishing you a lovely day that isn’t affected by a crisis, but if the worse should happen today or any day, I hope you’re a little better prepared to bring your organization through it and out the other side.
