Key Takeaways
- In the first hours of a crisis, the guiding rule is first do no harm: avoid categorical denials and premature interviews before the facts and documents are in hand.
- Day one should cover the key stakeholders, who is in charge, regulatory notification duties in every relevant jurisdiction, consistent messaging, mitigation steps, and document preservation.
- Common mistakes include investigating without knowing local interview and data-protection rules, overpromising to regulators, and creating notes or memos that read like admissions.
An executive is arrested, agents arrive with a search warrant, a cyberattack takes down systems, or a damaging allegation goes viral. What should a company do, and avoid doing, in the first day or two?
In this TalksOnLaw Brief, Joel Cohen talks with two experienced investigations lawyers: Olivia Radin, then a partner at Freshfields and now a partner in the Special Matters and Government Investigations practice at King & Spalding, and Kimberly Zelnick, a partner at Freshfields who heads its financial institutions disputes group. They lay out a practical roadmap for the first 24 to 48 hours of a corporate crisis.
First, Do No Harm
The guests' first principle is to do no harm. There is often an impulse to announce that there is no problem, to tell regulators the allegations are flatly untrue, or to declare that the company is shocked and will fire those responsible. The trouble, they explain, is that the company is speaking before it has the facts. The same goes for rushing to interview senior people about allegations before reviewing their documents and knowing what else is out there, which can make a situation far worse. Because commercial and brand pressures can pull against legal caution, they stress coordinating public relations with legal counsel from the start.
The Day-One Checklist
The guests outline what a company should settle early. Identify the key stakeholders, including regulators, banks, customers, shareholders, and the board, and decide what each will be told. Determine on day one who is in charge of the investigation. Map regulatory notification obligations in each country and for each regulator, and keep messaging consistent, since a report required in one jurisdiction usually means reporting in all of them. Prepare mitigation measures, such as new controls or monitoring. Get ready for incoming complaints with call centers, scripts, and a standing press statement. Preserve relevant documents by working with IT so nothing is destroyed. Finally, make an initial assessment of legal obligations and exposure, and keep updating it as the facts develop.
Mistakes to Avoid
Do not investigate without knowing the local rules: some jurisdictions restrict witness interviews or the collection of personal data. Do not overpromise to regulators and then underdeliver; a crisis is a marathon, not a sprint. Do not give in to pressure for knee-jerk public statements about what did or did not happen, since the company may lack a good factual basis for some time. And do not create documents that add to the problem: notes and memoranda should capture the nuance in the record rather than shorthand that reads like an admission.
What to Know Now
The guests' framework remains sound, and several later developments make the early hours even more consequential. Since December 2023, public companies have had to report a material cybersecurity incident on Form 8-K under Item 1.05 within four business days of determining that it is material. In May 2025, the Justice Department's Criminal Division revised its Corporate Enforcement and Voluntary Self-Disclosure Policy to give companies that promptly self-report, cooperate, and remediate a clearer path to a declination, so the decision whether and when to approach authorities carries real weight. Preservation now routinely extends to messaging apps and personal devices, which federal prosecutors consider in evaluating compliance programs. Data-protection laws continue to shape cross-border investigations. The balance the guests describe, moving quickly on process while staying careful about conclusions, is still the core of a good crisis response.
