Studio Notes
The plan you need before you have a bad day
Every firm will have one: a breach, a departure, a matter in the headlines. The firms that come through well decided how to respond before they had to.
Most firms have no crisis plan, for an understandable reason: nothing has gone wrong yet. Then, on a Friday afternoon, the IT provider reports a breach. Or a senior director resigns and takes a team. Or a journalist calls about a client matter. The firm finds itself making its most important communication decisions in its worst possible hours.
Three bad days you can see coming
The data breach
Firms hold exactly what attackers want: identity documents, financial records, details of deals that have not been announced. Under the Protection of Personal Information Act (POPIA), a firm that has reasonable grounds to believe personal information has been compromised must notify the Information Regulator and the people affected as soon as reasonably possible. Since 2025, reports to the Regulator go through its online portal. The legal duty is the easy part. The hard part is the call telling a client their information may be out, and that call goes far better when it has not been improvised.
The departure
When a director leaves, clients often hear it first from the director, in the director’s words. A firm that has not agreed what it will say, to whom and in what order loses the story, and sometimes even the clients.
The matter in the news
A client’s dispute becomes a story, or the firm itself is criticised. Confidentiality limits what you can say, which is exactly why you need to know in advance what you can say.
What the plan contains
It does not need to be thick. It needs to answer five questions before anyone is under pressure.
Who decides?
One person with authority to approve what is said, a named deputy, and a small group around them: the managing partner, IT, the partner responsible for the client and whoever handles communications. Not a committee of twenty.
Who speaks?
A single spokesperson who has been briefed, and a standing instruction that everyone else refers calls to them.
Who hears first?
Affected clients, then staff, then regulators where the law requires it, then the media. No client should learn about a problem from the press.
What can we say?
Short holding statements, drafted in calm and checked for confidentiality, that acknowledges the issue, says what is being done and commits to a time for the next update.
Where is everything?
Contact details for clients, insurers, forensic IT support, the firm’s own lawyers and the regulator. Keep a copy offline, because a breach may take your email down with it.
Then rehearse it. One hour a year, walking the key people through a realistic scenario, will expose the gaps faster than any document review.
How to sound on the day
Be quick, to-the-point and calm. Do not speculate and do not get defensive. “No comment” sounds like something to hide. “We are aware of the issue, we are investigating, and we will update affected clients directly by four o’clock” sounds like a firm in control.
Reputations are rarely lost in the crisis itself. They are lost in the first few hours of the response, when clients decide whether the firm seems honest and in command. A plan cannot stop the bad day from coming. It can make sure you are ready when it does.