Crisis? What is a crisis? Football is not in a crisis. We are not in a crisis, we are only in some difficulties and these difficulties will be solved – and they will be solved inside this family.

—Sepp Blatter, FIFA President, 1998–2015

These were the words of the former FIFA President at a press conference in May 2011, and they show that denial is a powerful thing. In the eyes of just about everyone else, FIFA was indeed in a crisis at that time. The organization was mired in investigations of bribery in connection with its presidential elections. Following the investigation, the president of the Asian Football Confederation, Mohammed bin Hammam – the only challenger to Blatter in the 2011 FIFA presidential race – was banned from football for life, raising questions about the integrity of FIFA's leadership as well as the bidding process for selecting host countries for the World Cup.

Four years later, in May 2015, authorities arrested several FIFA officials in a dawn raid at a five-star hotel in Zurich as part of a US-led investigation into alleged fraud, racketeering, and money laundering. The fallout was enormous; dozens of high-ranking football officials were indicted in the US for their involvement in illegal schemes (most ultimately pleaded guilty), while a number of separate criminal investigations were launched in other countries. Under mounting pressure from FIFA's corporate sponsors and facing a Swiss investigation into criminal mismanagement, the crisis finally caught up to Blatter himself – the four-term president was banned from football for eight years.

As the FIFA example shows, leaders can be seemingly blind to a crisis until it affects them personally – or, at least, until it strikes at the heart of an organization's centre of power and implicates senior executives in wrongdoing. Moreover, when they are finally forced to acknowledge the problem, they often assign blame to a few ‘bad apples’ – claiming these are outliers, unrepresentative of the organization's values and culture – in a futile attempt to contain the fallout. Almost invariably, this is the wrong approach, and only serves to make matters worse.¹

If your company finds itself in a corporate crisis, a better way of looking at the situation is to be open to the very real possibility (indeed, probability) that you have systemic and far-reaching issues that need to be addressed. More often than not, corporate crises result from a complex network of failures, including poor judgement by leaders, inadequate structures for compliance and oversight, weak culture, and ill-devised corporate strategies.

The instinctive reaction by leaders at the beginning of a crisis tends to be disbelief and denial. This is natural, but it is an instinct that should be resisted. This does not mean publicly admitting guilt right out of the gate; after all, there is important fact-finding that needs to be done. But it is best to operate under the assumption that the news may be true and that there may be worse news still to come. This allows a company's leaders to fully assess the situation, consider all possibilities, and put forward statements to the public that show openness, responsibility, and accountability.

NOW I AM IN CRISIS

In the years since the financial crisis of 2008, corporate crises have become both more common and more challenging to resolve. The scrutiny from regulators, news media, and the public is relentless and can last for years. Even when a scandal has finally receded, tomorrow's headlines can bring more damning allegations, reopening old wounds and calling into question the thoroughness and efficacy of past remedial efforts. Not an enviable place for a leader to be in.

Many crises begin when an allegation of misconduct is exposed to the public, whether by a whistle-blower, a media exposé, a raid on company offices, or an investigation announcement by law enforcement. The immediate damage can be considerable, but becomes far worse by the revelation that leaders within the organization knew about the misconduct and condoned and/or concealed it. The company's share price (or enterprise value) can fall dramatically due to the high degree of uncertainty and criminal risk that threatens the very survival of the organization in its current form.

Organizations that are well prepared to address allegations are far less likely to find themselves in crisis situations over which they have lost control. They have the tools to undertake an internal investigation, cooperate with law enforcement, and swiftly take any necessary action to move the organization from rocky waters to stable ground. These are companies that, knowingly or not, have already implemented Steps 5 through 7 of the Empowering Integrity process: the steps that inoculate you against future crises. Steps 1 through 4 get you out of the one you're in.

Over the past two decades, I've worked with many global companies that were not adequately prepared for a crisis. Some of these companies immediately got down to the work of changing business practices. Others stalled and denied, and took years before they realized they needed to get serious about addressing the underlying issues. The more seasoned and independent-minded directors move at the beginning of the crisis and recognize that there may be serious, fundamental, and far-reaching problems within the organization. Is it just a few bad apples in an otherwise healthy culture? Maybe. But unlikely. It is much more likely that there are bigger issues that need to be examined and corrected.

If it happens to your company, your priority at this stage is to conduct a thorough and credible investigation and get to the bottom of the situation. Rushing to judgement or taking half measures will prove unproductive in the long term. To do this investigation properly, you will need to recognize that your perspective is likely skewed and your sense of leadership is compromised; that you're walking through a cave without a flashlight, attuned to certain signals but blind to others.

