Introduction

This article provides an overview of crisis management through the lens of legal practice. While every crisis presents unique circumstances, clients, including Illinois-based corporations, commonly face certain recurring issues, ranging from personnel or financial crises to data security breaches. This article identifies themes and key considerations for navigating legal crises, along with practical strategies to minimise risk.

For lawyers representing clients in crisis situations, effective management requires more than legal advice; it demands rapid fact assessment, conflict identification, risk evaluation and the development of a comprehensive plan to simultaneously address legal, public relations and strategic concerns. Crises naturally escalate and expand. A single isolated issue can rapidly multiply by triggering copycat claims, regulatory and/or criminal investigations, media scrutiny and shareholder litigation. This compounding effect poses significant tactical challenges, as parallel proceedings and issues may conflict with one another. For example, public statements made to minimise reputational damage can later become evidence used against the client by investigators and plaintiffs.

Recent Legal Crises

Recognising a legal crisis is often not particularly difficult, given the urgency and public attention associated with such events. Rather, the difficulty can be understanding the nature of the crisis, how it affects the client, and the multiple potential or actual legal opponents. This section aims to highlight areas of recurring crises and identify potential risks stemming from each.

Personnel crises

Illinois continues to rank among the nation’s top destinations for corporate expansions and relocations, with 680 such projects in 2025 alone. The influx of new business headquarters and executive leadership may correspondingly expand the pool of C-suite executives subject to Illinois jurisdiction, potentially increasing the volume and complexity of litigation targeting corporate officers. This growth carries practical implications for corporate governance and crisis management.

Counsel for individuals must be prepared to advise on labour and employment implications, while company counsel must advise on personnel decisions, reputational damage mitigation and potential litigation against individuals. Companies that act swiftly to investigate (ideally through independent outside counsel) can:

• better control messaging;
• avoid conflicts of interest; and
• prepare for subsequent litigation by shareholders or other parties.

Personnel crises and scandals involving corporate executives can give rise to a wide range of legal, strategic, and public relations issues. These situations often involve uncomfortable, non-business matters that parties are reluctant to discuss and frequently present conflicts between the interests of the corporation and those of the individuals in leadership. Companies may pursue legal action against former executives for violations of severance agreements, such as non-compete provisions, or seek to recoup compensation through clawback provisions if additional misconduct is later discovered. Shareholders may bring derivative suits or demand accountability from the board.

For example, when the Chief Executive Officer and other senior executives of United Airlines were accused of misconduct in connection with the airline’s addition of a plane route, resulting in investigations by multiple governmental agencies, the authors counselled United’s Board of Directors through numerous business, regulatory, public relations, and other strategic considerations. This work was referenced in Turnaround Time, a 2023 book by Oscar Munoz, a former United Board member and CEO.

The authors also represented a Special Committee of the Board of Directors of a major multinational e-commerce company in connection with a criminal investigation into the conduct of several company employees.

In severe cases, the fallout from personnel scandals can lead to bankruptcy, sale of the company or significant restructuring, with victims of misconduct pursuing claims through bankruptcy proceedings or directly against individuals. Insurance may provide some protection for companies and executives, but reputational and financial consequences can be lasting. Companies must carefully weigh transparency against discretion in their public disclosures, recognising that their handling of such crises will be scrutinised by regulators, shareholders, and the public.

Financial crises

Financial crises create significant legal exposure for corporate clients beyond mere economic harm. When markets falter, companies frequently face shareholder litigation alleging mismanagement and breach of fiduciary duties by directors. No entity is immune. The 2008 housing collapse demonstrated how rapidly litigation can follow a financial crisis, with banks facing civil lawsuits, regulatory enforcement actions, criminal investigations and new layers of oversight. The financial toll was substantial, particularly in Illinois, where attorney general lawsuits against banks surged, and the Northern District of Illinois processed more federal foreclosure cases than any other district court by 2012.

The COVID-19 pandemic illustrated that financial crises can emerge even from unexpected sources. A public health emergency quickly transformed into a global economic catastrophe, forcing companies to make difficult decisions about furloughs, pay cuts and layoffs. The crisis also created fertile ground for fraud. By the end of 2020, government agencies had received thousands of fraud complaints, identified billions in questionable loans and launched over 100 investigations into COVID-19-related fraud and relief fund abuse.

