Managing a Regulatory Crisis in Retail and Consumer Businesses – 14 March 2017

Event summary and highlights

Our leading regulatory expert speakers highlighted some of the particular crisis risks we are seeing retail and consumer businesses face. In particular:

• Competition (Marc Shrimpling) – online sales restrictions, geo-blocking and restrictive distribution systems.
• Data Protection / Cybersecurity (Ashley Hurst) – state sponsored attacks, hacktavists, ethical hackers and employee error.
• Business Crime (Jeremy Summers) – growth of corporate liability, increased international intelligence sharing and whistle blowing, cooperation between regulators.
• Health, Safety and Environment (Katie Vickery) – contractors instore, asbestos, back of house and violence and abuse against employees.
• Product Safety (Katie Vickery) – higher risk with own brand products, compliance online and increased emphasis on traceability.

Attendees were then given a developing crisis scenario to work through and challenged to think how they might respond. Here are some of the thoughts from the event:

Prepare

1. Don’t wait for a crisis to hit before you learn how the business will deal it – prepare for crisis and audit your business’s crisis resilience.

2. But don’t over complicate your preparation! Complex crisis plans are voluminous, unwieldy and difficult to implement, plus trying to predict exactly what could happen with a decision making flowchart is too constraining. Simple is better e.g. one page checklists for specific scenarios to help focus those dealing with the live issues, flowcharts of who to call (which are regularly updated) spelling out who calls who, what people’s responsibilities are and designated leaders.

3. Think about using alias email addresses in your plans rather than named contacts e.g. crisis@businessname.com or productsafety@businessname.com – it can be easier for someone to remember an email address specific to a crisis situation rather than the name of a person who may change.  When people move on in the business, the email address remains constant.

4. Cover off your entry points – a consumer business can hear of crisis in a number of ways; through customer contact centres, instore, via social media. Those receiving the messages need to know how to initially deal and how to escalate.

When crisis hits

5. Give your crisis a project name. Use it. Mark all documents “legally privileged and confidential”. These two simple steps make email management easier and will simplify disclosure too.

6. Who you have on your team is critical to resolving the crisis – make them relevant to the crisis and include IT, HR, legal, customers services and marketing / comms as required. You need a good chair, who can hold the room, focus meetings and keep the agenda moving. They should be separate from decision makers who need to be free to see the bigger picture and make decisions rather than run meetings. Also, don’t ignore the junior in the team who has read all the documents and may have a better grip on the detail!

7. Engage external support quickly, particularly lawyers, if there are none in-house. This is important for both obtaining and preserving privilege in documents and to get some perspective on issues like whether you need to notify a regulator.

8. If you need to carry out a document review (including email) do not mess around with a live system. You could be destroying / tampering with evidence. Take an image of the live system so that it is preserved; extract onto a document review platform and then review.

9. Preserving brand, reputation and goodwill is paramount – sometimes, that might mean saying “sorry”. Don’t rush it, prepare for it, but accept that it may be necessary to get the business back on track.

10. Social media can be a way to combat “fake news” – but if your channels aren’t followed, it may have limited or no impact. Also, what you do about the situation can be a much better way of demonstrating your response to the crisis rather than what you say.