During the recent virtual annual meeting of , I was part of a panel, that discussed how in-house counsel must ensure that their company is prepared to handle any emergency. Other panelists included Laura Stevens, Executive Vice President and General Counsel of Cengage Group; Michelle-Kim Cohen, Deputy General Counsel of Dassault Syst猫mes; and Sarah Gatti, Corporate Counsel at Drift.com.

Here are some of the questions discussed by the panel and panelists鈥� responses.

How broad should your emergency response plan be for addressing any type of emergency?

A one-size-fits-all-approach may not always be feasible for company-wide emergency response planning. When preparing or updating an emergency response plan, a company should account for reasonably foreseeable emergencies that may occur, rather than addressing every possible emergency regardless of actual likelihood. This assessment depends on various factors, including geography, the company’s industry, the company’s products and services, and the nature of the workforce and whether it includes remote employees.

Geography plays a significant role in the risk assessment process and may result in different types of risk depending on location. For example, one region may be prone to certain types of natural disasters (such as earthquakes) that are unlikely to occur in another region where the company operates. Using this example, the emergency response plan for a worksite in that region must account for the possibility of those natural disasters occurring, whereas a plan for a worksite in a different region may not.

A company should also survey its existing resources and determine whether a plan already exists for a particular emergency situation, even if the internal distribution or use of these resources was limited. Existing resources can help identify reasonably foreseeable emergencies and provide a starting point for developing more comprehensive emergency planning.

Even if a company tailors its emergency response planning, certain components may be universal regardless of the type of emergency. For example, a company may use the same communication systems for alerting its workforce of an emergency, even if the extent of notification varies by the type of emergency.

How accessible should your company’s emergency response plan be?

A company must account for whether an emergency could impede access to the emergency response plan itself. A company should have copies of the emergency response plan printed out in hard copy format and kept at the company’s offices or work sites. In addition to hard copies, a company should have the emergency response plan electronically accessible, such as a version securely stored on a shared drive. Obviously, the inability to access an emergency response plan should not create an emergency in itself. For example, if there is a foreseeable risk of an emergency rendering an office physically inaccessible (such as from civil unrest), the company should not have the emergency response plan only kept in hard copy format at that office.

A company must take the proper steps to ensure that the plan鈥檚 needs are accessible to stakeholders and the persons responsible for implementing the plan. The company should also consider whether and to what extent to share the emergency response plan with its outside counsel.

Should the emergency response plan be shared externally?

A company should carefully determine to whom it discloses its emergency response plan and, if required, how much of the plan to disclose. This issue periodically comes up when customers or vendors want to determine if a company has a plan before doing business with the company. Sometimes limited disclosure of a company’s emergency response plan may be unavoidable.

A company should hesitate to fully disclose its emergency response plan to third parties unless absolutely required. Instead, a company should consider other ways of satisfying the needs of third parties that want to confirm the existence and content of the company鈥檚 emergency response plan. For example, a company could inquire whether providing a copy of the plan’s table of contents satisfies a third party’s needs. Alternatively, a company could require a nondisclosure or confidentiality agreement before disclosing any part of its emergency response plan or limiting disclosure to answering a questionnaire about its emergency response plan.

What is in-house counsel’s role in emergency response planning?

In-house counsel plays a central role in a company’s emergency response planning. Aside from serving on the crisis management team, in-house counsel often acts as a project manager in emergency response planning. As a result, in-house counsel communicates with a company’s departments and external and internal stakeholders, such as the company鈥檚 IT and communications personnel. In-house counsel also ensures that training and assessments of the plan regularly occur. In-house counsel may need to determine if the plan is current and accurately reflects up-to-date operational practices, the company’s business, and legal requirements.

In addition, in-house counsel serves as a subject matter expert with issues related to a company’s emergency response. This includes asking “what if” questions when reviewing the plan, conducting a post-mortem response to any testing of the plan or actual emergency, determining who to notify about the company’s emergency response, and ensuring that any emergency response is legally compliant.

How should your company prepare for implementing its emergency response plan?

