Briefing
Switching to the “Temporary Normal”: Seven Governance and Risk Management Guideposts for Navigating the Business Impacts of COVID-19
The COVID-19 pandemic has ushered in a period of dramatic and forced change, affecting all areas of business. Companies are pivoting quickly to remote operations and moving forward, wherever possible, with their businesses. Even if this is a “once in a generation” crisis, companies should take the following steps to ensure that their day-to-day decisions are grounded in good business judgment and meet regulatory expectations. This, in turn, will help mitigate litigation and investigations risks down the line.
- Institute good governance: Companies should take the time, even in the face of urgent decisions, to ensure that key matters, including those relating to disclosure, are subject to sufficient oversight, that key stakeholders are involved, and that business rationales are documented in a helpful way. A small investment in good governance at the outset of the crisis will go a long way to ensuring that the company makes sound decisions and can explain them in a helpful way at a later date.
- Update internal controls as needed: Companies should evaluate whether their controls are fit for purpose under changed conditions and should update them as needed. Complaint hotlines remain an important input for evaluating risks and should be taken into account.
- Benchmark and carefully consider employment actions: Decisions that affect working conditions should be benchmarked against official guidance. Employment actions and compensation decisions should be carefully considered and documented; and succession plans should be updated.
- Assess liquidity options: As we head into a likely downturn, liquidity is key. Companies should have liquidity plans in place and should consider the pros and cons of pursuing various options, including drawing on existing facilities and taking advantage of government programs. These decisions should be carefully considered and subject to the governance concerns discussed above.
- Prepare for litigation and regulatory risk: Past crises have taught us that companies’ pandemic responses will be scrutinized in the future by both private litigants and regulators. Companies would do well to start preparing for that now, including by identifying key risks and memorializing business decisions. At the same time, Companies should take legal advice under privilege and take steps to safeguard that privilege where applicable.
- Beware of antitrust risks: The crisis may put pressure on companies to collaborate with competitors as they face similar headwinds. Any such collaboration should be undertaken with care, as it may expose the company to scrutiny for potential antitrust infractions. Employees should be reminded of their obligations to avoid anticompetitive conduct.
- Avoid documentation pitfalls: Companies should remind employees that documentation can be taken of out context and that all written communications should be factual and devoid of speculation or hyperbole. Documents that overemphasize risk should be corrected and put into context. And companies should consider whether newly adopted technologies increase the risk that calls will be recorded and provide guidance to employees.
See below for more detail on these seven key steps to help companies establish a steady process for reacting to the business impacts of COVID-19.
1. Institute and test governance practices – a small investment in governance can go a long way
At this point, many companies have weathered the initial phase of the crisis and are settling into a “temporary normal,” using a combination of remote working and other techniques. Others are fighting for their very existence and facing urgent decisions on a day-to-day basis. For both, the transition to more remote working, and the economic disruption that has accompanied the pandemic, raise a host of new issues. For example, many companies are thinking through how to continue business in the context of a health and economic crisis; whether to make disclosures and, if so, what precisely to disclose and when; how to guard against cyber risk, fraud and other compliance risks in a changed environment; whether to honor or enforce contractual obligations given incredible change over such a short time; whether and how to take advantage of government aid; and how to interact with shareholders in light of the pandemic.
Given the number of issues, and the speed with which companies must address them, it is understandable that companies have been focused on the urgent questions confronting them each day. Nevertheless, it is worth taking the time to evaluate whether your company has sufficient governance in place to make these decisions — process is important. Each company must evaluate what structures work best for it, but, at bottom, companies should ensure that risks are identified, documented and reported to senior leadership; that important decisions are vetted with relevant stakeholders, including those in legal and compliance; that the company is taking steps to avoid silos and ensure that management is addressing potential issues across all business lines; and that the company is evaluating its business processes to determine if they are fit for purpose in the current environment. These steps should ideally be documented and revisited at regular intervals.