You will need external, independent support to help manage the investigation. In Step 2, we will look more closely at how to go about this.

THE ILLUSION OF THE ‘PERFECT STORM’

In 2015, I presented at a conference of the Chartered Professional Accountants of Canada. The conference's keynote speaker was Andrew Fastow, the former CFO of Enron, the Texas-based energy company that collapsed in 2001 following one of the biggest corporate accounting scandals in history. Fastow's presentation was titled ‘Oversight Gone Wrong – Lessons Learned to Prevent the Slippery Slope of Wrongdoing’.

Because of his criminal record, Fastow was not allowed into Canada, so he had to deliver his talk via videoconference. Fastow came across as remorseful, acknowledging the damage he had caused to shareholders and employees of his former company.

During his remarks, he described the accounting practices that won him both a CFO of the Year award and Federal Bureau of Prisons ID card. Today, he speaks out to educate business leaders and shine a light on various accounting practices that are still allowed under Generally Accepted Accounting Principles (GAAP) but which are potentially misleading and prone to abuse.

The Enron scandal, as most readers will recall, was a fast and shocking corporate collapse. It started in March 2001 with an article in Fortune magazine by Bethany McLean titled ‘Is Enron Overpriced?’, which got investors and others looking more closely at the company. By the end of that year, the company had declared Chapter 11 bankruptcy. Within the space of 10 months, a celebrated corporation, renowned for its innovation and creativity, was in ruins; the scandal also brought down Arthur Andersen, one of the world's largest accounting firms. And this was at a time when social media – with its power to mobilize public outrage en masse – was virtually non-existent.

Fastow's former boss at Enron, CEO Jeffrey Skilling – who was given a 14-year prison sentence for his role in the scandal – famously described Enron's collapse as a ‘perfect storm’. The phrase initially entered the popular vernacular because of a book and film of the same name that told the story of how the commercial fishing vessel, the Andrea Gail, and her six-man crew were lost at sea in the North Atlantic in October 1991. The sailors had been caught in a ‘perfect storm’, a powerful nor'easter resulting from a rare and extraordinary convergence of three weather systems. Skilling's adoption of the phrase struck a chord with business leaders and it has since entered the corporate lexicon as shorthand for an unpredicted alignment of events and circumstances that leads to catastrophe.

As convenient as it may be for executives to say they were the victims of a ‘perfect storm’, it is a cop-out. It is an appropriate phrase for a weather event over which humans have no control, but for business leaders who find themselves in a crisis, it is little more than a convenient way of deflecting responsibility for misconduct (and for mishandling the allegation when it came to light). Using the phrase sends the wrong message. It fails to acknowledge the underlying human and structural issues that existed within the organization, and which led to the crisis. It pretends that there had been no early indicators of inappropriate behaviour within the company's walls. This is almost never the case in a major corporate crisis. The evidence is usually there. Companies emerging from a major crisis should resist the ‘perfect storm’ metaphor and the powerlessness that it implies.

HOW COMPLEX SYSTEMS FAIL

Rather than perpetuate the myth of a ‘perfect storm’, a much better model for thinking about corporate failures may be that of the ‘normal accident’, a term coined by sociologist Charles Perrow in his book, Normal Accidents: Living with High-Risk Technologies (Perrow 1984), which was inspired by the 1979 Three Mile Island nuclear accident.

According to Perrow, accidents in complex systems are unavoidable because minor and seemingly unrelated events accumulate and interact unpredictably to create major malfunctions that produce catastrophic results. Perrow notes there are three conditions that make a system susceptible to normal accidents:

1. The system is complex, meaning that it consists of numerous individual components that can interact in many different ways. Complex systems are susceptible to unfamiliar, unplanned, or unexpected sequences of events that may not be immediately visible or comprehensible.
2. The system is ‘tightly coupled’; that is, it depends on time-sensitive and rigidly ordered processes. Precision and timing are of extreme importance for a successful outcome.
3. The system has catastrophic potential when failure in one component can coincide with the failure of a different component elsewhere in the system. Such an unpredictable sequence of failures can cause the accumulation of failures in multiple components.

