Corporate crises are inevitable. From cyberattacks to whistleblower complaints of executive misconduct, lawyers, both in-house and outside counsel, are usually among the first people pulled in to assist in addressing these crises. Lawyers are often expected not just to answer the legal questions associated with such crises, but also to guide corporate leaders in identifying problems, preserving attorney-client privilege, selecting appropriate resources, and satisfying fiduciary duties, all while maintaining legal and ethical standards throughout the process. The CLE program “When the Alarm Sounds: Boardroom Crisis Management in Real Time,” presented at the 2026 ABA Business Law Section Fall Meeting in Chicago, Illinois, provided practical guidance on governance, privilege and internal investigations, communications strategy, regulatory exposure, and legal and ethical compliance when facing moments of crisis.
This showcase program was moderated by Mac McCoy, a partner at Carlton Fields, P.A. in Tampa, FL, and past chair of the Business Law Section, and featured Margarita Rohaidy Delgado, founder and president of MRD Consulting; Cara Bradley, deputy general counsel of Brooks Automation; Ami N. Wynne, partner at Morgan, Lewis & Bockius; and Forrest J. Deegan, principal consultant at Spark Compliance Consulting, a Diligent brand. Together, these panelists led an interdisciplinary, thought-provoking conversation by walking through three fictional case studies— (1) a cyberattack, (2) a CEO ethics crisis, and (3) a patent and trademark war—and discussing best practices for tackling the issues in each respective scenario.
What Keeps You Up at Night?
Prior to diving into the case studies, the panelists set the stage for the discussion by sharing, from their unique perspectives, the thoughts that consume their minds in moments of crisis. “Do you have a game plan? . . . Do you have a team?” Bradley said, alluding to the need to have the proper resources in place before a crisis arises. Deegan stated that when it comes to a crisis, it is not a matter of how it will happen, but when it will happen. Next, Delgado emphasized concerns surrounding communication strategies and understanding vulnerabilities and communication risks before a crisis. Lastly, Wynne stressed what appeared to be the common, overarching theme shared by all: proper preparation.
Case Study #1: The Cyberattack
When a national healthcare company experiences a ransomware attack that risks compromising patient information, how does counsel respond? It is certain that in-house counsel will be pulled in immediately, but what should their priority be? In these situations, the lawyer’s job is not to slow the process, but instead to impose order on chaos. True to the theme of preparation, to impose such order, it is important for counsel to adhere to the incident response plan—which requires that companies and organizations have an incident response plan in place and ready to be executed.
But having a plan in place is not the only thing that matters. Bradley noted how important it is to determine who the team to carry out this plan will be. That includes considering which internal stakeholders are best equipped to address the situation, and what outside experts are the best fit to support the internal team; combined, they will form the core crisis team. An example of a core crisis team for a cyberattack may include the general counsel and other in-house counsel (as needed), the CEO or other designated executive lead, outside counsel, an IT or other information security lead, a communications professional, a compliance or regulatory lead, and an insurance or risk management lead. Ultimately, it becomes the job of the assembled team to collaborate by carrying out their respective tasks and following the plan in place.
Case Study #2: The CEO Ethics Crisis
Imagine the CEO of a publicly traded company is accused of maintaining a personal relationship with a major vendor, where emails are discovered that evidence a consulting arrangement in exchange for luxury travel and gifts. Although formal charges have yet to be filed, employees and investors are raising important questions. In this situation, it is imperative to address the elephant in the room: accountability. According to Wynne, it is important for the investigation team not just to focus on the policies and procedures in place to address such situations, but to consider the accountability factor, as that is ultimately what can have major implications here.
In scenarios like this, communication plans are also key components of the crisis response, as audiences, both internally and externally, will be waiting for responses. Per Delgado, appropriate disclosures may include acknowledgement of the situation, messaging that an investigation has been initiated, notice that counsel has been retained, and, most importantly, assurance that the company takes this issue seriously and will take appropriate actions based on the findings. In this particular situation, the lawyers assigned to this crisis should evaluate legal liability, regulatory exposure, fiduciary duties, disclosure obligations, employment consequences, insurance coverage, contractual obligations, litigation risk, privilege and waiver, and reputation and stakeholder trust.
Case Study #3: The Patent and Trademark War
A technology company launches a new artificial intelligence platform, and within hours a competitor files a lawsuit alleging patent infringement, trademark confusion, and theft of property concepts. Media outlets publish the story under headlines like “AI Company Accused of Stealing Competitor’s Innovation.”
As a best practice, the public statement that should be made in this situation and related situations is that you do not discuss active litigation in public. Further, it is important to note that anything that is discussed may be used in litigation.
Another best practice in this instance is that, given the high litigation stakes, attorneys need to be involved in approving all messaging, both internally and externally. It is important that attorneys review messaging for accuracy, consistency with public statements, preservation instructions, confidentiality obligations, media response guidance, whistleblower and anti-retaliation issues, and litigation hold language. Deegan shared that in these situations, it is imperative that communications teams have the correct legal contact to avoid delays; this ultimately needs to be addressed and planned for in the applicable crisis management plan.
Key Takeaways
In discussing these crisis scenarios that boards may face, the panel’s most common takeaway was that preparation and timing are key. To be prepared in a timely manner, crisis response plans must address who will lead and who should be informed, how to preserve privilege while gathering facts, how to navigate legal and ethical dilemmas, how to coordinate communications strategies without increasing liability, and how to advise boards through difficult governance decisions. Ultimately, it is important to plan the dive, and dive the plan.