2. Evaluate the impact of COVID-19 on existing controls and update risk assessments
The COVID-19 crisis is a real-life stress test, and companies should evaluate whether their controls are fit for purpose in the current environment, taking a risk-based approach. This does not mean that companies need to redo their risk assessments at this time, but companies would be well served to review their most recent risk assessments and evaluate how the crisis impacts both risks and mitigants (and, of course, documenting this analysis). It may become clear that modifications or new controls are necessary to account for the manner in which processes have changed to accommodate remote working conditions and business disruptions. Senior leadership should ensure that existing internal controls continue to be effective and that new or modified internal controls are put in place as needed in response to changed working conditions and business processes. These changes are important to be able to put executives in a position to be able to sign a Sarbanes-Oxley (SOX) Certification. It is also important to remember that changes to internal controls should be discussed with both the audit committee and the company’s external auditors.
In addition, Companies should take a look at their complaint hotlines on a frequent basis and evaluate whether those complaints reveal any new or increased risks in the current climate. These processes should be subject to oversight and conducted across regions and functional areas. Moreover, to the extent companies become aware of compliance infractions, either through their complaint hotlines or otherwise, they should investigate and discipline employees, as warranted, as they ordinarily would and should document this approach.
3. Benchmark employment-related actions against key guidance and evaluate compensation programs and succession planning
Over the past several weeks, companies have made significant changes to the way their employees interact with their employer and each other. We suggest that companies take steps to ensure that they have documented the changes that have been made, and that senior management and the board are being updated regularly. These plans should be revisited with some regularity. With respect to on-site operations, employers would do well to benchmark the precautions they have taken relative to publicly issued guidance, such as that from the Center for Disease Control (CDC) and the Occupational Safety and Health Administration (OSHA). Because these bodies continue to refine their guidance, companies should check guidance on a regular basis and update their approach accordingly. Steps to document the link between this guidance and corporate decision-making can further demonstrate that a company’s actions were measured and reasoned at the time, even if they are without precedent in the organization.
Some companies have recognized a need to modify their compensation programs to maintain stability and flexibility as the crisis evolves. For instance, companies are considering whether any changes are needed to existing or intended grants of performance-based compensation, such that they can continue to serve their intended purposes in light of a potentially changed outlook for the company; the effect of employment actions on equity compensation awards; whether across-the-board or executive-level pay reductions, or compensation payment deferrals, are warranted to preserve liquidity; and, for companies that have taken or are thinking about taking loans under the CARES Act, whether additional adjustments are necessary to comply with the Act’s required limitations on executive compensation. These steps should be considered carefully and documented.
Finally, as the virus continues to spread, it is very important for companies to have up-to-date succession plans in place. Note that executive and director changes often trigger current disclosures and, even if disclosure is not required, companies should consider disclosing these situations to control the narrative ahead of any market leaks.
4. Explore options for accessing fresh liquidity
In times of economic instability and market dislocation, liquidity is paramount. Boards and senior management should continue to evaluate their plans for accessing and preserving liquidity. This includes evaluating the amount of their existing funded debt together with their sources of fresh liquidity.
With respect to available, undrawn credit facilities, companies should focus on what the conditions to draw down on those facilities are and, naturally, whether the company will be able to satisfy those conditions to access the funding. If it is an option, the board should consider whether it is prudent to draw down now, taking into account whether conditions may change for either them or their lenders.
In addition, it is good practice for companies to consider alternative sources of capital, including whether the company may be a candidate for one of the many government programs adopted under the CARES Act — e.g., Primary Market Corporate Credit Facility, Main Street New Loan Facility, Main Street Expanded Loan Facility, Paycheck Protection Program, among others. Note, however, that these programs may not be the right choice for all companies, and boards would do well to explore other avenues of raising debt and equity funding. Even if there does not appear to be a present need for the funds, sound business judgment may very well dictate that the company arrange for “rainy day money” to be available. This does not necessarily mean that the company must borrow the money today, but rather that the company should consider lining up a committed facility that can be drawn when the company determines it is prudent to do so. The process for evaluating these options and taking action should be subject to good governance, as discussed in section 1.