For companies navigating a financial crisis, the central challenge is managing economic survival alongside legal risk. While corporations typically cannot prevent national financial downturns, the lesson from past crises is clear:

• assembling a coordinated legal strategy early;
• maintaining engagement with counsel; and
• keeping a focus on both business operations and legal exposure.

Data security breaches

Cybersecurity attacks and data security breaches are one of the most pressing threats facing businesses today. The scale of this threat is staggering: according to a 2024 report by the Federal Bureau of Investigation’s Internet Crime Complaint Centre, losses from reported cybercrimes exceeded USD16 billion, and Illinois ranked among the top ten states for cybercrime complaints. The consequences of such crises are particularly harmful, as they affect not only the business’s confidential information but also expose its customers’ personal information, which can be highly sensitive. These crises inflict lasting reputational damage and pose significant legal vulnerability, including class action lawsuits and regulatory enforcement actions.

In the event of a data breach, swift and coordinated action is paramount; it is essential that legal counsel is involved early to manage the response and take an active role in the investigation of the breach, typically working in tandem with digital data forensics specialists. Immediate priorities include promptly securing compromised systems, remediating vulnerabilities, and preserving all relevant evidence. The counsellor and client should work together to implement monitoring and response protocols. Throughout this process, counsel plays a critical role in navigating the complex web of legal obligations, from notifying affected customers within prescribed deadlines to filing required disclosures.

Beyond immediate crisis management, counsel should guide clients toward building lasting cyber resilience. This involves assessing internal controls and providing tailored recommendations to strengthen security. Clients should invest in dedicated cybersecurity expertise, whether by hiring professionals to vigilantly track and respond to emerging threats or by establishing specialised technology committees to drive improvements. In today’s cybersecurity landscape, a reactive posture is no longer sufficient; proactive defence is essential, which includes the advice of counsel.

Crises linked to AI

Artificial intelligence (AI) is rapidly transforming the corporate landscape, and Illinois is no exception. As AI capabilities continue to advance, businesses across industries are leveraging AI tools in their operations. In 2024 alone, corporate investments in AI reached USD252.3 billion, approximately a staggering 45% increase from the previous year. The global emerging AI market is projected to reach USD4.8 trillion by 2033, attracting an increasing number of businesses eager to make their mark in the AI industry.

AI has proven to enhance efficiency, improve accuracy, and reduce production costs. Yet, AI usage also carries a significant risk of crisis, which this section addresses alongside practical guidance. The heightened public scrutiny surrounding AI means that any crisis involving this technology is particularly susceptible to widespread media attention, litigation, and regulatory action. Counsel in this context plays a fundamental role, as counsel can bridge the knowledge gap between courts and regulators while applying established legal frameworks to achieve predictable outcomes and mitigate known risks.

AI models are frequently characterised as black boxes because their decision-making processes remain largely opaque, making it difficult to discern how conclusions were reached. Compounding this, AI systems may inadvertently learn biases and perpetuate biases embedded in their training data, leading to discriminatory outcomes. These transparency and bias concerns underscore the importance of establishing AI governance frameworks that incorporate human oversight and bias mitigation protocols to reduce the risk of a crisis.

AI has also become a weapon and a target in the cybersecurity arena. Malicious actors exploit AI to enhance cyberattacks, while AI models themselves remain vulnerable to breaches. Corporations must therefore conduct comprehensive risk assessments that account for AI threats and invest in cyber response training and security infrastructure aligned with this evolving landscape.

Inadvertent data leaks pose another significant risk because AI models learn from input data; thus, any information entered is effectively collected and retained. Corporations should implement employee policies to address AI and negotiate licensing agreements with providers that include appropriate data protections. Without such policies and safeguards, this exposure can give rise to intellectual property disputes and other legal complications.

The federal government and states have begun addressing AI through a fragmented patchwork of regulations. Businesses utilising AI models should therefore seek advice from counsel to ensure compliance. Illinois has enacted several laws regulating AI, including in the employment context. As AI continues to redefine how businesses operate, businesses must balance the pursuit of innovation with the risk of a crisis. Therefore, counsel is indispensable in mitigating inherent risks associated with AI.

