What Internal Auditors Can Learn From the Blizzard, Measles, and Underinflated Footballs

During the early years of my intern​al audit career, the Internet did not exist. In some ways, those were the “good ol’ days!” Today, social media and the Internet make information sharing nearly instantaneous. Unfortunately, bad news often travels even faster. Therein lies a huge challenge for organizations and the internal auditors who serve them.

It would seem counter-intuitive to think that organizations would struggle with communications in today’s highly interconnected world. In reality, organizations large and small are under great pressure to communicate their key messages quickly, accurately, and efficiently — especially in times of crisis. The potential for reputational harm caused by poor crisis communications is often a bigger risk than the crisis itself.

On a daily basis, there are news headlines and stories about some new calamity that has befallen a well-known organization. How the players are portrayed in the press depends largely on their ability to handle crisis communications.

While internal auditors are not in the business of developing crisis communications plans, they should assess the risks associated with ineffective communications in the face of a crisis, and if appropriate, to provide assurance to management and the board on the adequacy of communication plans during and after a crisis.

As with any business-related risk, internal audit can help by identifying areas where an organization may be vulnerable, recognizing and mitigating high-risk behavior, and offering its insight when a crisis communications plan is being developed.

Three current events provide solid examples of the value of good crisis communications planning. One involves lots of frigid air, one involves an airborne virus, and the other is a matter of not enough air.

The blizzard of 2015 wreaked havoc on air travel in New York and parts of New England, one of the busiest travel corridors in the world. This type of weather delay is common for this time of year, and most airlines that serve the region announced flight delays and cancellations days before the first inch of snow had accumulated on the ground. Indeed, more than 24 hours before the worst of the forecasted wintery weather hit, most major airlines had announced fee waivers on itinerary changes.

These actions reflect the execution of well-designed communications and marketing plans for dealing with weather-related delays. Airline executives understand the value of managing expectations — acknowledging there will be cancellations and delays — and exhibiting empathy for their customers — waiving change fees. Imagine the potential reputational damage to the one airline that would refuse to waive such fees.

This brings up an important point about crisis communications plans. Organization should fashion plans that are specific to their needs. There is no cookie-cutter option. Keeping the blizzard of 2015 as an example, literally hundreds of thousands of businesses will be affected by the storm, and each should have a plan to deal not only with business disruptions but also with any crises that may develop.

A current measles outbreak provides an example of how indirect risk can lead to a communications crisis. The outbreak, which has infected 100 people in seven U.S. states as well as Mexico, appears to have originated with “patient zero” at a major west-coast theme park. While the theme park is named in most news accounts, a significant secondary impact has come from news reports that a number of patients received the standard measles vaccine and still became ill. This has created reputational repercussions for the vaccine maker, which already was under scrutiny about the vaccine’s efficacy.

The lesson for management and internal auditors here is that they must be cognizant of the risks underlying the cause of the crisis as well as the added risk of poor crisis communications.

Then there’s Deflate-gate. This is the controversy that plowed into the New England Patriots football franchise last week like an unblocked blitzing linebacker.

Soon after the Patriots overwhelmed the Indianapolis Colts in the AFC Championship game on Jan. 18, the NFL confirmed it was investigating whether the footballs used by the Patriots were underinflated. The league mandates footballs must be inflated within a specific range — 12.5 to 13.5 PSI. Apparently, underinflating can improve the grip on the ball in adverse weather conditions and make it easier to throw, and, indeed, the AFC Championship game in Foxborough, Mass., was played in a cold, driving rain.

I’m in no position to comment on the condition of the offending footballs, but the Patriots’ initial response to the allegations did little to pump up the organization. They appeared unprepared for the sudden controversy taking several days to communicate something that should have been announced clearly and forcefully on the very first day: We don’t cheat!

I’ll leave it up to the public-relations experts to comment on the effectiveness of the team’s response, but the internal audit lesson that should be taken from this is that having good communications protocols in place can help an organization mitigate reputational and other potential risks in a crisis. But proper execution of the plan also plays a vital role in its success.

As internal auditors, we should be assessing the full portfolio of risks our organizations face — including the risks of not addressing adversity swiftly and effectively. Don’t overlook the plan for addressing risks that come to fruition. After all, a delayed or ineffective response can often compound the impact of a risk.