Legal and business continuity. I was recently asked a series of questions about lawyers' involvement in business continuity. There was an assumption that legal wasn't seen as part of a business continuity plan. That was the first issue. A second was that lawyers are only involved in crisis management...which is really about having legal review the crisis communications a company will send out. There are a lot of assumptions of what lawyers do and don't do. So let's clear that up.
I had given a talk about legal implications of business continuity - the dangers of not having a business continuity plan, what force majeure means and how it is just a lot of failures of business continuity (I even did a previous blog post about force majeure). But I think I need to go back to the basics.
Every business continuity plan looks at the most important departments within an organization. Assuming it's a big company, it will include legal. Legal isn't just about not getting sued or writing contracts.
Regulatory compliance is a big component of business continuity. Without compliance a company can be fined, lose their license, face criminal charges or a civil lawsuit, or be put out of business altogether. Compliance needs to be in place before an action takes place. It can have a big impact on a vital asset: reputation.
Audits are a different breed of the same animal. They are backwards looking for what has already been done. Audits are important for risk management. You find a problem, you fix it.
And, yes, there is that matter of boards of directors being liable for not having a business continuity plan because they are required by a fiduciary duty to put the interest and longevity *of the company* ahead of their own interests...and paying for business continuity may well cut into their compensation (at least for the short term). Tyson Foods was sued by its shareholders for mishandling the COVID-19 outbreak, citing their lack of action which caused the plants to close down from the rapid spread to the workers...which impacted the shareholders' dividends. Southwest Airlines also had a shareholder derivative lawsuit based on their not having a more agile booking/tracking system and the collapse of their system thanks to bad winter weather just this past December.
Fun fact: even law firms need to do business continuity. Imagine them losing access to their files. Missing court filings because the internet is down. A cyberattack that exposes confidential client information. Honestly no business is safe.
Lawyers do more than make sure the right words published both informs the stakeholders appropriately and prevents accepting liability. They also have an integral part of any business continuity program. Aside from business continuity professionals working in tandem with them, lawyers are a welcome and necessary part of the risk assessment and business impact analysis.
We (I can still call myself one, as I still have a current license to practice law, despite describing myself as a recovering attorney) legal beagles do keep things running. And help you not get sued.