A key component of emergency planning involves testing and training employees on the components of the plan that are relevant to their respective roles. To test the plan, the company should perform tabletop exercises to simulate reasonably likely emergency scenarios to better ensure that key personnel know their role and can implement the plan. These exercises can also identify any necessary changes for updating the plan. For example, if key personnel are unreachable during a tabletop exercise, the company should consider updating its plan by replacing them with more accessible individuals.

The company should test its emergency response plan in real-time. This may involve testing the plan after-hours because a real-life emergency occurs at any time.

Given the legal and business continuity risks to their company, in-house counsel must have a central role in ensuring that their company (and, if necessary, the corporate law department) has an emergency or disaster recovery plan in place before an emergency arises. This plan must be flexible to cover any probable emergency that may arise.

Developing a company’s emergency response plan

In-house counsel typically serves on their company’s emergency response team and often have a significant role as a leader in creating their company’s emergency response plan, even though the law department may not be directly responsible for managing or owning the plan. In particular, in-house counsel is exceptionally situated to help prepare and provide feedback on the emergency response plan because of their knowledge, experience, and ability to identify red flags and analyze “what if” situations. For example, in-house counsel must apply their knowledge of applicable data privacy laws and determine the best course of action if there is a risk of a cyberattack that could compromise sensitive information stored by the company.

You can learn more on this topic at the upcoming panel, ““, at the Association of Corporate Counsel’s 2021 Virtual Annual Meeting (10 a.m. to 11 a.m., EST on October 20, 2021).

A starting point in emergency response planning involves identifying the possible risks to the company. Planning must account for general risks and those risks specific to the company based on its geographical footprint, industry, and workforce. In addition to ensuring business continuity and minimizing risks, a company needs to consider critical questions, such as:

• • • Whether it should use a one-size-fits-all approach for all emergencies and company sites, or customize the plan to specific emergencies and sites?
    • Who has access to the plan?
    • When does the plan activate?
    • Who will execute the plan in the event of an emergency?
    • Who will the plan affect, both internally and externally?
    • What critical functions, systems, and activities are central to the company?
    • What external and internal resources exist for responding to an emergency?
    • What actions should the company take as part of its post-emergency response?
    • How should the company handle an emergency that may affect only part of the company?

As part of its planning, a company must also account for emergencies when all or part of its workforce already works remotely from different locations 鈥� a common occurrence resulting from the corporate response to the pandemic. Therefore, the emergency response plan must address information technology systems, security, and employee safety for a fully or partially remote workforce.

Once the company develops a plan, it should then inform the emergency response team. The company should also train key personnel and hold drills to test the plan.

Ensuring the law department’s preparedness

A company鈥檚 law department must have the ability to function during and in the aftermath of an emergency. Depending on the company, the law department may require its own emergency response plan. As a result, the law department should know the company’s emergency response plan and ensure consistency with the department’s own emergency response plan, if any.

The department should follow a similar approach to emergency response planning, consistent with the company’s overall planning. This includes assessing possible threats, determining overall preparedness, creating an emergency response team, drafting a written plan, conducting drills and training, and identifying post-emergency legal priorities (such as evaluating contractual obligations and notifying insurance carriers).

Among other impacts, an emergency may require the law department to take additional actions to preserve legal privileges, protect trade secrets, and maintain confidentiality of information. For example, the law department must continue to maintain the confidentiality of attorney-client privileged communications throughout any emergency.

Further, the risk of inadvertent disclosure and waiver rises when the law department or other company personnel work remotely. To help protect against the inadvertent waiver of the attorney-client privilege, the law department should adopt procedures and take appropriate proactive security measures if the emergency requires the law department or company personnel to function remotely.

Updating the emergency response plan

Finally, emergency response plans must be dynamic, rather than frozen in time. In-house counsel must work with their company to regularly review and update their existing emergency response plans. If an emergency occurs, a company should also consider conducting a post-emergency audit of the company’s actual response and address any deficiencies in the existing plans.

For example, a company should update its plan to reflect relevant organizational and other changes. This includes changes to key personnel, technology, the company’s office locations (or remote workforce), relevant laws (such as environmental standards), possible threats, and the organization’s culture.

While an emergency creates the potential for disrupting business operations and creating legal liability, a prepared company and its law department can minimize these risks. To ensure preparedness, in-house counsel must actively participate in the company’s emergency response planning and play a strong leadership role in its development, execution, and update.

