An Overview of Professional Directors and Officers Liability in Disaster Preparedness and Recovery Planning

Transcription

1 An Overview of Professional Directors and Officers Liability in Disaster Preparedness and Recovery Planning Eric Martin Scott Southern University Law Center

2 Preparation for disasters involves a variety of measures, but one of the most important for corporations is planning for disasters before they happen. Disaster recovery and preparedness plans can minimize losses to assets such as property and capital as well as the all-important human asset. Disaster recovery and preparedness plans (also known as business continuity plans, "business resumption plans, or "emergency response plans") are formal documents outlining the policies, procedures and actions for dealing with various types of business disrupting events. Historically, during a catastrophic event, directors and officers were merely required to ensure their corporation was prepared according to its own emergency bylaws. But with events such as the 9/11 Attacks, Hurricane Katrina, and the current financial crisis, corporate directors and officers are increasingly obligated to evaluate whether the companies they serve have reasonable disaster preparedness and recovery plans in place. Directors and officers obligations to evaluate a corporation s disaster recovery and preparedness plans can arise from many sources. A company s stakeholders (such as shareholders, owners, employees and investors) can obligate them to safeguard revenues, retain market share, and protect corporate image and reputation. The prospect of an outside auditor s report can create an obligation to evaluate a corporation s disaster recovery and preparedness plans if the company aims to receive insurance coverage or business loans. Additionally, regulatory bodies that govern the corporation s industry can deem disaster recovery and preparedness plans a requirement for membership or compliance. For example, the Financial Industry Regulatory Authority, Inc. (FINRA) requires its firms to create and maintain business continuity plans. Federal legislation regarding the protection of corporate financial records can obligate directors and officers to evaluate a corporation s disaster recovery and preparedness plans. The Sarbanes-Oxley Act of 2002 has caused many companies 1

3 to develop disaster preparedness and recovery plans even though the law does not expressly mandate it. This is due to the financial document retention and control requirements found in the law. Thus, according to David M Hudanish, to ensure that information is both never lost and always available, companies must perform, [the] analysis, planning, management and implementation of safeguards that goes into developing and maintaining an effective business continuity and disaster recovery plan. 1 The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 further expanded the requirement for risk management regarding financial document retention for financial firms. Additionally, according to PricewaterhouseCoopers, nonfinancial companies that perform or service critical functions of the financial markets may be at risk for designation as [Technology Service Providers] subjecting them to new levels of supervision and examination that will include disaster recovery and going-concern plans. 2 Tasks Needed to Avoid Catastrophic Situations The primary task directors and officers of corporations need to undertake to avoid a catastrophic situation in a disaster is develop an action-plan. These plans must include steps to eliminate and minimize employee injury and death as well as damage to property. The first and most important task in a disaster action plan is to provide protection for people. There are two situations to plan for when a crisis occurs. One is where people, such as employees, visitors, and other third parties, are located in the business facility when the disaster strikes. The other is where personnel are located outside the business facility. 1 Hudanish, David M., Disaster Recovery and Business Continuity in an Evolving Regulatory Framework, Paper presented at the Georgetown University Law Center Continuing Legal Education 17th Annual Advanced Computer and Internet Law Institute, March 4-5, 2004, Washington, DC, 2004 WL , 4. 2 PricewaterhouseCoopers, A Closer Look at Dodd-Frank Wall Street Reform and Consumer Protection Act, (Dec. 2010), 2

4 The action plan for the former situation, according to the Federal Emergency Management Agency (FEMA), should include building evacuation, external sheltering, and sheltering-in-place. The latter situation will require planning for communication and contact coordination. This will be key for responding before, during and after a disaster or emergency. Much of this action is outlined at the Federal Government s Ready.gov website, but a few important points should be mentioned here. Primarily a disaster communication action plan should include, staff notification procedures, alternate communication methods, and a public relations plan. For staff notification procedures, directors and officers should ensure there is a process in place where personnel have a pre-determined list of other persons to contact and report to. Alternate communication methods should include land and mobile phones as well and Internet messaging groups through which members can make contact. A disaster public relations plan should include processes for contacting external communications groups such as the media, government bodies, and pertinent industry partners. While people are the primary assets of a business, the protection of physical assets such as facilities, inventory, and equipment is also highly important. The most important task to avoid or minimize property damage is facility preparation. This includes protecting all essential equipment and hazardous materials, ensuring alternate power sources such as generators, and developing an equipment evacuation plan. (The equipment evacuation plan must be developed to ensure that personnel are given adequate time to evacuate.) Additionally, a salvage plan should be developed because after a disaster, personnel may only be allowed a short window of time to return to the facility to recover any necessary items. This plan should include what important records and essential equipment is to be recovered. 3