General Considerations in Managing a Crisis

Managing a crisis is, by definition, a fast-paced and ever-changing task. This section aims to pinpoint critical steps and related considerations for a lawyer aiding a client in a crisis. To note, crisis management is not one-size-fits-all; every crisis is different. Nonetheless, there are some overarching principles to consider in managing a crisis.

Identification of the client

Identifying the client is an important task at the outset of any crisis, as a corporation is distinct from its individual officers, directors, and employees, including the Chief Executive Officer and General Counsel. Maintaining a clear understanding of the identity of the client at all times is essential to determining potential conflicts of interest and maintaining privilege. Furthermore, identifying the client is crucial to determining when independent counsel must be retained. Lastly, maintaining a clear understanding of the client’s identity can aid the investigation by focusing on the principal interest.

Investigation and information-gathering

Interviewing witnesses and gathering relevant documents are instrumental first steps toward understanding the scope of a crisis and its exposure risks. Due to time pressures associated with a crisis, it is imperative that a dedicated note-taker regularly circulate summaries of key findings to the legal team throughout the entire investigation to ensure real-time awareness of factual developments.

Following a crisis event, counsel should promptly identify and preserve all relevant documents by working with in-house counsel to locate key custodians and issue legal holds to preserve documents. Counsel must:

• consider all potential sources of documents, including:
1. email;
2. smartphones; and
3. instant messaging; as well as
• external sources obtainable through:
1. formal discovery;
2. public records requests; or
3. other methods, such as temporary restraining orders or preliminary injunctions.

Counsel should assemble and train a document review team.

When producing documents, counsel should consider legal obligations and possible cooperation with regulatory bodies. Counsel should also negotiate Rule 502(d) orders to protect against inadvertent privilege waiver and maintain careful records of all preservation, collection and production activities. Finally, counsel should designate a core internal client team with institutional knowledge to assist in gathering, while carefully considering whether to include public relations professionals in privileged communications, given inconsistent court treatment of such communications.

Witness interviews are essential to legal crisis management, enabling counsel to:

• assess credibility;
• reconstruct timelines; and
• identify key documents and information sources.

When selecting interviewees, counsel should evaluate each individual’s relationship to the crisis and prioritise current employees for logistical ease and stronger privilege protections, while deferring interviews of key witnesses and executives until document review provides sufficient context.

Preparation is critical: counsel should review relevant documents and develop detailed outlines that cover the background and substantive questions. All interviews should be memorialised with counsel’s impressions of the witness’s testimony and demeanour, as memoranda that merely recount facts without mental impressions risk losing work product protection. Every interview should include an Upjohn warning clarifying (i) that counsel represents the company, not the witness, (ii) that the communication is privileged and (iii) that the company controls and may waive that privilege.

Third-party witness interviews require particular caution because communications with external parties are generally not privileged and carry disclosure risks. Joint defence or common interest agreements may provide protection where parties share aligned interests in the matter.

Educating and informing the client

Communication with the client is essential during a crisis. Counsel should establish regularly scheduled meetings with the core attorney team and client representatives knowledgeable about relevant subject matter areas related to the crisis.

For corporate clients, counsel may offer formal updates to the board of directors or audit committee and prepare agendas, talking points, and presentations with necessary background information. Counsel and the client should contact each other in real-time as issues arise. To avoid communication breakdown during the demanding periods of crisis management, counsel must respond to all client-initiated communications as quickly as possible.

Communications and public relations

Managing public communications during a corporate crisis requires careful coordination between counsel and the client. A single spokesperson should be designated to ensure consistent messaging, with the selection depending on the nature of the crisis. Options include existing public liaisons, in-house counsel or outside counsel, though individuals involved in the crisis or facing potential criminal liability should not serve in this role. For high-profile matters, clients should consider retaining professional public relations agencies to prepare statements and press releases.

Privilege protection is a critical concern throughout the crisis. Public disclosure of privileged communications can result in a waiver of the attorney-client privilege, and this risk is heightened when third-party public relations firms are involved, as communications with such consultants may not be protected unless their services are predominantly legal rather than standard public relations. Counsel should establish clear employee guidelines instructing staff to direct all questions to counsel, avoid discussing the matter with colleagues or outside parties, and exercise caution with emails, informal communications, and social media.