Rose Ors: Who are the individuals outside of the legal industry who have influenced how you approach your work?

Veta T. Richardson: I鈥檝e been influenced and inspired by the example and the stories of individuals who have shown courage in how they鈥檝e lived or led. Thurgood Marshall and Constance Baker Motley are examples 鈥� my mother is another example.

These are individuals who inspire me because they looked at the world and their original place in it and had the courage to reach higher and step outside of what鈥檚 expected. Doing that, they achieved more than most, especially given where they came from. Those are the stories that have influenced my work because they make me approach it in a more fearless way.

Rose Ors: How do you approach your role as the leader of ACC?

Veta T. Richardson: I approach my role at ACC as I鈥檝e approached my career journey 鈥� according to five principles: The first principle is taking stock. I continually examine where ACC is going against where we want to go. I look at the gaps, and together with my team decide how we are going to close them. The second principle is to not be afraid to take risks. Every organization and individual needs to take risks to grow and prosper 鈥� staying in your comfort zone is antithetical to success.

The third principle is to take credit, meaning offer clarity about the value that you bring to the table. I always ask, 鈥淲hat does success look like for this role or project or task?鈥� I then plan and track how I will contribute as an individual member and as a leader.

The fourth principle I call taking a hand. I spend a lot of my time mentoring others. It is very satisfying and important to invest in the success of others, as well as not being too proud to ask for someone to lend a hand to advise you. Finally, the last principle is using your voice to take a stand. I believe that no one can lead effectively if they lack the courage to, when necessary, use their position to voice perspectives that differ from the status quo. Leaders lead.

Rose Ors: What books have influenced you?

Veta T. Richardson: A favorite book 鈥� one I have read many times 鈥� is Who Moved my Cheese by Spencer Johnson. It is a business parable featuring four characters 鈥� two mice and two 鈥渓ittle people鈥� 鈥� who live in a maze and search for cheese. The maze serves as a metaphor for aspects of your life and the cheese serves as a metaphor for the things you want from those aspects. As the characters navigate the maze looking for cheese, the cheese keeps moving and you see how the characters respond to changing circumstances.

The increasingly complex set of regulations, the global landscape, geopolitical risk, and the speed of change and disruption requires that a company鈥檚 top legal executive also be one of the company鈥檚 top business leaders.

My other favorite book is I Moved Your Cheese: For Those Who Refuse To Live as Mice in a Maze that Someone Else Creates by Harvard Business School professor Deepak Malhotra. It is a story about three mice. These mice refuse to accept the reality of the maze and see themselves as more than characters in a rat race. The book was a real eye opener for me. It confirmed for me the importance of creating your own reality versus accepting what someone else creates.

One of the best lines in the book is when one mouse says to another, “You see Max, the problem is not that the mouse is in the maze but that the maze is in the mouse.” As a woman of color this lesson resonated in a very deep way. It so beautifully illustrates the importance and impact of writing your own narrative rather than blindly accepting or conforming to the expectations of others 鈥� a lesson that was another gift from my beloved mother to my sister and me.

Rose Ors: What is a big-picture issue facing the ACC today?

Veta T. Richardson: We are currently focused on how we can, as an organization, best advocate for assuring that a company鈥檚 chief legal officer (CLO) has a seat on their company鈥檚 executive team and an empowered voice in the board room.

The importance of achieving these dual goals can鈥檛 be overstated. Today, being an exceptional legal strategist is table stakes. The increasingly complex set of regulations, the global landscape, geopolitical risk, and the speed of change and disruption requires that a company鈥檚 top legal executive also be one of the company鈥檚 top business leaders. We believe that this coming decade will be known as the Age of the Chief Legal Officer, as those in that role become key players in the C-Suite.

Rose Ors: What are the key steps in that evolution?

Veta T. Richardson: ACC believes that the first step is for the CLO to report directly to the CEO and to play a role in the development and execution of a company鈥檚 strategy.

Along the same lines, for a company to enjoy the full value of a business savvy CLO, he or she should be given the opportunity to develop a relationship with the board of directors and attend board meetings. We are already seeing this evolution happen and we are committed to lending our voice and influence to support it.

This interview has been edited and condensed by Rose Ors.