Counsel need a triage plan when responding to possible reputation damage to firm: GC retreat panel

Disclaimer: This article was originally published by Canadian Lawyer Magazine. It has been reproduced with permission.  

Having an up-to-date and comprehensive policies and procedures guide can be an in-house counsel lawyer’s best friend in managing firm reputations when the stakes are high, delegates to the Canadian Corporate Counsel Association annual retreat were recently told.

“This is not a situation where you want to be making it up as you go along,” said Andres Duran, who has worked as senior legal counsel for organizations such as Ellis Don, SNC-Lavalin, and Infrastructure Ontario.

Duran was commenting on a hypothetical situation presented to him in which the chair of a fictional firm’s board of directors’ contacts in-house counsel, saying the board has received a letter from a lawyer representing a female employee who claims she had an unwanted sexual relationship with the CEO for the last six months.

The scenario goes on to say that the female employee requests a third-party investigation, and if one is not set up, she will have no choice but to go to the media.

Duran and other panel presenters were asked how best to handle this delicate situation – managing staff, executives, media, and the general public.

“Clearly, your code of conduct is your roadmap,” said Duran. “The more detailed, the better.” He added in-house counsel should also be clear on the reporting structure of any investigation and the protocols required.

Labour and employment lawyer Christine Thomlinson, co-founder and co-managing partner of Rubin Thomlinson LLP, said one intriguing aspect of the scenario presented is that the employee had gone to a lawyer early in the process.

 “That signals to me there’s not a culture of trust, where employees feel there’s somebody they can go to” in this hypothetical scenario.

She added that a lot of her firm’s work is “to go into organizations and look at their system to see how they work and what happens when issues [like these] come up.

“Do employees know what they can do? Do they have faith in the system?” she asked, adding that it may come to light that even if there is a clear policy, perhaps not all employees have read or understand it or didn’t pay attention to it at the time.

“So, you learn a lot about how you can really bolster the kinds of things that organizations have in place to address issues like this,” she said, ensuring everyone is up to speed on the code of conduct at their workplace.

Panel moderator Ryan Duquette, national leader of digital forensics with session sponsor MNP, a professional services firm, told the audience that as a forensic investigator, he advises that similar to an incident response plan for cyber breaches, firms should have a response plan in place prior to an incident. Part of that response plan is preserving evidence because “it’s of the utmost importance."

Duquette, a former police officer with expertise in cybersecurity and fraud, also noted that these days, “so much evidence involved in a case like this is digital” – whether on computers or cell phones. And such evidence can be “very volatile and disappear very quickly.”

He also discussed how gathering the necessary evidence can be complicated in workplaces with “bring your own device” policies and the potential difficulty in accessing those personal devices to preserve evidence.

Duran said he has a two-page checklist that helps him triage responses to situations like the scenario. “Is there a PR risk? Is there theft? Is it a sexual harassment issue? Is there a potential for criminal liability?”

The answers to these questions “will guide you,” he said, and the checklist should help make decisions on who will be involved in the investigation and the level of in-house counsel’s involvement in the matter, or should external legal counsel be brought in.

Duran said he would “absolutely” want external counsel involved in the specific scenario presented. “That would be my first or second phone call,” he said. Making that call can help establish a “chain of privilege” and what expertise is needed., because “you’re going to need expert help.”

However, Duran said while dealing with such a scenario is something you don’t want to do alone, “you have to be very careful” in keeping the investigation limited to a “close group of people who are clearly instructed.” This type of workplace incident can attract a lot of gossip, so “you need to keep things very tight.”

Thomlinson noted that parameters for an external investigation must also be clear – “what you need, what you want, and what you hope to get at the end.”

She gave as an example a case where a company is retaining an external investigator and deciding on the mandate. If the case is going to have “far-reaching implications” that could involve litigation, the company might not want the investigator to conduct a policy analysis or make recommendations, as this could interfere with their litigation strategy later.

It might make more sense for the investigator to stick to factual findings (i.e. “did this happen?”) and let the company decide what to make of those findings. This way, if the case goes to litigation, the company doesn’t have to worry about an investigator’s report that says something that doesn’t support their litigation strategy.

These are the kinds of decisions Thomlinson encourages organizations to think about when retaining external investigators.