Media coverage should be tracked closely, as it may reveal additional witnesses, issues for investigation, or concerns related to venue transfer motions and jury selection. A member of the legal team should be assigned to set up news alerts and monitor social media platforms for relevant commentary. For publicly traded companies, counsel must also prepare clients to handle investor inquiries in compliance with Regulation Fair Disclosure, ensuring that any information shared with investors is also disclosed to the public to avoid selective disclosure issues and potential securities claims.

All public communications should be accurate, consistent, and aligned with the legal strategy. In some situations, declining to comment may be the best approach.

Business considerations

Effective crisis management requires counsel to anticipate business considerations regarding how a client’s response will be scrutinised in future litigation, government investigations and by outside parties. Disclosure obligations are a critical and often-overlooked concern: public companies must evaluate how a crisis affects SEC filings, including Form 8-K triggers and issues like loss contingencies and liquidity, while companies in regulated industries or with government contracts may face additional reporting requirements. Failure to comply can result in civil or criminal liability, investigations, shareholder suits or debarment.

Insurance and indemnification should be assessed early, as coverage can shape litigation strategy, and firm deadlines for tendering claims must be observed to preserve defence and indemnity rights. Auditor communications require careful management to avoid both certification issues and inadvertent waiver of privilege, since documents shared with auditors may lose attorney-client protection.

Preparing for Crisis Litigation

Early attention to litigation risks is a key step of effective crisis management. Before litigation begins, companies should preserve documents and data, identify key witnesses, select litigation counsel and begin developing litigation themes. Building a compelling case narrative is essential throughout the crisis response, as research indicates juries decide cases by comparing competing stories. Counsel should prepare detailed chronologies and craft factually accurate narratives that incorporate recognisable themes – whether emphasising remedial efforts or highlighting patterns of misconduct – to frame the case persuasively.

Expert witnesses play a critical role in crisis litigation, helping counsel assess the situation, develop sound theories and identify relevant information for future claims and defences. Retaining experts early allows clients to secure the most qualified individuals in the field and may prevent opponents from engaging particularly damaging experts first. However, because jurors are often sceptical of expert testimony, especially when opposing experts contradict each other, it is important to select experts who are not only well-credentialed but are also clear communicators capable of connecting with lay audiences.

Corporations should also anticipate heightened shareholder scrutiny during a crisis. Plaintiffs’ lawyers frequently use statutory “books and records” demands to investigate potential wrongdoing, and shareholders may examine documents for breach of fiduciary duty claims against the board. As the case law is unclear on whether investigative reports shared with the board will waive privilege, corporations should take steps to preserve it, such as having counsel:

• conduct investigations directly;
• limiting distribution of materials; and
• including legal analysis throughout related documents.

Crisis Prevention

Organisations can better avoid and manage crises by establishing a strong corporate culture supported by a robust compliance infrastructure. This begins with senior leadership setting the appropriate tone at the top by:

• communicating that legal consultation is encouraged;
• employees will not be penalised for raising concerns; and
• formal policies require engagement with in-house or outside counsel in key situations such as:
1. threatened litigation;
2. contract negotiations; or
3. receipt of legal process.

A well-resourced ethics and compliance office with direct reporting lines to senior leadership should develop and implement a comprehensive code of conduct and related policies that address anti-bribery, gifts and entertainment, Foreign Corrupt Practices Act compliance, government contracts, whistleblower protections and anonymous reporting mechanisms.

These efforts should be reinforced through employee training programmes tailored to risk exposure, along with documented certifications confirming employees’ agreement to abide by company policies. Together, these structural and cultural elements help prevent fraud, ensure regulatory compliance, and provide employees with clear guidance and accessible resources for navigating ethical concerns.

Conclusion

Effective crisis management requires lawyers to act swiftly and strategically, balancing competing interests across legal, regulatory, public relations and business domains while maintaining clear communication with clients and coordinating multidisciplinary teams. As illustrated by the categories of recurring crises ranging from personnel crises to data breaches, crises have a natural tendency to escalate – thus, making early preparation, thorough investigation and the development of a coherent narrative essential to mitigating liability and protecting corporate reputation. Ultimately, the most effective crisis response begins long before a crisis occurs through:

• robust compliance programmes; employee training; and
• a corporate culture that encourages transparency and early escalation of potential problems.

The authors would like to thank Melissa Braunstein and Nicole Leon-Elvir, associates at Willkie Farr & Gallagher, for their assistance in preparing this article.