Technology, globalization, and regulation have evolved rapidly in the twenty-first century, creating an increasingly complex business environment in which companies depend every day on the successful interaction of a dizzying array of moving parts – corporate and outsourced functions, production facilities, security, supply and distribution chains, external business partners, financing structures, etc. Businesses and capital markets are closely intertwined. Meanwhile, the worldwide flow of information across the Internet has become nearly instantaneous, to the extent that a problem in one part of the system can become global news before headquarters even becomes aware of it.

Today's organizational systems are so complex that they would seem to defy effective central oversight. And yet, CEOs and Boards must do so and must not use that complexity as an excuse to ignore or accept it as just being so. Like a nuclear reactor, organizational systems are susceptible to unravelling as a failure in one component precipitates others throughout the system. As failures cascade, according to Perrow, the acceleration of errors exceeds the ability of human operators to remedy the situation, and disaster ensues. The catastrophic potential of a corporate crisis becomes instantly visible through major drops in stock prices and reputational damage that casts a long shadow over the organization for months or years.

When corporate leaders hide behind the ‘perfect storm’ mentality, they are refusing to address the challenge of coping with the reality of normal accidents within their organizations. In many corporate crises, the triggering event is a relatively small issue that had become known to management a number of years prior to a crisis erupting and was, at the time, incorrectly dismissed as immaterial or inadequately addressed. It may be ‘small’ but it touches the core: a superstar manager, a high-growth area, or a shady practice in a high-risk market. Ultimately, the issue festers and others crop up elsewhere in the organization, accumulating to cause a full system breakdown – the result of human and structural failures, and erroneous past judgements.

The issues that trigger the intervention of law enforcement and regulators rarely emerge without some prior warning to an organization's leadership. In many instances, we find that internal whistle-blowers had approached the company's management, internal auditors, compliance personnel, or legal staff with allegations of misconduct that were ignored, dismissed, or mishandled. These frustrated whistle-blowers then brought the issue to regulators, law enforcement, or the media, sparking an investigation. Sometimes, a regulator with a tip will give the company a chance to respond or to address it immediately and quietly. If they find resistance at this stage, they may be compelled to defer to their enforcement departments and ultimately to criminal authorities.

Enron was an extreme case, both in the scope of the problems, the wilful and complicit involvement of the CEO and CFO, the validation that they received from their Board, and in the speed of its self-destruction. Certainly, it is unusual for a magazine article to trigger such a devastating event. However, corporate leaders must always be thinking of such worst-case scenarios and how to avoid them through a robust and effective response to the normal accidents that inevitably will occur. The question is not if but when.

WHEN CRISIS STRIKES: WHAT NOT TO DO

At one European-headquartered company I was brought in to help, my client was dealing with a corruption investigation by US authorities – and dealing with it poorly. Many people within the company had become convinced that inquiries coming from the other side of the Atlantic were ‘fishing expeditions’, cynical attempts by Americans to steal intellectual property from European firms. They believed the Americans were jealous of the company's products and the real reason for the investigation was to steal trade secrets. It was misguided paranoia and it distracted them from asking the questions they should have been asking: whether their company had in fact done something wrong and, if so, how they could prevent the misconduct from happening again.

After much pressure, the company eventually agreed to undertake an investigation using their external corporate counsel. But even then, their defences were up. They took the position that a minimum of information would be shared with US regulators and that material would be fully redacted. What should have been a steady flow of information was a mere trickle. Eventually, the regulators justifiably escalated matters to criminal prosecutors, and the company was forced to accept the severity of the situation and cooperate fully.

The company had found itself in what felt to them like a ‘perfect storm’, but it was a crisis of their own making.

It is easy to judge the company's response in hindsight. It is important to remember that it is natural for a company to underestimate a threat initially and adopt a defensive posture when accused of wrongdoing. As natural as this reactive position may be, it will ultimately make the situation worse. Here are some examples of what not to do when facing allegations of misconduct:

KNOWING WHAT'S MATERIAL

You might be thinking: it's all well and good to say that an organization needs to treat an allegation seriously and launch a thorough and independent investigation. But the reality is, it's not so easy to know when the situation is serious enough to warrant such a full-scale response.

After all, large organizations have an extensive list of whistle-blower calls and ongoing litigation at any point in time. Separate and apart from the litigation, there are always allegations of misconduct that an organization receives, coming from employees, regulators, the media, business partners, and customers. In fact, a steady stream of allegations is healthy – it indicates that communication channels are working and people feel empowered to speak up.

Large, sophisticated, and well-run organizations have legal, compliance, and finance departments with hundreds of internal and external professionals, and good processes and reporting structures in place. Nevertheless, it can be difficult to keep track of everything and measure the risk associated with each file. How does a senior leader distinguish cases that relate to ‘business as usual’ disputes from those which might signal a major and fundamental issue that needs addressing?