5 To minimize business interruption during and after a disaster, directors and officers should ensure a Continuity of Operations Plan (COOP) is in place. The COOP plan must outline how the corporation will conduct its business operations. FEMA provides templates and instructions for developing COOP plans. 3 Essentially all COOP plans cover certain core ideas. The Scope of the plan outlines the types of threats the corporation plans to encounter and how its plan applies to divisions and personnel. The Functions List should describe what essential business functions must be maintained and their order of priority. The Activation section should resolve who has the power to determine when the corporation is facing a disaster and any steps for the delegation of authority during a crisis. The Relocation section should outline how and where to relocate the corporation s decision-making personnel and headquarters. A Recovery Process must also be determined to ensure the corporation can return to pre-disaster operation. Finally, directors and officers should not overlook how important a Training and Updates section is to ensure the corporation s COOP plan is up-todate on present threats and that personnel are properly trained and informed about it. Compensating Injured Employees and Families of Employees Killed in the Line of Work Despite having the best disaster preparedness and recovery plans that have employee protection in mind, directors and officers should plan for employee injuries and even deaths. Employers are responsible to maintain a safe work environment, and the Occupational Health and Safety Act (OSHA) ensures employees are provided safe working conditions. Also, states have various laws that protect injured employees and families of employees killed in the line of work

6 Each state s laws where the corporation has operations should therefore be investigated. Depending on the situation, a corporation may need to offset medical expenses for catastrophic injury and provide short or long-term care costs of injured employees. Workers' compensation may not provide full wage replacement and medical benefits to employees injured in the course of employment during a disaster. Thus, a corporation should plan to provide health and life insurance to reduce the risk of directly incurring medical and death expenses. Also, special policies may be necessary because of the uniqueness of the corporation s business and the disaster events it might encounter. Furthermore, directors and officers must plan to compensate any employees killed in the line of work during a disaster. Every state requires compensation owed to a deceased employee be paid to a legal representative. Generally, this payment must be made within a specific time period after the death or the corporation could face criminal charges, along with civil suits, if a delay is found to be intentional. Liabilities for Failing to Live Up to Your Obligations Corporate directors and officers face multiple liabilities in failing to live up to their obligations in evaluating whether the companies they serve have reasonable disaster preparedness and recovery plans in place. The first and foremost liability is to people. While there generally is no criminal liability for failing to plan for the protection of personnel in a disaster, the corporation could face civil liability if the failure is grossly negligent. Additionally, corporate directors and officers have liabilities to stakeholders. Shareholders could file a shareholders derivative suit against any officer or director for the failure to exercise reasonable business judgment in neglecting to 5

7 have a current disaster recovery plan. Employees could sue if injured while in the line of work, because they are unable to return to work or are uncompensated because the business is unable to operate after a disaster. Customers and suppliers could sue due to loss of their profits and business. Finally, state and federal regulators could file charges if the corporation is unable to comply with legislation because the corporation failed to retain regulated information or protect hazardous materials. Additionally, the IRS has tax reporting requirements for businesses that have suffered from a disaster. Insurance Available to Protect Directors and Officers from Catastrophe Liability While directors and officers may be held personally responsible for any failure of a corporation s disaster preparedness, there is insurance available to protect them. Director and officer (D&O) insurance is available to shield directors and officers from such liability. This insurance provides coverage when a director or officer commits a negligent act or omission and the policy provides coverage for liability exposure if they are sued as individuals. Coverage is also provided for the costs of defense such as legal fees and other court costs. Conclusion Now more than ever corporations must be prepared for devastating events. This means that directors and officers must ensure that plans are in place to deal with disasters. While the preparation of disaster recovery and preparedness plans can be time and labor intensive, it will be effort well spent when disaster strikes. 6