|
Why Directors & C-Level Officers ARE Legally Liable if a Disaster or Disruption Occurs
Why are Directors & C’s liable when there is an Emergency or Disaster, and how can they defend themselves? By Jay N. Rosenblatt, Partner, Simpson Wigle LLP
Much has been written in the last few weeks about the catastrophe known as Katrina, but not much has been focused on the legal responsibilities of directors and C-level officers related to Disaster Management & Business Continuity.
Everyone talks about how to RESPOND to an emergency, and that indeed is important, but is a jury going to be satisfied with that kind of response? Likely not, but why not?
To me, disaster recovery plans are important, but business continuity plans are everything! A DRP is reactive and only helps to minimize the loss AFTER the event. A BCP is proactive and is designed to minimize the loss BEFORE THE EVENT OCCURS.
The legal issues are all about: (1) negligence; (2) due diligence.
There are ramifications if a director and C-level officer is negligent.
Simply put, negligence is a failure to do what a reasonably careful and reasonably prudent person would do in the given circumstances.” The relation is such as to produce a risk of foreseeable harm to a stakeholder, creating a duty of care, and the degree of care is not taken.
Business can ‘Ignore it (the risk) or deal with it’. Remember: inaction is a decision, and inaction is negligence! Directors and C’s must stop behaving like an ostrich with its head in the sand.
There is a duty to all the stakeholders to keep the business running!
Everyone is aware that business is exposed to risks. Those risks are on a continuum: inconveniences (traffic delays), disruptions (local fire, flood), disasters (earthquakes, SARS, West Nile Virus, terrorist attacks) , catastrophes (9/11, Tsunami and Katrina).
Any of these risks will affect the ability of that business to continue operating, limiting or eliminating access to its critical data, applications and facilities.
Failure to manage and mitigate those risks is negligence, and will result in legal exposure to the directors and C’s.
Business has a duty and obligation to all its stakeholders: employees, shareholders, investors, regulators, customers and suppliers, just to name a few; employees will sue if they are endangered while on the job or can’t get back because the business fails to continue after an emergency; existing investors may lose confidence and not continue to fund the business; potential investors may decide to invest in a business that is more proactive; regulators will be laying charges for non-compliance of legislations such as Sarbanes-Oxley, NYSE and SEC regulations (just to name a few); customers may find an alternate source of supply of services and materials if they feel their existing business is not reliable; suppliers will not be comfortable knowing one of their customers may not be in business and therefore not be able to pay its bills!
But what is the defence to a charge of negligence?: it’s due diligence; due diligence is simply doing what the ‘reasonable man’ would do; doing it right for all the stakeholders. It’s all about good corporate governance and best practices!
What should directors and C’s do in order to exercise due diligence?
In today’s world, there is no justifiable defense in stating that you weren’t expecting SOME disruption/disaster. Today’s world is such that we know these events will occur, but we just don’t know the timing or the type of event. For that reason, directors and C’s must be proactive. One excellent element of that is to have a business continuity plan in place. We can be like the ostrich, or we can be like Noah; Noah had warning of the flood, planned for it, and implemented his plan. Business leaders must be more like Noah.
Remember: you can’t ELIMINATE risk, but can at least MANAGE it!
Everyone reading this article is aware of the key elements of a business continuity plan or can use the resources available to prepare one.
Here are some basic components to a business continuity plan:
- Safety of family and employees;
- Communication with employees;
- Communication with customers and suppliers;
- Off-site data storage and recovery;
- Security of home and business facilities;
- Remote access to your facility, data and software applications by way of a vpn, etc.;
- Alternative workplace facilities;
- Alternative sleeping accommodations;
- Business recovery centre.
On the topic of ‘Communication”, I feel that it is crucial that a national Emergency Communication System be established, whereby there is a clear instant, effective communication between first responders, and with employees, families, suppliers, customers. As we have seen with Katrina, communication is critical. That communication can be by a special text messaging service, or an emergency bandwidth reserved for and available to first responders, and others. With all the technology available today, such an initiative is not so difficult to implement.
What is required is to determine:
- What level of government initiates it;
- Who activates it;
- Who implements it;
By way of summary, remember:
- Be prepared, but not scared;
- Directors and C’s are liable;
- Your only defence is due diligence (besides, it is only a good business practice);
- Manage and mitigate your risks;
- Assess the risk;
- “Worry a bit now, or worry a lot later!”
About the Author
Jay N. Rosenblatt
Jay is a partner in the law firm Simpson Wigle LLP, located in Hamilton, Ontario, Canada, and is engaged in a Business and Technology law practice. http://www.simpsonwigle.com/
|