The accounting concept of materiality comes into play.

For accountants, when preparing an entity's financial statements, information is considered material if omitting, misstating, or obscuring it could reasonably be expected to influence decisions primary users of those financial statements make about the entity. In dealing with allegations of misconduct, business leaders should consider the information contained within the allegation to be material (regardless of the amount of money involved) if it:

• pertains to white-collar crime (organizational fraud, corruption, money laundering, anti-trust, tax evasion);
• provides a threat to human safety; or
• calls into question the integrity of senior management due to their involvement in the misconduct itself or in efforts to conceal it.

Organizations generally rely on the concept of materiality in order to assess priorities for the Board and devise a response. Many times, corporate leaders rely on a strictly quantitative approach to materiality. A chief accountant told me once that if an issue did not exceed his $350 million net income statement threshold, he would not bother looking at it. He failed to see that a corruption matter – even one that may appear financially ‘small’ – undermines the integrity of management as well as management representations over financial statements. After all, how can you trust an executive's statements that the financials are fine when their own conduct and judgement are in question?

The difficulty in separating material from immaterial is compounded by the fact that CEOs and directors are inundated with information at all times of the day and on a vast array of subjects, and it becomes increasingly difficult to sort the very important from the less relevant. Because of an executive's high-ranking position, we often assume that they know how to identify and address all key issues, especially those that could lead to a major crisis. This is an incorrect assumption.

Even if a leader has been through one crisis, it unfortunately does not mean that he or she will see the next one coming in time to prevent it. One of my clients had an excellent Audit Committee chairman who was attuned to ethical issues, accorded them high priority at the Board level, and acted with a steadfast commitment to doing the right thing. He was integral in helping to steer that company through the crisis it was in.

Years later, we were called in to help a second client that was suffering a similar set of issues, and this company's Board was chaired by that same individual. Despite his experience, he had somehow failed to address a similar set of problems. It could be that corporate management withheld key information from him and he had inadequate mechanisms for confirming what he was being told. Or, more probably, he failed to appreciate the systemic challenges of the organization and reviewed issues in isolation rather than as a whole. Regardless, symptoms of misconduct that should have been familiar and detectable were surfacing under his watch.

If someone like that, with competence, high integrity, and significant relevant experience of a past crisis, can find himself operating in the dark, how can other business leaders fully discern what is important and what is not? Ultimately, in today's environment, they have little choice but to invest the time and attention to look beyond quantitative materiality to more qualitative issues. This means asking: does an allegation (or worse, a pattern of allegations) call into question the ethical judgement or oversight of leadership? Could this lead stakeholders to question their trust in the organization? Does it concern a potentially illegal business practice? Does it point to a weakness in corporate strategy that forces the company to make ethical compromises or take undue risks? Answering these questions requires judgement and thoughtfulness – because the line between ethical and unethical conduct can't be delineated by a fixed financial threshold.

NEVER LET A CRISIS GO TO WASTE

In the immediate aftermath of the 2008 financial crisis, then-White House Chief of Staff, Rahm Emanuel, told a panel of CEOs, ‘You never let a serious crisis go to waste.’ Emanuel's sentiment is a good one. If your company has hit a crisis point, it is helpful to have a mind-set that sees opportunity in the situation: an opportunity to reform, learn, and adapt.

A willingness to self-correct rather than fight to retain the status quo may determine whether a crisis becomes a long, drawn-out process of litigation or becomes a catalyst for change. Positive change begins with robust fact-finding to understand the crisis and effective communication that clearly outlines how you intend to respond to it.

As a leader potentially facing a new, public, and very complex situation, it is wise to consider alternatives and take actions that balance and consider all potential scenarios. Taking responsibility for a situation is important in the public's eye, and leaders, as the face of the company, must be seen to be contrite and committed to solving the situation. The possibility of a worst-case scenario needs to be clearly considered and not excluded from framing a plan of action. A systemic failure is such a worst-case scenario, one that has damaged many parties and brings the potential for disaster. Step 1 is a call to consider the possibility of a systemic failure, to open the frame of thinking beyond containment to one that takes responsibility and calls for full, independent fact-finding. This is all a leader can do at this point, as they cannot promise specific reform without understanding the depth and scope of a problem. Good crisis management then defers to such fact-finding and a CEO's commitment to right the wrongs and take any and all action necessary for remediation.