5. Consider and plan for potential litigation and investigations risk
Based on past experience, companies’ responses to the pandemic will be scrutinized in the future by private litigants and government regulators. Now that we are past the initial adjustment to the crisis, companies would be well served by taking some time to identify litigation and investigations risks and prepare accordingly. Such preparations could include documenting business decisions in an appropriate and helpful way; obtaining consents or written contract amendments, as needed; evaluating whether multiple jurisdictions are implicated; and ensuring that legal and compliance are advising on key decisions and taking steps to maintain legal privilege. This analysis should be undertaken under privilege and reported to senior leadership.
At the same time, during times of stress, it is often also helpful for senior management and boards to document in a non-privileged way, particularly in board minutes, the steps they have taken to protect their businesses, including the information available when those decisions were made. After the 2008 credit crisis, companies that had taken the extra time to contextualize their decisions in their board minutes were able to handle later regulatory scrutiny and litigation more effectively. Today’s decisions are based on current information, but will be judged with hindsight; so making sure a record is available to help ensure that those scrutinizing past decisions in the future will understand their context is recommended.
Balancing the privileged and non-privileged record can be tricky, but it is important to engage in that balancing act throughout the crisis and its aftermath. Knowing what is and is not privileged, what will and will not be reviewable by litigants and regulators later and making documentation decisions with those guidelines in mind will be important.
6. Pay particular attention to contacts with competitors
Given the upheaval caused by COVID-19, companies searching for ways to weather the storm may be tempted to reach out to others facing the same headwinds. Contacts with competitors, however, carry significant risks under antitrust laws. Even innocuous competitor contacts can be misinterpreted by government agencies and private civil litigants as evidence of an illegal agreement and used to force companies to defend themselves in protracted and costly litigation. The Antitrust Division of the Department of Justice (DOJ) and the Federal Trade Commission (FTC) have emphasized that they will remain on the lookout for anticompetitive collaborations during the pandemic.
Companies should ensure that employees appreciate the risks inherent in communicating with competitors and receive guidance about when they may—and may not—participate in those types of communications. But companies need not necessarily forego all competitor contacts. The DOJ and FTC have signaled some flexibility in accounting for exigent circumstances when evaluating joint efforts to address the spread of COVID-19 and its aftermath, and they have established expedited procedures for providing guidance about how to ensure that those types of collaborations comply with federal antitrust laws. Any efforts to reach out to competitors should be carefully considered and the rationale for any such outreach should be documented and approved by senior management, with advice from internal or external counsel.
7. Avoid documentation pitfalls
Documentation should be drafted with the understanding that any written communication can turn into evidence years down the road. To that end, a company should remind employees that all documentation should be factual and avoid speculation, sarcasm, exaggeration, or a tone that could be misconstrued when read out of context at a later time. We recommend a few things:
- To the extent that documentation exists that overemphasizes risks, makes untrue allegations or can otherwise be taken out of context, it is important ensure that the documentary record reflects a corrective response.
- Companies should have their sales, accounts payable, accounts receivable and legal departments work together so that the written record of any contractual accommodations, payment discussions or assurances of future performance are consistent with the overall strategy of the company.
- Care should be taken when dealing with sources of financing, contractual counterparties, investors and the like to make sure that any assurances of future business or contractual performance are accurate and do not give rise to additional, unforeseen legal obligations.
- Companies should consider rolling out a revised working from home policy and should consider whether new tools for communication increase the risk that calls will be recorded.
***
In this time of unprecedented business disruption, maintaining robust governance and risk management practices will not only help companies overcome the day-to-day challenges presented by COVID-19, but will also prepare them to address the increased shareholder, counterparty, and regulatory scrutiny that will inevitably follow in the wake of the crisis. Small steps now can make a big difference later, and we encourage you to reach out to your usual Freshfields contact to discuss any COVID-19-related issues that are currently affecting your business, and for advice on how to prepare for issues that may arise in the future.
For more detail and practical tips for managing the impacts of COVID-19, please visit our coronavirus alert hub.
