In the early 2000s, The LEGO Group was on the verge of collapse.
It sounds hard to believe today, since the company is one of the largest and most successful toy sellers in the world. But in 2003, the Denmark-based company was on the brink of insolvency, with massive debt and a negative cash flow of DKK $1 billion.
LEGO needed new leadership. It promoted Jørgen Vig Knudstorp, a former consultant, to CEO. Along with Chief Financial Officer Jesper Ovesen — a former banker — Knudstorp gradually righted the ship by instilling organizational discipline and forming a strong financial foundation for the company.
The new executives were brutally honest with LEGO’s board and employees about the challenges the company faced. To survive, everyone needed to focus on turning things around, correcting the company’s problems so they could plan its future.
That required clear thinking and a dose of reality.
“Before LEGO could even begin to reignite a sense of what was possible for LEGO, they first had to persuade people that decades of unfettered growth offered no assurance that the company would ever get its groove back,” writes David Robertson in “Brick by Brick: How LEGO Rewrote the Rules of Innovation and Conquered the Global Toy Industry.”
Crises come in all shapes and sizes. They can be small and isolated in a single company, like LEGO’s need to refocus itself after years of mismanagement. Or they can be caused by broader, external factors that affect industries and economies.
No matter the source, crises call for strong leadership. The coronavirus pandemic is just the latest example.
Carla Harris, vice chairman of wealth management and a senior client advisor at Morgan Stanley, shares what leaders today must do to weather the current crisis in a discussion that kicks off Microsoft’s Envision Virtual Forum for Financial Services.
First, great leaders are visible, says Harris. “There’s something powerful in being able to see the person that you’re following.”
They’re also transparent and empathetic. Employees and other stakeholders “want to see empathy, but they also want to see confidence and positivity,” she says. It’s an uncertain environment, and we’re all feeling a wide range of emotions due to the health and economic consequences of this crisis.
“One of the biggest learning moments for me as a leader was watching financial services leadership during the financial crisis. There were some leaders who didn’t really say anything to their people, and there were some leaders who were out front every day,” she says. Harris has spent over three decades on Wall Street, joining Morgan Stanley in 1987. “There was a regular cadence that people came to rely on, and that was frankly empowering.”
While the unfolding crisis is unique even among crises, with an especially broad range of potential outcomes, leaders have arguably never been better equipped from a technology standpoint to take action. Companies may be locked down for the most part, with employees largely working remotely, but leaders can still communicate directly with staff. For example, Boston-based State Street Corp. uses video conferencing technology to host virtual forums where employees can interact with senior executives to get answers to their questions.
Harris also recommends that leaders be flexible in today’s environment and open themselves up to input from diverse viewpoints. Strategic goals may shift in response to the Covid-19 environment, or leaders may need to consider new ways to achieve their objectives. “Don’t have rigid views of what you think things are going to look like on the other side” of this crisis, she says. “This is the time now to be an inclusive leader, and the hallmark of being an inclusive leader is to solicit other peoples’ voices.”
I’d suggest one addition to the actions Harris outlines, based on my conversations with business leaders like Horst Schulze, the co-founder and former president of the Ritz-Carlton Hotel Co.
Lead with purpose.
There is no one-size-fits-all personality for leaders, and leadership skills are developed over time. But all great leaders share one trait: They have a vision and inspire employees to achieve it.
“We need leadership,” says Schulze. “Leadership implies, ‘I have a destination in mind.’ It means, ‘I show my people the destination, and I show them how it’s beautiful for them, how it’s great for them, how it’s exciting for them, how they should join me in reaching that destination.’”
Great leaders are rare. But in times like these, they can be the difference between surviving a crisis or thriving despite it.
Crisis planning is getting more attention these days because we are constantly reminded of events that could not only impact our business, but have significant impact on our reputations. One data breach and we stand to lose faith in our ability to safeguard our clients’ money. While planning is expected, bankers could really get value from practice in two areas: 1) tabletop exercises and 2) media training. Tabletop exercises are role playing crisis scenarios whereby bank management gets on a conference call and develops responses, assigns roles, identifies tasks and develops timelines. Banks would benefit from doing this on a quarterly basis. Media training allows bank executives to learn how to look and respond appropriately to a tense situation only after they learn how to answer questions and the ground rules for working with the media. Turn on a video camera and see how well your team does. Crisis planning is better if treated as an ongoing discipline.
Testing, testing and more testing! Banks typically have multiple plans that can be triggered in the event of a significant cyber-related “crisis,” including, for example, a business continuity plan, incident response plan and crisis communication plan. Multiple groups within a bank likely have responsibility for these plans. And, the plans may not be aligned from a response standpoint with respect to significant cyber events. In the event of such a crisis, it is critical for a bank to be able to respond in a uniform and effective way at the enterprise level. Bringing a bank’s various teams together to test or tabletop a significant cyber event can shed light on how the bank’s various plans (and teams) will work together. This will also provide a valuable opportunity for refinement and alignment of the bank’s related response plans.
