What you need to know
- In-house legal teams are increasingly central to crisis management. Not just as advisers, but as decision-makers who bring clarity when it matters most.
What you need to do
- Build your crisis ‘toolkit’ now. Crisis plans, playbooks, escalation paths and draft communications shouldn’t be written for the first time under pressure.
- Invest in trust before you need it. Establish relationships within your crisis team and with key stakeholders so you can act decisively when things go wrong.
- Learn from every crisis, even if it isn’t yours. Post-incident reviews drive better risk management, updated playbooks and smarter investment decisions.
Data breaches. Insolvency. Shifting regulations. Geopolitical curveballs. In-house legal teams face a more volatile landscape than ever. When crises hit, they need to stay calm and deliver clear, principled guidance - fast.
Reach by Ashurst Perkins Coie and the Association of Corporate Counsel (ACC) recently hosted a series of roundtables across Australia and in London. Across four sessions, we explored how in-house legal teams prepare for crises, manage real-time responses, and create value after an incident.
Setting the scene
Before the roundtables, we surveyed more than 300 Reach consultants for their insights. We then put the same questions to our roundtable participants.
Our first question: how ready is your organisation? As figure 1 shows, most respondents said their organisations were mostly (44%) or somewhat (46%) prepared for a crisis.
As figure 2 shows, organisations are putting their money where their mouth is: some (54%) or many (25%) are investing in crisis management. And 80% of our surveyed Reach consultants (many of whom work across different in-house teams) have noticed a step-up in crisis preparation.
So what’s keeping in-house lawyers up at night? As figure 3 shows, three issues stood out: regulatory or political scrutiny (67%), data privacy and information governance (58%), and cybersecurity (54%).
These findings come as no surprise.
Regulatory environments are growing more complex by the day. Add a volatile global landscape, heightened domestic political scrutiny and rising geopolitical risks - including supply chain vulnerabilities - and you have a potent mix.
Privacy breaches spell serious reputational and financial risk. In Australia, the Office of the Australian Information Commissioner received 532 data breach notifications in the first half of 2025 alone.
Cybersecurity incidents are surging globally. The UK’s National Cyber Security Centre reported a 50% jump in 'highly significant' incidents in 2025.
Roundtable observations
Our four roundtables brought together in-house lawyers and guest speakers from across the spectrum: large global teams, smaller national teams, and sole counsels. Collectively, they represented a broad spread of industries, from financial and professional services to logistics, energy, FMCG and healthcare.
Crisis management preparation strategies
‘We treat crisis readiness as an operational capability… The question is not if pressure or disruption will arise, but how prepared we are to respond when it does.’ – Roundtable speaker
Participants told us many organisations have carved out a ‘crisis HQ’ role for their in-house legal teams. The most common governance model? A single crisis leader responsible for decision-making, backed by a small executive team and subject matter experts - including lawyers.
Board support proved crucial, participants noted. One speaker observed that ‘board engagement improves significantly when crisis readiness is positioned as a resilience and value protection capability rather than as a defensive spend’. Another shared how they had used an external supplier to win board buy-in.
Trust matters. And it needs to be built before a crisis strikes. Participants stressed the importance of crisis teams building relationships with each other and maintaining trust with key stakeholders by avoiding silence, delay and inconsistencies when things go wrong.
One speaker shared their organisation’s success in mapping a limited number of ‘credible, high consequence scenarios’ - serious safety events, major asset failures, cyberattacks, data compromise, regulatory enforcement and industrial action.
The toolkit for crisis management is extensive: crisis plans, materiality thresholds, playbooks, checklists, draft communications, escalation paths and decision prompts. But as one participant cautioned: ‘Don't do your first draft of anything during a crisis’.
Other essentials? Regular scenario testing, clear roles and responsibilities, media training for spokespeople, and on-call external experts in the right time zones and jurisdictions.
Some participants explored how tech powers ‘wargaming’, including the use of ethical hackers. Others flagged the need for analogue backup: printed materials, separate communication channels, and dedicated devices not linked to networks.
Successful management of crises
‘In a crisis, general counsels often take the lead because of their broad visibility of the business and their understanding of regulatory frameworks.’ – Roundtable speaker
When a crisis breaks, organisations often turn to their in-house legal teams first. Lawyers advise, decide, manage stakeholders and engage with regulators - often all at once.
What skills and behaviours do in-house legal teams need in these pressured moments? Participants identified many, but one speaker’s advice stood out: stay calm and favour decisiveness over perfection. They added: ‘We need to be explicit about what we know, what we don’t, and what we are assuming. We also need to provide conservative, defensible guidance early, even if it is later refined. There’s false comfort in waiting for “full clarity” because it rarely arrives’.
With regulators potentially watching, managing information flows becomes critical. Especially when ‘facts are uneven and emotions are high’, as one participant put it.
Activities that add-value after an event
‘The most important shift after a crisis is moving from incident closure to organisational learning – without sliding into blame or defensiveness.’ – Roundtable speaker
We asked participants: what does success look like after an incident?
For many, success means avoiding regulatory investigations and litigation, echoing the survey findings on regulatory scrutiny and reputational damage. However, participants also pointed to broader measures: employee wellbeing, contained costs, time, reputation and stakeholder confidence, and operational recovery.
Post-incident reviews emerged as vital. These typically assess: what happened and why, who was involved (and who should have been), how long each action took, risk exposures and outcomes. Done well, they drive improved risk management, updated playbooks, and positive policy and cultural change. They can also shape future investment decisions.
One participant offered a sharp insight: ‘It doesn't need to be your crisis’ to provide valuable lessons.
The takeaways
The message from our survey and roundtables is clear: in-house legal teams are both firefighters and forward-thinkers when it comes to organisational crises.
In-house legal teams sit at the epicentre of a crisis, and for good reason. They know their organisation inside out, understand its regulatory and legal obligations, and bring technical, communication and analytical skills to the table. As one speaker summed it up: ‘When a crisis breaks, legal often becomes the balancing point. The value of legal is not in being the conscience of the organisation: it’s in being a driver of clarity.’
What’s keeping lawyers in the hot seat up at night? Regulatory, data privacy and cybersecurity risks. But there’s a silver lining: organisations are increasingly investing in crisis readiness. The tide is turning from reactive firefighting to proactive forward-thinking.
Author: Linda Grace, Partner and Head of Reach.
Want to know more?
- Blurred boundaries: the changing nature of in-house legal teams (23 July 2025). The role of in-house legal teams are increasingly becoming broader, more business-embedded, and multi-disciplinary in nature. Explore the measures taken by teams successfully blurring traditional boundaries.
