Recent global cyber-attacks have everyone focused on pre-determined ‘how to respond’ lists and directives in times of crisis; response manuals are built around them. While this form of preparation is a practical and essential part of addressing a problem, it unfortunately focuses company management on simply managing a crisis according to the lists in the manual, rather than leadership at a time of a significant reputational challenge.
The secret to reputation recovery after a crisis involves leaders taking rapid action and then communicating to key stakeholders in an authentic way. Yet in a cyber-attack, the first mistake managers make is thinking of the at-risk or stolen data as belonging to the company rather than to the customers actually affected, thereby approaching the crisis primarily from their own perspective.
As a result, companies delay announcing that they have been breached until they know everything about the breach: when was it, over what time frame, how much data has been stolen, is the data now secure, etc. If delaying until they know everything, though, they will never say anything.
Target in the US approached its breach in this manner, delaying its disclosure of the truth and in the process destroying its trust with key stakeholders. They failed to recognize that those whose data has been stolen have a right to know immediately. True leaders understand this, opening the communication early and keeping it going.
When medical insurance company Anthem Blue Cross was hacked in 2014, they seized control of their reputation by announcing the breach immediately and talking about what they were doing to support their customers. The divergent share price movements for Target and Anthem Blue Cross in the aftermath of their respective issues tell the story of who gained trust and who destroyed it. Anthem Blue Cross has been praised across the board for their handling of this crisis – they actually built goodwill.
But more than communicating, leaders also need to be seen leading. None have demonstrated their leadership more clearly than Tony Fernandes, head of Air Asia, when one of his company’s planes flying from Indonesia crashed into the sea in late December last year and unfortunately took the lives of all 162 people on board. Not only did Fernades communicate early and constantly on behalf of the company through regular tweets and authentic language, but he also showed the kind of genuine compassion that marks a true leader in fatal crises.
Fernandes’ tweets – his primary communications medium – were not crafted by lawyers or corporate PR people; instead, he spoke of the anguish for the families of the passengers, the staff and even himself. He was boots-on-ground quickly at Surabaya (from where the flight departed), meeting with families and staff and making himself constantly available to the media – even when he had nothing new to share. He was visibly demonstrating authentic leadership, and he kept communicating.
“I apologize profusely for what they are going through, I am the leader of this company; I take responsibility. That is why I am here. I am not running away from my obligations even though we don’t know what’s wrong [in causing the crash]. The passengers were on my aircraft, and I have to take responsibility for that.“
– Tony Fernandes in a televised press conference, after debris from the plane was first spotted.
Fernandes’ response (and, really, the way he was quickly called into action) is illustrative of the fact that one of the most vital roles for any CEO is to ensure their organization is fully prepared to successfully deal with crises – from cybercrime to product failures to natural disasters. When McKinsey polled global CEOs on the most important capabilities in managing a company through a crisis, they found that two qualities emerged at the top – both of which Fernandes demonstrated in spades. The first was leadership – the ability to inspire others and shape their actions – and the second was direction, defined as the capacity for clarity around where the organization is going and aligning people on how to get there.
Yet, in practice, the ability to provide this leadership and direction hinges on a third quality: preparation. As we know from experience, when a crisis hits, the market decides quickly whether a company is a winner or loser. Public perceptions start forming with the first tweet, making a company’s response in the first 24 hours absolutely critical.
If a crisis came calling today, are you comfortable that your company has the right plan and the right people in place, fully prepared to respond swiftly and effectively and to show authentic leadership? Or are you simply in a position to check boxes off a list? These are questions – and realities – that need to be confronted before it’s too late.
About Brian West