Business continuity and disaster recovery considerations are an important component of a bank’s business model. In addition to preparing for natural disasters and other physical threats, continuity also means preserving access to customer data and the integrity and security of that data in the face of cyberattacks. For this reason, the FDIC encourages banks to practice responses to cyber risk as part of their regular disaster planning and business-continuity exercises. They can use the FDIC’s cyber challenge program, which is available on the 
Banks can improve planning by developing a crisis plan ahead of a data breach or cybersecurity issue. These action plans should include:
Though banks understand the risk of cyberattacks, many are unprepared to act quickly and effectively to mitigate damage when faced with a serious cyber breach. To improve crisis planning, banks should consider conducting simulated cybersecurity exercises involving key personnel. Moving quickly following a cyber breach is critical to limiting unauthorized access to sensitive data and the resulting harm. Such exercises demonstrate why an effective cybersecurity program is more than an “tech issue,” and requires coordinated institutional mobilization across business segments, with oversight from senior management. Most banks will eventually find themselves in a hacker’s crosshairs no matter how advanced their defenses, and a coordinated, rapid response will not only limit short-term data loss and legal exposure, but will also help preserve a bank’s reputation and customer relationships.
Planning activities generate lots of documents, which are fascinating to auditors but useless in an emergency. You don’t have to give planning reports to your response team. Your phone is a perfect emergency communications console. Social media, including Twitter, YouTube and even Facebook, are indispensable as communications tools. You can monitor events as they unfold or push messages out to staff and public. Cyber is the new disaster. Compare today’s threat assessment with one from 2010. Notice that blizzards and hurricanes have dropped out of the top ten, replaced by data breaches and identity theft.
The list of notable organizations who have suffered a cyberattack is all too familiar. The likelihood of joining that list—whether by malware, ransomware or data breach—increases almost daily.
As described in the investigative report, GM executives adopted a decision process forever identified as the “GM nod,” where everyone would nod in agreement with a proposal and then leave the room without having established responsibility and accountability for the decision made. The lesson for any company is to insist, from the top-down, on responsibility and accountability. By comparison, Alan Mulally famously reformed Ford’s culture to reward those who accurately reported risks and mistakes and took responsibility. The results have showed up in quality of the products of each company and the perception of these companies in the market. These lessons can certainly inform management at banks, particularly with regard to the bank’s risk culture. The first line of defense in any bank to managing risks is in the line of business itself, which should be held accountable by senior management and the board of directors for appropriately identifying and mitigating risks. This should not be left to the auditors, examiners, and risk managers to instill risk management discipline.
A slow reaction to a problem can result in more than just a bad day in the office. The biggest headline was not the recall. The media focused on the fact that General Motors knew about the problem long before the recall and failed to react resulting in lawsuits, congressional hearings and calls for boycotts, all of which have negatively impacted the automaker’s reputation and bottom line. Bankers should take notice of such missteps in responding to potential cyber-attacks launched at their institutions. It is not enough to simply have security measures in place. Directors also need to ensure that their institutions have proper response policies to react quickly to minimize potential damage to customers and to take corrective measures to address the cyber-attacks head on. Failing to respond in a timely manner can result in more than just a few angry customers and can expose the banks to regulatory and legal penalties.
It appears there was little enterprise risk management stressed and in place at General Motors. The General Motors situation has taught us the need to encourage/require employees at any level of a bank hierarchy immediately to report problems so that material issues can be handled and solved by executive management with reports, if necessary going to the full board. Bank employees must not hide material issues. When discovered, the issues may lead to very embarrassing situations for the bank and its parent.
GM probably learned a few lessons from the experience of the banking industry and was more prepared to navigate the horror of becoming a public whipping boy. When something has gone terribly wrong inside a large organization, it’s terribly important to get on top of the facts as soon as possible. And that’s not easy. To avoid embarrassment and compounding the problem, you have to resist the temptation to speak before you have assembled the facts. Measure your statements carefully, and support them with facts identified by an investigation by an outside firm and reported to the board or committee of the board charged with overseeing the investigation. [CEO] Mary Barra deserves serious praise for her authentic brand of leadership in the midst of a corporate crisis.
The GM ignition switch debacle is nothing new and merely underscores a series of well-known precepts that directors should internalize as official bank policy. Playing ostrich never works. Problems must be faced, not ignored in the hope they will disappear. Cover-ups never work either. The underlying problem always comes to light, and the consequences in terms of reputation risk, regulatory risk, and legal risk end up being exacerbated, and any judgments and penalties enhanced. When an issue is identified by any employee, including even the lowest level employee, steps must be taken by management promptly to investigate the issue and, if it is significant, bring it to the board’s attention and implement a strategy to address it. The board should have a crisis management policy in place for handling really serious issues; this will entail assembling a team of specialists to handle the public relations, compliance, security, IT, and legal components of the problem, including where necessary, an internal investigation.
More than most companies, banks rely on the trust and confidence of the public. The 81-year-old deposit insurance program has made Depression-era bank runs, where frightened depositors once lined the street waiting to withdraw their money, a relic of the past. But there’s a new risk that the deposit insurance system can’t protect against—the theft of sensitive customer information by cyber crooks—and banks of all sizes need to have a crisis management plan at the ready in case they get hacked.
For bank executives and directors, crisis situations can take many forms. In the post-financial meltdown environment, there are an ever-growing number of crises that can arrive at your door. Your bank does not have to be on the verge of failure to face a crisis. A bad examination, an inquiry from the SEC, a data security breach, a money laundering or lending discrimination allegation or a major compliance issue could make you feel like the sky is falling. Advance preparation can go a long way in helping you effectively sort through and address these issues. When your institution is faced with one — or increasingly a combination — of these issues, the key is not to lose your head. Instead, pause and then implement these five basic steps: